Firewall Filter Match Conditions for MPLS Traffic
You can configure a firewall filter with match conditions for MPLS traffic
(family mpls
).
-
The
input-list filter-names
andoutput-list filter-names
statements for firewall filters for thempls
protocol family are supported on all interfaces except for management interfaces and internal Ethernet interfaces (fxp
orem0
), loopback interfaces (lo0
), and USB modem interfaces (umd
) -
(QFX5100, QFX5110, QFX5200, QFX5210) If you are applying an MPLS filter on a loopback interface, you can only filter on the
label
,exp
,ttl=1
, and Layer 4tcp
andudp
port number fields. For TTL, you must explicitly specifyttl=1
underfamily mpls
to match on TTL=1 packets. The only actions you can configure areaccept
,discard
, andcount
. You can apply the filter only in the ingress direction. -
For MX Series Routers with MPC and MIC, you can apply inbound and outbound filters for MPLS family based on MPLS-tagged IPv4 and IPv6 parameters using inner payload match conditions, and enable selective port mirroring of MPLS traffic unto a monitoring device (starting in Junos OS Release 18.4R1). For IP-based filtering, additional match conditions are available under the MPLS filter term
from
parameter, and to support port mirroring, additional actions (such as port-mirror and port-mirror-instance), are available under the filter termthen
parameter.
Table 1 describes the match-conditions
you can configure
at the [edit firewall family mpls filter filter-name term
term-name from]
hierarchy level.
Match Condition | Description |
---|---|
|
Specify which groups to inherit configuration data from. You can specify more than one group name. You must list them in order of inheritance priority. The configuration data in the first group takes priority over the data in subsequent groups. |
|
Specify which groups not to inherit configuration data from. You can specify more than one group name. |
|
Match on the UDP or TCP destination port field. In place of the numeric value, you can specify one of the following
text synonyms (the port numbers are also listed):
|
|
Experimental (EXP) bit number or range of bit numbers in the MPLS header of a packet. For number, you can specify one or more values from 0 through 7 in binary, decimal or hexadecimal format, as given below:
Note:
This match condition is deprecated on PTX10001-36MR, PTX10003,
PTX10004, PTX10008, and PTX10016 devices and is replaced by
|
|
Do not match on the EXP bit number or range of bit numbers in the
MPLS header. For Note:
This match condition is deprecated on PTX10001-36MR, PTX10003,
PTX10004, PTX10008, and PTX10016 devices and is replaced by
|
|
Experimental (EXP) bit number or range of bit numbers in the TOS MPLS header of a packet. For number, you can specify one or more values from 0 through 7 in binary, decimal or hexadecimal format, as given below:
|
|
Do not match EXP bit number or range of bit numbers in the TOS MPLS header of a packet. For number, you can specify one or more values from 0 through 7 in binary, decimal or hexadecimal format, as given below:
|
|
Experimental (EXP) bit number or range of bit numbers in the MPLS header that is next to the TOS (top of stack) MPLS header. For number, you can specify one or more values from 0 through 7 in binary, decimal or hexadecimal format, as given below:
|
|
Do not match on the EXP bit number or range of bit numbers in the MPLS header next to the TOS MPLS header. For number, you can specify one or more values from 0 through 7 in binary, decimal or hexadecimal format, as given below:
|
|
Forwarding class. Specify Note:
On PTX10001-36MR, PTX10003, PTX10004, PTX10008, PTX10016 routers,
|
|
Do not match on the forwarding class. Specify
|
|
Interface on which the packet was received. You can configure a match condition that matches packets based on the interface on which they were received. Note:
If you configure this match condition with an interface that does not exist, the term does not match any packet. |
|
Match the interface on which the packet was received to the specified interface set. To define an interface set, include the
Note:
This match condition is not supported on PTX series packet transport routers. For more information, see Filtering Packets Received on an Interface Set Overview. |
|
Match inner IP version. For example, to match MPLS-tagged IPv4
packets, match on the text synonym |
|
MPLS label value or range of label values in the MPLS header of a packet. For number, you can specify one or more values from 0 through 1048575 in decimal or hexadecimal format, as given below:
Note:
This option is deprecated on PTX10001-36MR, PTX10003, PTX10004,
PTX10008, and PTX10016 devices and is replaced by
|
|
MPLS label value or range of label values in the TOS MPLS header of a packet. For number, you can specify one or more values from 0 through 1048575 in decimal or hexadecimal format, as given below:
|
|
Do not match MPLS label value or range of label values in the TOS MPLS header of a packet. For number, you can specify one or more values from 0 through 1048575 in decimal or hexadecimal format, as given below:
|
|
Match the MPLS label value or range of label values in the MPLS header label of the MPLS header that is next to the TOS MPLS header. For number, you can specify one or more values from 0 through 1048575 in decimal or hexadecimal format, as given below:
|
|
Do not match on the MPLS label value or range of label values in the MPLS header label of the MPLS header that is next to the TOS MPLS header. For number, you can specify one or more values from 0 through 1048575 in decimal or hexadecimal format, as given below:
|
label number
top | bottom | offset
offset-value |
Match top label, or bottom label or the label at a specified offset (from the top or bottom of the label stack) of the incoming MPLS packet.
