Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Firewall Filter Nonterminating Actions

Firewall filters support different sets of nonterminating actions for each protocol family, which include an implicit accept action. In this context, nonterminating means that other actions can follow these actions whereas no other actions can follow a terminating action. As such, you cannot configure the next term action with a terminating action in the same filter term. You can, however, configure the next term action with another nonterminating action in the same filter term.

Table 1 describes the nonterminating actions you can configure for a firewall filter term.

Table 1: Nonterminating Actions for Firewall Filters

Nonterminating Action

Description

Protocol Families

count counter-name

Count the packet in the named counter.

  • family any

  • family inet

  • family inet6

dont-fragment (set | clear)

Configure the value of the Don’t Fragment bit (flag) in the IPv4 header to specify whether the datagram can be fragmented:

  • set—Change the flag value to one, preventing fragmentation.

  • clear—Change the flag value to zero, allowing fragmentation.

Note:

The dont-fragment (set | clear) actions are supported only on MPCs.

family inet

dscp value

Set the IPv4 Differentiated Services code point (DSCP) bit. You can specify a numerical value from 0 through 63. To specify the value in hexadecimal form, include 0x as a prefix. To specify the value in binary form, include b as a prefix.

The default DSCP value is be (best effort), or 0.

You can also specify one of the following text synonyms:

  • af11—Assured forwarding class 1, low drop precedence (1)

  • af12—Assured forwarding class 1, medium drop precedence (2)

  • af13—Assured forwarding class 1, high drop precedence (3); and so on through af43, Assured forwarding class 4, high drop precedence

  • be—Best effort

  • cs0—Class selector 0; and so on through cs7, Class selector 0

  • ef—Expedited forwarding

Note:

MPC line cards running on MX series routers support any value (from 0 to 63) in conjunction with the set dscp firewall filter action.

family inet

force-premium

By default, a hierarchical policer processes the traffic it receives according to the traffic’s forwarding class. Premium, expedited-forwarding traffic, has priority for bandwidth over aggregate, best-effort traffic. The force-premium filter ensures that traffic matching the term is treated as premium traffic by a subsequent hierarchical policer, regardless of its forwarding class. This traffic is given preference over any aggregate traffic received by that policer.

Note:

The force-premium filter option is supported only on MPCs.

  • family any

  • family inet

  • family inet6

forwarding-class class-name

Classify the packet to the named forwarding class:

  • forwarding-class-name

  • assured-forwarding

  • best-effort

  • expedited-forwarding

  • network-control

  • family any

  • family inet

  • family inet6

hierarchical-policer

Police the packet using the specified hierarchical policer

  • family any

  • family inet

  • family inet6

log

Log the packet header information in a buffer within the Packet Forwarding Engine. You can access this information by issuing the show firewall log command at the command-line interface (CLI).

Note:

The Layer 2 (L2) families log action is available only for MX Series routers with MPCs (MPC mode if the router has only MPCs, or mix mode if it has MPCs and DCPs). For MX Series routers with DPCs, the log action for L2 families is ignored if configured.

  • family inet

  • family inet6

loss-priority (high | medium-high | medium-low | low)

Set the packet loss priority (PLP) level.

You cannot also configure the three-color-policer nonterminating action for the same firewall filter term. These two nonterminating actions are mutually exclusive.

For IP traffic on MX Series routers with Enhanced II Flexible PIC Concentrators (FPCs), you must include the tri-color statement at the [edit class-of-service] hierarchy level to commit a PLP configuration with any of the four levels specified. If the tri-color statement is not enabled, you can only configure the high and low levels. This applies to all protocol families.

  • family any

  • family inet

  • family inet6

next

 Continue to the next term in a filter.

  • family inet

  • family inet6

next-ip ip-address

Direct packets to the specified destination IPv4 address.

family inet

next-ip6 ipv6-address

Direct packets to the specified destination IPv6 address.

family inet6

policer policer-name

Name of policer to use to rate-limit traffic.

