| Numeric Range
Match Conditions |
|
keyword-except
|
Negates a match—for example, destination-port-except number.
The following keywords accept the -except extension: destination-port, dscp, esp-spi, forwarding-class, fragment-offset, icmp-code, icmp-type, interface-group, ip-options, packet-length, port, precedence, protocol and source-port.
|
|
destination-port number
|
Matches a TCP or User Datagram Protocol (UDP) destination port field.
You cannot specify both the port and destination-port match
conditions in the same term. Normally, you specify this match in conjunction
with the protocol tcp or protocol udp match statement
to determine which protocol is being used on the port.
In place of the numeric value, you can specify a text synonym. For example,
you can specify telnet or 23.
|
|
esp-spi spi-value
|
Matches an IPSec encapsulating security payload (ESP) security parameter
index (SPI) value. Match on this specific SPI value. You can specify the ESP
SPI value in either hexadecimal, binary, or decimal form.
|
|
forwarding-class class
|
Matches a forwarding class. Specify assured-forwarding, best-effort, expedited-forwarding,
or network-control.
|
|
fragment-offset number
|
Matches the fragment offset field.
|
|
icmp-code number
|
Matches the ICMP code field. Normally, you specify this match condition
in conjunction with the protocol icmp match statement to determine
which protocol is being used on the port.
This value or keyword provides more specific information than icmp-type.
Because the value's meaning depends on the associated icmp-type,
you must specify icmp-type along with icmp-code.
In place of the numeric value, you can specify a text synonym. For example,
you can specify ip-header-bad or 0.
|
|
icmp-type number
|
Matches the ICMP packet type field. Normally, you specify this match
condition in conjunction with the protocol icmp match statement to
determine which protocol is being used on the port.
In place of the numeric value, you can specify a text synonym. For example,
you can specify time-exceeded or 11.
|
|
interface-group group-number
|
Matches the interface group on which the packet was received. An interface
group is a set of one or more logical interfaces. For information about configuration
interface groups, see the JUNOS Policy Framework Configuration Guide.
|
|
packet-length bytes
|
Matches the length of the received packet, in bytes. The length refers
only to the IP packet, including the packet header, and does not include any
Layer 2 encapsulation overhead.
|
|
port number
|
Matches a TCP or UDP source or destination port field. You cannot specify
both the port match and either the destination-port or source-port match
conditions in the same term. Normally, you specify this match condition in
conjunction with the protocol tcp or protocol udp match
statement to determine which protocol is being used on the port.
In place of the numeric value, you can specify a text synonym. For example,
you can specify bgp or 179.
|
|
precedence ip-precedence-field
|
Matches the IP precedence field. You can specify precedence in either
hexadecimal, binary, or decimal form.
In place of the numeric value, you can specify a text synonym. For example,
you can specify immediate or 0x40.
|
|
protocol number
|
Matches the IP protocol field. In place of the numeric value, you can
specify a text synonym. For example, you can specify ospf or 89.
|
|
source-port number
|
Matches the TCP or UDP source port field. You cannot specify the port and source-port match
conditions in the same term. Normally, you specify this match condition in
conjunction with the protocol tcp or protocol udp match
statement to determine which protocol is being used on the port.
In place of the numeric value, you can specify a text synonym. For example,
you can specify http or 80.
|
| Address Match
Conditions |
|
address prefix
|
Matches the IP source or destination address field. You cannot specify
both the address and the destination-address or source-address match
conditions in the same term.
|
|
destination-address prefix
|
Matches the IP destination address field. You cannot specify the destination-address and address match
conditions in the same term.
|
|
destination-prefix-list prefix-list
|
Matches the IP destination prefix list field. You cannot specify the destination-prefix-list and prefix-list match
conditions in the same term.
|
|
prefix-list prefix-list
|
Matches the IP source or destination prefix list field. You cannot specify
both the prefix-list and the destination-prefix-list or source-prefix-list match
conditions in the same term.
|
|
source-address prefix
|
Matches the IP source address field. You cannot specify the source-address and address match
conditions in the same rule.
|
|
source-prefix-list prefix-list
|
Matches the IP source prefix list field. You cannot specify the source-prefix-list and prefix-list match
conditions in the same term.
|
| Bit-Field Match
Conditions with Values |
|
fragment-flags number
|
Matches an IP fragmentation flag. In place of the numeric value, you
can specify a text synonym. For example, you can specify more-fragments or 0x2000.
|
|
ip-options number
|
Matches an IP option. In place of the numeric value, you can specify
a text synonym. For example, you can specify record-route or 7.
|
|
tcp-flags number
|
Matches a TCP flag. Normally, you specify this match condition in conjunction
with the protocol tcp match statement to determine which protocol
is being used on the port. In place of the numeric value, you can specify
a text synonym. For example, you can specify syn or 0x02.
|
| Bit-Field Text
Synonym Match Conditions |
|
first-fragment
|
Matches the first fragment of a fragmented packet. This condition does
not match unfragmented packets.
|
|
is-fragment
|
Matches the trailing fragment of a fragmented packet. It does not match
the first fragment of a fragmented packet. To match both first and trailing
fragments, you can use two terms, or you can use fragment-offset 0-8191.
|
|
tcp-established
|
Matches a TCP packet other than the first packet of a connection. This
match condition is a synonym for "(ack | rst)".
This condition does not implicitly check that the protocol is TCP. To
do so, specify the protocol tcp match condition.
|
|
tcp-initial
|
Matches the first TCP packet of a connection. This match condition is
a synonym for "(syn & !ack)".
This condition does not implicitly check that the protocol is TCP. To
do so, specify the protocol tcp match condition.
|
