Access Control Lists (Firewall Filters)
Read this topic to learn about Layer 2 access control lists (Firewall filters) in the Cloud-Native Router.
Access Control Lists (Firewall Filters)
Cloud-Native Router includes firewall filter capability for bridge family traffic. L2 ACL support is enhanced in this release to align with L3 and L4 ACL capabilities. You can configure the filters using the Junos OS CLI within the Cloud-Native Router controller, using NETCONF, or the Cloud-Native Router APIs. You can also configure firewall filters using node annotations and custom configuration templates at the time of Cloud-Native Router deployment. See the deployment guide for more details.
During deployment, the system defines and applies firewall filters to block traffic from passing directly between the router interfaces. You can dynamically define and apply more filters. Use the firewall filters to:
-
Define firewall filters for bridge family traffic.
-
Define filters based on one or more of the following fields: source MAC address, destination MAC address, or EtherType.
-
Define multiple terms within each filter.
-
Apply terminating actions: accept, discard, or routing-instance.
-
Apply nonterminating actions: count, log, or syslog.
-
Apply filters to bridge domains.
The L2 ACL changes in this release are not backward compatible with the previous releases. The show firewall output format has changed, and the vRouter acl utility now requires the bridge family to be explicitly specified. Review your existing L2 ACL configuration before upgrading.
Cloud-Native Router supports the following match conditions for bridge family firewall filters:
| Match Condition | Description |
|---|---|
source-mac-address |
Match the source MAC address of the packet. |
destination-mac-address |
Match the destination MAC address of the packet. |
ether-type |
Match the EtherType field in the Ethernet frame. You can specify the EtherType
as a keyword (for example, arp, ipv4,
ipv6) or as a hexadecimal value (for example,
0x0800 for IPv4). |
Cloud-Native Router supports the following actions for bridge family firewall filter terms:
| Type of Action | Supported Actions | Description |
|---|---|---|
| Terminating | accept |
Accept the packet. |
discard |
Discard the packet silently, without sending an ICMP message. | |
routing-instance
routing-instance-name |
Direct the packet to the specified routing instance. | |
| Nonterminating | count
counter-name |
Count the packet in the named counter. Use count only with a
terminating action in the same term. |
log |
Log the packet header information in a buffer within the Packet Forwarding
Engine. Access this information using the show firewall log
command. |
|
syslog |
Log the packet to the system log file. |
accept with count in a single term.set system syslog file jcnr-firewall.log any any set system syslog file jcnr-firewall.log match-strings "JCNR-FIREWALL"
set system syslog file messages_firewall_any match-strings "JCNR-FIREWALL"
Configuration Example
The following example shows a bridge family firewall filter that matches IPv4 traffic (EtherType 0x0800) and accepts it while counting matched packets.
-
Configure the interface for bridge family traffic in access mode on VLAN 700:
set interfaces enp3s0 unit 0 family bridge interface-mode access set interfaces enp3s0 unit 0 family bridge vlan-id 700
-
Configure the firewall filter:
set firewall family bridge filter testL2TermMod term term1_src_dst_mac from ether-type 0x0800 set firewall family bridge filter testL2TermMod term term1_src_dst_mac then count l2_term1_stats set firewall family bridge filter testL2TermMod term term1_src_dst_mac then accept
-
Configure the virtual switch routing instance, associate the interface, configure the bridge domain, and apply the filter to the bridge domain:
set routing-instances vswitch instance-type virtual-switch set routing-instances vswitch interface enp3s0 set routing-instances vswitch bridge-domains bd700 vlan-id 700 set routing-instances vswitch bridge-domains bd700 forwarding-options filter input testL2TermMod
-
Commit the configuration:
commit
The complete configuration looks like this:
root@jcnr01> show configuration firewall
firewall {
family {
bridge {
filter testL2TermMod {
term term1_src_dst_mac {
from {
ether-type 0x0800;
}
then {
count l2_term1_stats;
accept;
}
}
}
}
}
}After configuration, you must apply your firewall filters to a bridge domain using the
set routing-instances vswitch bridge-domains bd-name
forwarding-options filter input filter-name configuration
command. Then commit the configuration for the firewall filter to take effect.
Cloud-Native Router Controller Commands
The following commands can be used on the Cloud-Native Router controller to view bridge family firewall filter information.
