Stateless Firewall Filter Application Points

After you define the firewall filter, you must apply it to an application point. These application points include logical interfaces, physical interfaces, routing interfaces, and routing instances.

In most cases, you can apply a firewall filter as an input filter or an output filter, or both at the same time. Input filters take action on packets being received on the specified interface, whereas output filters take action on packets that are transmitted through the specified interface.

You typically apply one filter with multiple terms to a single logical interface, to incoming traffic, outbound traffic, or both. However, there are times when you might want to chain together multiple firewall filters (with single or multiple terms) and apply them to an interface. You use an input list to apply multiple firewall filters to the incoming traffic on an interface. You use an output list to apply multiple firewall filters to the outbound traffic on an interface. You can include up to 16 filters in an input list or an output list.

There is no limit to the number of filters and counters you can set, but there are some practical considerations. More counters require more terms, and a large number of terms can take a long time to process during a commit operation. However, filters with more than 4000 terms and counters have been implemented successfully.

Table 1 describes each point to which you can apply a firewall filter. For each application point, the table describes the types of firewall filters supported at that point, the router (or switch) hierarchy level at which the filter can be applied, and any platform-specific limitations.

Table 1: Stateless Firewall Filter Configuration and Application Summary
Filter Type	Application Point	Restrictions
Stateless firewall filter Configure by including the `filter filter-name` statement the `[edit firewall]` hierarchy level: filter `filter-name`; Note: If you do not include the `family` statement, the firewall filter processes IPv4 traffic by default.	Logical interface Apply at the `[edit interfaces interface-name unit unit-number family inet]` hierarchy level by including the `input filter-name` or `output filter-name` statements: filter { input `filter-name`; output `filter-name`; } Note: A filter configured with the implicit `inet` protocol family cannot be included in an input filter list or an output filter list. Note: On T4000 Type 5 FPCs, a filter attached at the Layer 2 application point (that is, at the logical interface level) is unable to match with the forwarding class of a packet that is set by a Layer 3 classifier such as DSCP, DSCP V6, `inet-precedence`, and `mpls-exp`.	Supported on the following routers: T Series routers M320 routers M7i routers with the enhanced CFEB (CFEB-e) M10i routers with the enhanced CFEB-e Also supported on the following Modular Port Concentrators (MPCs) on MX Series routers: 10-Gigabit Ethernet MPC 60-Gigabit Ethernet Queuing MPC 60-Gigabit Ethernet Enhanced Queuing MPC 100-Gigabit Ethernet MPC Also supported on EX Series switches
Stateless firewall filter Configure at the `[edit firewall family family-name]` hierarchy level by including the following statement: filter `filter-name`; The `family-name` can be any of the following protocol families: `any` `bridge` ethernet-switching ccc `inet` `inet6` `mpls` `vpls`	Protocol family on a logical interface Apply at the `[edit interfaces interface-name unit unit-number family family-name]` hierarchy level by, including the `input`, `input-list`, `output`, or `output-list` statements: filter { input `filter-name`; input-list [ `filter-names` ]; output `filter-name`; output-list [ `filter-names` ]; }	The protocol family `bridge` is supported only on MX Series routers.
Stateless firewall filter	Routing Engine loopback interface
Service filter Configure at the `[edit firewall family (inet \| inet6)]` hierarchy level by including the following statement: service-filter `service-filter-name`;	Family `inet` or `inet6` on a logical interface Apply at the `[edit interfaces interface-name unit unit-number family (inet \| inet6)]` hierarchy level by using the `service-set` statement to apply a service filter as an input or output filter to a service set: service { input { service-set `service-set-name` service-filter `filter-name;` } output { service-set `service-set-name` service-filter `filter-name;` } } Configure a service set at the `[edit services]` hierarchy level by including the following statement: `service-set service-set-name`;	Supported only on Adaptive Services (AS) and Multiservices (MS) PICs.
Postservice filter Configure at the `[edit firewall family (inet \| inet6)]` hierarchy level by including the following statement: service-filter `service-filter-name`;	Family `inet` or `inet6` on a logical interface Apply at the `[edit interfaces interface-name unit unit-number family (inet \| inet6)]` hierarchy level by including the `post-service-filter` statement to apply a service filter as an input filter: service { input { post-service-filter `filter-name`; } }	A postservice filter is applied to traffic returning to the services interface after service processing. The filter is applied only if a service set is configured and selected.
Simple filter Configure at the `[edit firewall family inet]` hierarchy level by including the following statement: simple-filter `filter-name`	Family `inet` on a logical interface Apply at the `[edit interfaces interface-name unit unit-number family inet]` hierarchy level by including the following statement: simple-filter `simple-filter-name`;	Simple filters can only be applied as input filters. Supported on the following platforms only: Gigabit Ethernet intelligent queuing (IQ2) PICs on the M120, M320, and T Series routers. Enhanced Queuing Dense Port Concentrators (EQ DPC) on MX Series routers (and EX Series switches).
Reverse packet forwarding (RPF) check filter Configured at the `[edit firewall family (inet \| inet6)]` hierarchy level by including the following statement: filter `filter-name`;	Family `inet` or `inet6` on a logical interface Apply at the `[edit interfaces interface-name unit unit-number family (inet \| inet6)]` hierarchy level by including the following statement: rpf-check fail-filter `filter-name` to apply the stateless firewall filter as an RPF check filter. rpf-check { fail-filter `filter-name`; mode loose; }	Supported on MX Series routers and EX Series switches only.