Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Example: Configuring a Filter for Use as an Ingress Queuing Filter

This example shows how to configure a firewall filter for use as an ingress queuing filter. The ingress queuing filter assists in traffic shaping operations by enabling you to set the forwarding class and packet loss priority, or drop the packet before ingress queue selection. The firewall filter must be configured within one of the following protocol families: bridge, cc, inet, inet6, mpls, or vpls and have one or more of the following actions: accept, discard, forwarding-class, and loss-priority.


Although the ingress queuing filter can be used with EX9200 switches and T-Series routers as well as MX-Series routers, it is used only on those MX Series routers that have MPCs. An error is generated at commit if the ingress queuing filter is applied to an interface on any other type of port concentrator.


This example uses the following hardware and software components:

  • An MX Series router with MPC

In order for ingress queuing filters to function, ingress-and-egress must be configured as the traffic-manager mode at the [edit chassis fpc slot pic slot traffic-manager mode] hierarchy level.


In this example, you create a firewall filter named iqfilter1 in the inet protocol family that sets the loss priority and forwarding class of packets coming from the network. You then apply the iqfilter1 filter to the ge-0/0/0.0 logical interface as an ingress queuing filter.

To configure a firewall filter and apply it for use as an ingress queuing filter involves:

  • Creating a firewall filter named iqfilter1 in the inet protocol family with the following two actions: forwarding-class and loss-priority.

  • Applying the firewall filter to the ge-0/0/0.0 interface as an ingress queuing filter.


CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Configuring the Firewall Filter and Applying It to an Interface as an Input Queuing Filter

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure the firewall filter, iqfilter1, and apply it to logical interface ge-0/0/0 unit 0:

  1. Create a firewall filter named iqfilter1.

  2. Apply the firewall filter to the logical interface.


From configuration mode, confirm your configuration by entering the show firewall and the show interfaces ge-0/0/0.0 commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

If you are done configuring the device, enter commit from configuration mode.