Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Example: Nesting References to Multiple Firewall Filters

This example shows how to configure nested references to multiple firewall filters.

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you configure a firewall filter for a match condition and action combination that can be shared among multiple firewall filters. You then configure two firewall filters that reference the first firewall filter. Later, if the common filtering criteria needs to be changed, you would modify only the one shared firewall filter configuration.

Topology

The common_filter firewall filter discards packets that have a UDP source or destination port field number of 69. Both of the two additional firewall filters, filter1 and filter2, reference the common_filter.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Configure the Nested Firewall Filters

Step-by-Step Procedure

To configure two nested firewall filters that share a common filter:

  1. Navigate the CLI to the hierarchy level at which you configure IPv4 firewall filters.

  2. Configure the common filter that will be referenced by multiple other filters.

  3. Configure a filter that references the common filter.

  4. Configure a second filter that references the common filter.

Apply Both Nested Firewall Filters to Interfaces

Step-by-Step Procedure

To apply both nested firewall filters to logical interfaces:

  1. Apply the first nested filter to a logical interface input.

  2. Apply the second nested filter to a logical interface input.

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

To confirm and then commit your candidate configuration:

  1. Confirm the configuration of the firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  3. If you are done configuring the device, commit your candidate configuration.

Verification

To confirm that the configuration is working properly, enter the show firewall filter filter1 and show firewall filter filter2 operational mode commands.