Note:
Note:
The configuration command options are introduced in Junos Release 22.3R1. |
|
Match the packet loss priority (PLP) level. Specify a single level or multiple levels: Supported on M120 and M320 routers; M7i and M10i routers with the Enhanced CFEB (CFEB-E); and MX Series routers and EX Series switches. For IP traffic on M320, MX Series, and T Series routers with Enhanced
II Flexible PIC Concentrators (FPCs), and EX Series switches, you
must include the For information about the Note:
On PTX10001-36MR, PTX10003, PTX10004, PTX10008, PTX10016 routers,
|
|
Do not match the PLP level. For details, see the
Note:
This match condition is not supported on PTX series packet transport routers. |
|
Match on the TCP or UDP source port field. You cannot specify the If you configure this match condition for IPv4 traffic, we recommend
that you also configure the In place of the numeric field, you can specify one of the text
synonyms listed under |
|
Match TTL number or range of numbers in the TOS MPLS header of a packet. Time To Live (TTL) is an 8-bit field in the MPLS label that signifies the remaining time that a packet has left before its life ends and is dropped. For number, you can specify a value from 0 through 255. |
|
Do not match TTL number or range of numbers in the TOS MPLS header of a packet. Time To Live (TTL) is an 8-bit field in the MPLS label that signifies the remaining time that a packet has left before its life ends and is dropped. For number, you can specify a value from 0 through 255. |
|
Match TTL number or range of numbers in the MPLS header that is next to the TOS MPLS header of a packet. Time To Live (TTL) is an 8-bit field in the MPLS label that signifies the remaining time that a packet has left before its life ends and is dropped. For number, you can specify a value from 0 through 255. |
|
Do not match TTL number or range of numbers in the MPLS header that is next to the TOS MPLS header of a packet. Time To Live (TTL) is an 8-bit field in the MPLS label that signifies the remaining time that a packet has left before its life ends and is dropped. For number, you can specify a value from 0 through 255. |
exp0
, exp0-except
, exp1
,
exp1-except
, ip-version
,
label0
, label0-except
,
label1
, label1-except
, ttl0
,
ttl0-except
, ttl1
, and
ttl1-except
are only supported on PTX10001-36MR, PTX10003,
PTX10004, PTX10008, PTX10016.
Table 2 describes the actions you can configure for MPLS firewall filters at the
[edit firewall family mpls filter filter-name term
term-name then]
hierarchy level.
Action |
Description |
---|---|
|
Accept a packet |
|
Count the number of packets that pass this filter or term. Note:
We recommend that you configure a counter for each term in a firewall filter, so that you can monitor the number of packets that match the conditions specified in each filter term. |
|
Discard a packet silently without sending an Internet Control Message Protocol (ICMP) message |
|
Starting with Junos OS 13.2X51-D15, you can send traffic matched by an MPLS filter to a two-color policer. |
|
Starting with Junos OS 13.2X51-D15, you can send traffic matched by an MPLS filter to a three-color policer. |