Display all firewall filters for family bridge:
user@host> show firewall family bridge
Display a specific firewall filter for family bridge:
user@host> show firewall family bridge filter testL2TermMod Filter : testL2TermMod Counters Packet Bytes l2_term1_stats 19 1484
Display all firewall filters across all families:
user@host> show firewall
Clear counter statistics for bridge family:
clear firewall family bridge clear firewall family bridge filter filter-name clear firewall family bridge filter filter-name count counter-name
View firewall logs:
user@host> show firewall log [JCNR-FIREWALL]: Mar 20 08:08:45 hostname feb FW: ge-1/1/0.0 A icmp 192.168.207.222 192.168.207.223 0 0 (1 packets)
View syslog messages:
user@host> show log messages_firewall_any [JCNR-FIREWALL]: Mar 20 08:08:45 hostname feb FW: ge-1/1/0.0 A icmp 192.168.207.222 192.168.207.223 0 0 (1 packets)
show firewall output format for bridge family in this release is
aligned with the L3 ACL format. It displays the filter name and named counter with packet
and byte counts. In earlier releases, the output displayed the filter name, vlan-id, term
name, and packet count. This change is not backward compatible.Release 25.4 output format:
show firewall filter filter1 Filter : filter1 vlan-id : 3001 Term Packet t1 0
Release 26.2 output format:
show firewall family bridge filter testL2TermMod Filter : testL2TermMod Counters Packet Bytes l2_term1_stats 19 1484
vRouter Commands
The following commands can be used on the vRouter to view bridge family firewall filter
configuration and state. Run these commands from inside the
contrail-vrouter-agent-dpdk container or using the
contrail-tools container.
List all bridge family ACL filters:
bash-5.2# acl --list-filters --family bridge ======================================= Filter: testL2TermMod ======================================= Term: term1_src_dst_mac ----- Priority: 256 Dst MAC: 52:54:00:28:bb:cf/48 Action: accept (n/a) Action: count (l2_term1_stats) =======================================
Display a specific bridge family filter term:
bash-5.2# acl --family bridge --filter testL2TermMod --term term1_src_dst_mac ======================================= Filter: testL2TermMod ======================================= Term: term1_src_dst_mac ----- Priority: 256 Dst MAC: 52:54:00:9a:bb:24/48 Src MAC: 52:54:00:0f:99:97/48 Action: accept (n/a) Action: count (l2_term1_stats) =======================================
List all ACL actions (counters) across all families including bridge:
bash-5.2# acl --list-actions
bridge filter "testL2TermMod": Counter "l2_term1_stats"
Rx Packets: 19 Rx Bytes: 1714The complete set of acl command options now includes
bridge as a supported family:
acl --list-filters --family <inet/inet6/mpls/bridge> acl --list-actions [--core <core number>] acl --family <inet/inet6/mpls/bridge> --filter <name> [--list-terms] acl --family <inet/inet6/mpls/bridge> --filter <name> [--term <name>] acl --family <inet/inet6/mpls/bridge> --filter <name> [--action <name>] [--core <core number>] acl --family <inet/inet6/mpls/bridge> --filter <name> [--action <name>] [--core <core number>] --clear acl --help
bridge was not a supported family value for the
acl command. You must now explicitly specify --family
bridge to view bridge family ACL filters. Display the bridge domain table to verify filter attachment:
The bd --dump output includes a Filter Name column that
shows the filter attached to each bridge domain.
bash-5.2# bd --dump
Bridge Domain (BD) Table
--------------------------------------------------------------------------------------------
VRF VLAN BD BD Name Filter Name
--------------------------------------------------------------------------------------------
1 100 2 vswitch_bd100 -
1 200 3 vswitch_bd200 -
1 300 4 vswitch_bd300 -
1 400 5 vswitch_bd400 -
1 700 1 vswitch_bd700 testL2TermMod
--------------------------------------------------------------------------------------------The Filter Name column shows the name of the filter applied to the bridge domain via the
forwarding-options filter input configuration. A dash (-) indicates no
filter is applied to that bridge domain.
Troubleshooting
The following table lists some of the potential problems that you might face when you implement firewall rules or ACLs in the cloud-native router. You run most of these commands on the host server.
| Problem | Possible Causes and Resolution | Command |
|---|---|---|
| Firewall filters or ACLs not working | gRPC connection (port 50052) to the vRouter is down. Check the gRPC connection. |
netstat -antp|grep 50052 |
The ui-pubd process is not running. Check whether
ui-pubd is running. |
ps aux|grep ui-pubd |
|
| Firewall filter or ACL show commands not working | The gRPC connection (port 50052) to the vRouter is down. Check the gRPC connection. |
netstat -antp|grep 50052 |
| The firewall service is not running. |
ps aux|grep firewall |
|
show log filter.logYou must run this command in the JCNR-controller (cRPD) CLI. |