  • family any

  • family inet

  • family inet6

port-mirror instance-name

Port-mirror the packet based on the specified family. This action is supported on M120 routers, M320 routers configured with Enhanced III FPCs, MX Series routers, and PTX Series Packet Transport Routers only.

We recommend that you do not use both the next-hop-group and the port-mirror actions in the same firewall filter.

  • family any

  • family inet

  • family inet6

routing-instance routing-instance-name

Direct packets to the specified routing instance.

  • family inet

  • family inet6

sample

Sample the packet.

Note:

Junos OS does not sample packets originating from the router. If you configure a filter and apply it to the output side of an interface, then only the transit packets going through that interface are sampled. Packets that are sent from the Routing Engine to the Packet Forwarding Engine are not sampled.

  • family inet

  • family inet6

service-accounting

Use the inline counting mechanism when capturing subscriber per-service statistics.

Count the packet for service accounting. The count is applied to a specific named counter (__junos-dyn-service-counter) that RADIUS can obtain.

The service-accounting and service-accounting-deferred keywords are mutually exclusive, both per-term and per-filter.

  • family any

  • family inet

  • family inet6

service-accounting- deferred

Use the deferred counting mechanism when capturing subscriber per-service statistics. The count is applied to a specific named counter (__junos-dyn-service-counter) that RADIUS can obtain.

The service-accounting and service-accounting-deferred keywords are mutually exclusive, both per-term and per-filter.

  • family any

  • family inet

  • family inet6

service-filter-hit

(Only if the service-filter-hit flag is marked by a previous filter in the current type of chained filters) Direct the packet to the next type of filters.

Indicate to subsequent filters in the chain that the packet was already processed. This action, coupled with the service-filter-hit match condition in receiving filters, helps to streamline filter processing.

  • family any

  • family inet

  • family inet6

syslog

Log the packet to the system log file.

The syslog firewall action for existing inet and inet6 families, and the syslog action in L2 family filters includes the following L2 information:

Input interface, action, VLAN ID1, VLAN ID2, Ethernet type, source and destination MAC addresses, protocol, source and destination IP addresses, source and destination ports, and the number of packets.

Note:

The L2 families syslog action is available only for MX Series routers with MPCs (MPC mode if the router has only MPCs, or mix mode if it has MPCs and DCPs). For MX Series routers with DPCs, the syslog action for L2 families is ignored if configured.

  • family inet

  • family inet6

three-color-policer (single-rate | two-rate) policer-name

Police the packet using the specified single-rate or two-rate three-color-policer.

Note:

You cannot also configure the loss-priority action for the same firewall filter term. These two actions are mutually exclusive.

  • family inet

  • family inet6

traffic-class value

Specify the traffic-class code point. You can specify a numerical value from 0 through 63. To specify the value in hexadecimal form, include 0x as a prefix. To specify the value in binary form, include b as a prefix.

The default traffic-class value is best effort, that is, be or 0.

In place of the numeric value, you can specify one of the following text synonyms:

  • af11—Assured forwarding class 1, low drop precedence

  • af12—Assured forwarding class 1, medium drop precedence

  • af13—Assured forwarding class 1, high drop precedence

  • af21—Assured forwarding class 2, low drop precedence

  • af22—Assured forwarding class 2, medium drop precedence

  • af23—Assured forwarding class 2, high drop precedence

  • af31—Assured forwarding class 3, low drop precedence

  • af32—Assured forwarding class 3, medium drop precedence

  • af33—Assured forwarding class 3, high drop precedence

  • af41—Assured forwarding class 4, low drop precedence

  • af42—Assured forwarding class 4, medium drop precedence

  • af43—Assured forwarding class 4, high drop precedence

  • be—Best effort

  • cs0—Class selector 0

  • cs1—Class selector 1

  • cs2—Class selector 2

  • cs3—Class selector 3

  • cs4—Class selector 4

  • cs5—Class selector 5

  • cs6—Class selector 6

  • cs7—Class selector 7

  • ef—Expedited forwarding

  • family inet6

Related Documentation