Firewall Filter Match Conditions Based on Address Classes
For IPv4 and IPv6 traffic only, you can use class-based firewall filter conditions to match packet fields based on source class or destination class.
Source-Class Usage
A is a set of source prefixes
grouped together and given a class name. To configure a firewall filter
term that matches an IP source address field to one or more source
classes, use the source-class class-name match condition under the [edit firewall family (inet
| inet6) filter filter-name term term-name from] hierarchy level.
Source-class usage (SCU) enables you to monitor the amount of traffic originating from a specific prefix. With this feature, usage can be tracked and customers can be billed for the traffic they receive.
Destination-Class Usage
A is a set of destination
prefixes grouped together and given a class name. To configure a firewall
filter term that matches an IP destination address field to one or
more destination classes, use the destination-class class-name match condition at the [edit firewall
family (inet | inet6) filter filter-name term term-name from] hierarchy level.
Destination-class usage (DCU) enables you can track how much traffic is sent to a specific prefix in the core of the network originating from one of the specified interfaces.
Note, however, that DCU limits your ability to keep track of traffic moving in the reverse direction. It can account for all traffic that arrives on a core interface and heads toward a specific customer, but it cannot count traffic that arrives on a core interface from a specific prefix.
Guidelines for Applying SCU or DCU Firewall Filters to Output Interfaces
When applying a SCU or DCU firewall filter to an interface, keep the following guidelines in mind:
Output interfaces—Class-based firewall filter match conditions work only for firewall filters that you apply to output interfaces. This is because the SCU and DCU are determined after route lookup occurs.
Input interfaces—Although you can specify a source class and destination class for an input firewall filter, the counters are incremented only if the firewall filter is applied on the output interface.
Output interfaces for tunnel traffic—SCU and DCU are not supported on the interfaces you configure as the output interface for tunnel traffic for transit packets exiting the router (or switch) through the tunnel.