Firewall Filter Match Conditions for Protocol-Independent Traffic
You can configure a firewall filter with match conditions for
protocol-independent traffic (family any
).
To apply a protocol-independent firewall filter to a logical
interface, configure the filter
statement under the logical
unit.
On MX Series routers, attach a protocol-independent firewall
filter to a logical interface by configuring the filter
statement directly under the logical unit:
[edit interfaces name unit number filter]
[edit logical-systems name interfaces name unit number filter]
On all other supported devices, attach a protocol-independent
firewall filter to a logical interface by configuring the filter
statement under the protocol family (family any
):
[edit interfaces name unit number family any filter]
[edit logical-systems name interfaces name unit number family any filter]
Table 1 describes the match-conditions
you can configure at the [edit firewall family any filter filter-name term term-name from]
hierarchy level.
Match Condition |
Description |
---|---|
|
Match the forwarding class of the packet. Specify For information about forwarding classes and router-internal output queues, see Understanding How Forwarding Classes Assign Classes to Output Queues. Note:
On T4000 Type 5 FPCs, a filter attached at the Layer 2
application point (that is, at the logical interface level) is
unable to match with the forwarding class of a packet that is
set by a Layer 3 classifier such as DSCP, DSCP V6,
|
|
Do not match on the forwarding class. For details, see the
|
|
Match the interface on which the packet was received. Note:
If you configure this match condition with an interface that does not exist, the term does not match any packet. |
|
Match the interface on which the packet was received to the specified interface set. To define an interface set, include the
|
|
Match the packet loss priority (PLP) level. Specify a single level or multiple levels: Supported on M120 and M320 routers; M7i and M10i routers with the Enhanced CFEB (CFEB-E); and MX Series routers. For IP traffic on M320, MX Series, and T Series routers with Enhanced
II Flexible PIC Concentrators (FPCs), you must include the
Note:
This match condition is not supported on PTX series packet transport routers. For information about the |
|
Do not match the PLP level. For details, see the
Note:
This match condition is not supported on PTX series packet transport routers. |
|
Match the length of the received packet, in bytes. The length refers only to the IP packet, including the packet header, and does not include any Layer 2 encapsulation overhead. You can also specify a range of values to be matched. |
|
Do not match on the received packet length, in bytes. For details,
see the |
|
Match the VLAN ID of the packet. The range is 0 - 4095. |