Firewall Filter Match Conditions for MPLS-Tagged IPv4 or IPv6 Traffic
Matching on IPv4 or IPv6 Packet Header Fields in MPLS Traffic
To support network-based services in a core network, you can configure firewall
filters that match IPv4 or IPv6 packet headers in MPLS traffic (family
mpls). These filters can inspect the inner payload of MPLS
packets with either a single label or up to five stacked labels.
The feature is not supported for the router or switch loopback interface
(lo0), the router or switch management interface
(fxp0 or em0), or USB modem interfaces
(umd).
When using the ip-version match condition, the following additional
match conditions become available.
IP Header Match Conditions for MPLS Traffic
Table 1 describes the match conditions you can configure at the [edit firewall
family mpls filter filter-name term
term-name from ip-version
ip-version] hierarchy level.
| Match Condition | Description |
|---|---|
|
|
Match the address of the destination node to receive the packet. |
|
|
Do not match the address of the destination node to receive the packet. |
destination-prefix-list
name |
Match destination prefixes in specified list |
dscp
value |
Match Differentiated Services code point (0-63) |
dscp-except
value |
Exclude specified DSCP value |
first-fragment |
Match if packet is the first fragment |
fragment-flags
value |
Match IPv4 fragment flags (DF, MF) |
fragment-offset |
Match fragment offset |
fragment-offset-except |
Do not match fragment offset |
ip-address |
Match IPv4 source or destination address |
ip-destination-address |
Match IPv4 destination address |
ip-options |
Match IP options |
ip-options-except |
Do not match IP options |
ip-protocol |
Match IP protocol type |
ip-protocol-except |
Do not match IP protocol type |
ip-source-address |
Match IPv4 source address |
ip6-address |
Match IPv6 source or destination address |
ip6-destination-address |
Match IPv6 destination address |
ip6-source-address |
Match IPv6 source address |
is-fragment |
Match IPv4 fragmented packets |
next-header
number |
Match IPv6 next header type (equivalent to IPv4 protocol) |
payload-protocol |
Match payload protocol type |
payload-protocol-except |
Do not match payload protocol type |
prefix-list |
Match source or destination prefixes in specified list |
|
|
Match the IP protocol type field. In place of the numeric value,
you can specify one of the following text synonyms (the field
values are also listed): |
|
|
Match the address of the source node sending the packet. |
|
|
Do not match the address of the source node sending the packet. |
source-prefix-list
name |
Match source prefixes in specified list |
tcp-established |
Match established TCP connections (requires protocol tcp) |
tcp-initial |
Match initial TCP packets (requires protocol tcp) |
tcp-flags |
Match TCP flags (in symbolic or hex formats). Logical operators |
IP Port Match Conditions for MPLS Traffic
Table 2 describes the port-specific match conditions you can configure at the
[edit firewall family mpls filter filter-name term
term-name from ip-version ip-version
protocol (udp | tcp)] hierarchy level.
| Match Condition | Description |
|---|---|
|
|
Match on the UDP or TCP destination port field. In place of the numeric value, you can specify one of the
following text synonyms (the port numbers are also listed):
|
|
|
Do not match on the UDP or TCP destination port field. In place of the numeric value, you can specify one of the text
synonyms listed with the |
destination-port-list |
Match destination ports in specified list. |
|
|
Match TCP/UDP source or destination port. |
port-except |
Do not match TCP/UDP source or destination port. |
port-list |
Match source or destination ports in specified list. |
|
|
Match on the TCP or UDP source port field. In place of the numeric field, you can specify one of the text
synonyms listed under |
|
|
Do not match on the TCP or UDP source port field. |
source-port-list |
Match source ports in specified list. |
ICMP Match Conditions for MPLS Traffic
Describes the ICMP-specific match conditions you can configure at the [edit
firewall family mpls filter filter-name term
term-name from ip-version ip-version
protocol icmp] hierarchy level for IPv4 or next-header
icmpv6 for IPv6.
| Match Condition | Description |
|---|---|
icmp-code
number |
Match ICMP message code (0-255). |
icmp-code-except |
Do not match ICMP message code. |
icmp-type
number |
Match ICMP message type (0-255). |
icmp-type-except |
Do not match ICMP message type. |
Interface Match Conditions for MPLS Traffic
Table 4 describes the interface-specific
match-conditions you can configure at
the [edit firewall family mpls filter filter-name term
term-name] hierarchy level.
| Match Condition | Description |
|---|---|
|
|
Match the interface group. Options are:
|
Configuration Example
firewall {
family mpls {
filter MPLS_TRAFFIC_FILTER {
term BLOCK_FRAGMENTS {
from {
ip-version ipv4;
is-fragment; /* Match IPv4 fragments */
}
then discard;
}
term ALLOW_WEB_TRAFFIC {
from {
ip-version ipv4;
protocol tcp;
destination-port 80; /* HTTP */
}
then accept;
}
term ALLOW_DNS {
from {
ip-version ipv6;
next-header udp;
destination-port 53; /* DNS */
}
then accept;
}
term ALLOW_ICMP {
from {
ip-version ipv6;
next-header icmpv6;
icmp-type echo-request; /* IPv6 ping */
}
then accept;
}
}
}
}Usage Notes
ip-versionmust be specified before using IP header match conditions- Port match conditions require explicit protocol definition (tcp/udp)
- ICMP conditions require protocol icmp (IPv4) or next-header icmpv6 (IPv6)
- Supports MPLS packets with 1-5 label stacks
- IPv4 and IPv6 match conditions cannot be mixed in the same term
- All match conditions evaluate inner payload of MPLS packets