Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

show-firewall-configuration

Syntax

Description

When firewall filters are configured, an optimization operation is performed on the configuration. The optimization process may merge or eliminate the terms of filters. This can lead to differences between the configured filters and the filters programmed in the hardware.

  • Use the show firewall configuration firewall firewall filter name information-type configured | compiled command to display a CLI filter’s configured information or this same firewall filter’s information after its compilation/optimization.

  • Use the show firewall configuration firewall firewall filter name information-type configured | compiled application application-name command to display a non-CLI filter’s (such as a BGP FlowSpec firewall filter) configured information or this same firewall filter’s information after its compilation/optimization.

Note:

Use set firewall enable-filter-debug to enable this feature.

Options

  • application application name—The owner application of the firewall filter. The application names are:

    • cosd—Cosd filters

    • firewalld—Cli filters

    • jdhcpd—Jdhcpd filters

    • l2cpd—L2cpd filters

    • lsp—Lsp filters

    • p4-switch—P4-switch filters

    • ppmd—Periodic packet management daemon

    • routing (RPD)—BGP flowspec filters

  • information-type

    • configured—Display configured information of the filter

    • compiled—Display compiled information of the filter

Required Privilege Level

view

Output Fields

Table 1: <show firewall configuration filter <filter-name> information-type configured/compiled> Output Fields
Field Name Field Description

Filter

Name of the filter

Number Of Terms

The number of terms in the filter

App Name

The owner application of the firewall filter

Family Name

The firewall filter family

Interface/Instance Specific

True if the firewall filter is interface or instance specific. False otherwise.

Fast Lookup

True if the firewall filter is a Fast Lookup filter. False otherwise.

Scale Mode

True if scale-mode setting has been applied on the firewall filter. False otherwise.

No Incremental Update

True if no-incremental-update setting has been applied on the firewall filter. False otherwise.

Layer2 Policer

True if layer2-policer setting is applied on this firewall filter. False otherwise.

Term

Name of the firewall filter term

Status

Status of the firewall filter term. For e.g. Available indicates that the firewall filter term will be retained after optimization/compilation. Will get discarded in optimized filter indicates that the firewall filter term will be removed during the optimization/compilation process.

Match Conditions

Shows the firewall filter match conditions

Actions

Shows the firewall filter actions

Sample Output

<show firewall configuration filter <filter-name> information-type configured>

In the following example, after a CLI filter f1 is configured, issuing show firewall configuration filter f1 information-type configured displays the following output.

<show firewall configuration filter <filter-name> information-type compiled>

show firewall configuration filter f1 information-type configured showed the details of the firewall filter named f1 before optimization/compilation. show firewall configuration filter f1 information-type compiled shows the details of this firewall filter after optimization/compilation.

<show firewall configuration filter <filter-name> information-type configured application <application-name>

The following example displays a sample output of a non-CLI firewall filter, an implicit filter, such as a BGP Flowspec firewall filter f1 when issuing show firewall configuration filter f1 information-type configured application routing command. Because this is a BGP Flowspec firewall filter managed by the routing application, you specify the application name as routing. The application name is indicated by App Name in the output. Below each term in the output, the status field indicates how the term will be optimized. As is indicated in the sample output, the following terms will get optimized:

  • Term *,*,proto=4—Will get merged to term *,*,proto=3 in optimized filter due to similar Match Conditions/Actions

<show firewall configuration filter <filter-name> information-type compiled application <application-name>>

show firewall configuration filter f1 information-type configured application routing command showed the details of the firewall filter named f1 before optimization/compilation. show firewall configuration filter f1 information-type compiled application routing shows the details of this firewall filter after optimization/compilation. Before optimization/compilation, the following terms were identified for optimization.

  • Term *,*,proto=4—Will get merged to term *,*,proto=3 in optimized filter due to similar Match Conditions/Actions

After optimization/compilation, as can be noted in the sample output:

  • *,*,proto=4 and *,*,proto=3 were merged and *,*,proto=4 is removed.

Release Information

Command introduced in Junos OS Release 25.2R1