ON THIS PAGE
Example: Configuring a Filter to Set the DSCP Bit to Zero
This example shows how to configure a standard stateless firewall filter based on the Differentiated Services code point (DSCP).
Requirements
No special configuration beyond device initialization is required before configuring this example.
Overview
In this example, you use a stateless firewall filter to match
packets on DSCP bit patterns. If the DSCP is 2, the packet
is classified to the best-effort forwarding class, and
the DSCP is set to 0. If the DSCP is 3, the
packet is classified to the best-effort forwarding class.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
To configure this example, perform the following tasks:
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Stateless Firewall Filter to a Logical Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following
configuration commands into a text file, remove any line breaks, and
then paste the commands into the CLI at the [edit] hierarchy
level.
set firewall filter filter1 term 1 from dscp 2 set firewall filter filter1 term 1 then forwarding-class best-effort set firewall filter filter1 term 1 then dscp 0 set firewall filter filter1 term 2 from dscp 3 set firewall filter filter1 term 2 then forwarding-class best-effort set interfaces so-0/1/0 unit 0 family inet filter input filter1
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter filter1:
Create the stateless firewall filter.
[edit] user@host# edit firewall filter filter1
Configure the first term to match a packet with a DSCP of
2, change the DSCP to0, and classify the packet to thebest-effortforwarding class.[edit firewall filter filter1] user@host# set term 1 from dscp 2 user@host# set term 1 then forwarding-class best-effort user@host# set term 1 then dscp 0
Configure the other term to match a packet with a DSCP of
3and classify the packet to thebest-effortforwarding class.[edit firewall filter filter1] user@host# set term 2 from dscp 3 user@host# set term 2 then forwarding-class best-effort
Apply the Stateless Firewall Filter to a Logical Interface
Step-by-Step Procedure
To apply the stateless firewall filter to the logical interface corresponding to the VPN routing and forwarding (VRF) instance:
Configure the logical interface to which you will apply the stateless firewall filter.
[edit] user@host# edit interfaces so-0/1/0 unit 0 family inet
Apply the stateless firewall filter to the logical interface.
[ input filter1] user@host# set filter input filter1
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall filter filter1 { term term1 { from { dscp 2; } then { forwarding-class best-effort; dscp 0; } } term term2 { from { dscp 3; } then { forwarding-class best-effort; } } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces so-0/1/0 { unit 0 { family inet { filter input filter1; } } }If you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working properly, enter the following operational mode commands:
show class-of-service—Displays the entire class-of-service (CoS) configuration, including system-chosen defaults.show class-of-service classifier type dscp—Displays only the classifiers of the DSCP for IPv4 type.