| Numeric
Range Match Conditions |
|
keyword-except
|
Negates a match—for example, destination-port-except number.
The following keywords accept the -except extension: destination-port, dscp, esp-spi, forwarding-class, fragment-offset, icmp-code, icmp-type, interface-group, ip-options, packet-length, port, precedence, protocol and source-port.
|
|
destination-port number
|
Matches a TCP or User Datagram Protocol (UDP) destination port
field. You cannot specify both the port and destination-port match conditions in the same term. Normally, you specify this match
in conjunction with the protocol tcp or protocol udp match statement to determine which protocol is being used on the
port.
In place of the numeric value, you can specify a text synonym.
For example, you can specify telnet or 23.
|
|
esp-spi spi-value
|
Matches an IPSec encapsulating security payload (ESP) security
parameter index (SPI) value. Match on this specific SPI value. You
can specify the ESP SPI value in either hexadecimal, binary, or decimal
form.
|
|
forwarding-class class
|
Matches a forwarding class. Specify assured-forwarding, best-effort, expedited-forwarding, or network-control.
|
|
fragment-offset number
|
Matches the fragment offset field.
|
|
icmp-code number
|
Matches the ICMP code field. Normally, you specify this match
condition in conjunction with the protocol icmp match statement
to determine which protocol is being used on the port.
This value or keyword provides more specific information than icmp-type. Because the value's meaning depends on the associated icmp-type, you must specify icmp-type along with icmp-code.
In place of the numeric value, you can specify a text synonym.
For example, you can specify ip-header-bad or 0.
|
|
icmp-type number
|
Matches the ICMP packet type field. Normally, you specify this
match condition in conjunction with the protocol icmp match
statement to determine which protocol is being used on the port.
In place of the numeric value, you can specify a text synonym.
For example, you can specify time-exceeded or 11.
|
|
interface-group group-number
|
Matches the interface group on which the packet was received.
An interface group is a set of one or more logical interfaces. For
information about configuration interface groups, see the JUNOS Policy Framework Configuration Guide.
|
|
packet-length bytes
|
Matches the length of the received packet, in bytes. The length
refers only to the IP packet, including the packet header, and does
not include any Layer 2 encapsulation overhead.
|
|
port number
|
Matches a TCP or UDP source or destination port field. You cannot
specify both the port match and either the destination-port or source-port match conditions in the same term. Normally,
you specify this match condition in conjunction with the protocol tcp or protocol udp match statement to determine which
protocol is being used on the port.
In place of the numeric value, you can specify a text synonym.
For example, you can specify bgp or 179.
|
|
precedence ip-precedence-field
|
Matches the IP precedence field. You can specify precedence
in either hexadecimal, binary, or decimal form.
In place of the numeric value, you can specify a text synonym.
For example, you can specify immediate or 0x40.
|
|
protocol number
|
Matches the IP protocol field. In place of the numeric value,
you can specify a text synonym. For example, you can specify ospf or 89.
|
|
source-port number
|
Matches the TCP or UDP source port field. You cannot specify
the port and source-port match conditions in the
same term. Normally, you specify this match condition in conjunction
with the protocol tcp or protocol udp match
statement to determine which protocol is being used on the port.
In place of the numeric value, you can specify a text synonym.
For example, you can specify http or 80.
|
| Address
Match Conditions |
|
address prefix
|
Matches the IP source or destination address field. You cannot
specify both the address and the destination-address or source-address match conditions in the same term.
|
|
destination-address prefix
|
Matches the IP destination address field. You cannot specify
the destination-address and address match conditions
in the same term.
|
|
destination-prefix-list prefix-list
|
Matches the IP destination prefix list field. You cannot specify
the destination-prefix-list and prefix-list match
conditions in the same term.
|
|
prefix-list prefix-list
|
Matches the IP source or destination prefix list field. You
cannot specify both the prefix-list and the destination-prefix-list or source-prefix-list match conditions in the same term.
|
|
source-address prefix
|
Matches the IP source address field. You cannot specify the source-address and address match conditions in the
same rule.
|
|
source-prefix-list prefix-list
|
Matches the IP source prefix list field. You cannot specify
the source-prefix-list and prefix-list match conditions
in the same term.
|
| Bit-Field
Match Conditions with Values |
|
fragment-flags number
|
Matches an IP fragmentation flag. In place of the numeric value,
you can specify a text synonym. For example, you can specify more-fragments or 0x2000.
|
|
ip-options number
|
Matches an IP option. In place of the numeric value, you can
specify a text synonym. For example, you can specify record-route or 7.
|
|
tcp-flags number
|
Matches a TCP flag. Normally, you specify this match condition
in conjunction with the protocol tcp match statement
to determine which protocol is being used on the port. In place of
the numeric value, you can specify a text synonym. For example, you
can specify syn or 0x02.
|
| Bit-Field
Text Synonym Match Conditions |
|
first-fragment
|
Matches the first fragment of a fragmented packet. This condition
does not match unfragmented packets.
|
|
is-fragment
|
Matches the trailing fragment of a fragmented packet. It does
not match the first fragment of a fragmented packet. To match both
first and trailing fragments, you can use two terms, or you can use fragment-offset 0-8191.
|
|
tcp-established
|
Matches a TCP packet other than the first packet of a connection.
This match condition is a synonym for "(ack | rst)".
This condition does not implicitly check that the protocol is
TCP. To do so, specify the protocol tcp match condition.
|
|
tcp-initial
|
Matches the first TCP packet of a connection. This match condition
is a synonym for "(syn & !ack)".
This condition does not implicitly check that the protocol is
TCP. To do so, specify the protocol tcp match condition.
|
