ON THIS PAGE
Example: Configuring and Applying a Simple Filter
This example shows how to configure a simple filter.
Requirements
This example uses one of the following hardware components:
One Gigabit Ethernet intelligent queuing (IQ2) PIC installed on an M120, M320, or T Series router
One Enhanced Queuing Dense Port Concentrator (EQ DPC) installed on an MX Series router or an EX Series switch
Before you begin, make sure that you have:
Installed your supported router (or switch) and PIC or DPC and performed the initial router (or switch) configuration.
Configured basic Ethernet in the topology, and verified that traffic is flowing in the topology and that ingress IPv4 traffic is flowing into logical interface
ge-0/0/1.0.
Overview
This simple filter sets the loss priority to low for TCP traffic with source address 172.16.1.1, sets the loss priority to high for HTTP
(Web) traffic with source addresses in the 172.16.4.0/8 range, and sets the loss priority to low for all traffic with destination address 172.16.6.6.
Topology
The simple filter is applied as an input filter (arriving packets are checking for destination address 6.6.6.6, not queued output packets)
on interface ge-0/0/1.0.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
To configure this example, perform the following tasks:
- CLI Quick Configuration
- Configuring the Simple Firewall Filter
- Applying the Simple Filter to the Logical Interface Input
CLI Quick Configuration
To quickly configure this example, copy the following commands into a text file, remove any line breaks, and then paste the commands into the
CLI at the [edit] hierarchy level.
set firewall family inet simple-filter sf_classify_1 term 1 from source-address 172.16.1.1/32 set firewall family inet simple-filter sf_classify_1 term 1 from protocol tcp set firewall family inet simple-filter sf_classify_1 term 1 then loss-priority low set firewall family inet simple-filter sf_classify_1 term 2 from source-address 172.16.4.0/8 set firewall family inet simple-filter sf_classify_1 term 2 from protocol tcp set firewall family inet simple-filter sf_classify_1 term 2 from source-port http set firewall family inet simple-filter sf_classify_1 term 2 then loss-priority high set firewall family inet simple-filter sf_classify_1 term 3 from destination-address 6.6.6.6/32 set firewall family inet simple-filter sf_classify_1 term 3 then loss-priority low set firewall family inet simple-filter sf_classify_1 term 3 then forwarding-class best-effort set interfaces ge-0/0/1 unit 0 family inet simple-filter input sf_classify_1 set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.3/30
Configuring the Simple Firewall Filter
Step-by-Step Procedure
To configure the simple filter:
Create the simple filter
sf_classify_1.[edit] user@host# edit firewall family inet simple-filter sf_classify_1
Configure classification of TCP traffic based on the source IP address.
[edit firewall family inet simple-filter sf_classify_1] user@host# set term 1 from source-address 172.16.1.1/32 user@host# set term 1 from protocol tcp user@host# set term 1 then loss-priority low
Configure classification of HTTP traffic based on the source IP address.
[edit firewall family inet simple-filter sf_classify_1] user@host# set term 2 from source-address 172.16.4.0/8 user@host# set term 2 from protocol tcp user@host# set term 2 from source-port http user@host# set term 2 then loss-priority high
Configure classification of other traffic based on the destination IP address.
[edit firewall family inet simple-filter sf_classify_1] user@host# set term 3 from destination-address 6.6.6.6/32 user@host# set term 3 then loss-priority low user@host# set term 3 then forwarding-class best-effort
Results
Confirm the configuration of the simple filter by entering the show firewall configuration mode command. If the command output does not
display the intended configuration, repeat the instructions in this example to correct the configuration.
[edit]
user@host# show firewall
family inet {
simple-filter sf_classify_1 {
term 1 {
from {
source-address {
172.16.1.1/32;
}
protocol {
tcp;
}
}
then loss-priority low;
}
term 2 {
from {
source-address {
172.16.4.0/8;
}
source-port {
http;
}
protocol {
tcp;
}
}
then loss-priority high;
}
term 3 {
from {
destination-address {
6.6.6.6/32;
}
}
then {
loss-priority low;
forwarding-class best-effort;
}
}
}
}
Applying the Simple Filter to the Logical Interface Input
Step-by-Step Procedure
To apply the simple filter to the logical interface input:
Configure the logical interface to which you will apply the simple filter.
[edit] user@host# edit interfaces ge-0/0/1 unit 0 family inet
Configure the interface address for the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set address 10.1.2.3/30
Apply the simple filter to the logical interface input.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set simple-filter input sf_classify_1
Results
Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does
not display the intended configuration, repeat the instructions in this example to correct the configuration.
[edit]
user@host# show interfaces
ge-0/0/1 {
unit 0 {
family inet {
simple-filter {
input sf_classify_1;
}
address 10.1.2.3/30;
}
}
}
When you are done configuring the device, commit your candidate configuration.
Verification
Confirm that the configuration is working properly.
- Displaying the Mapping of Forwarding Class Maps and Names to Queue Numbers
- Displaying CoS Queue Counters for the Interface
- Displaying CoS Queue Counter Details for the Physical Interface
Displaying the Mapping of Forwarding Class Maps and Names to Queue Numbers
Purpose
Display the mapping of forwarding class names to queue numbers.
Action
Enter the show class-of-service forwarding-class operational mode command.
[edit] user@host> show class-of-service forwarding-class
For information about the command output, see “show class-of-service forwarding-class”
in the CLI Explorer.
Displaying CoS Queue Counters for the Interface
Purpose
Verify that the class-of-service (CoS) queue counters for the interface reflect the simple filter applied to the logical interface.
Action
Enter the show interfaces command for the physical interface on which the simple filter is applied, and specify detail or extensive output
level.
[edit] user@host> show interfaces ge-0/0/1 detail
In the Physical interface section, under Ingress queues, the Queue counters section displays ingress queue counters
for each forwarding class.
For more detailed information about the command output, see “show interfaces ” in the CLI Explorer.
Displaying CoS Queue Counter Details for the Physical Interface
Purpose
Verify that the CoS queue counter details for the physical interface reflect the simple filter applied to the logical interface.
Action
Enter the show interfaces queue command for the physical interface on which the simple filter is applied, and specify the ingress option.
[edit] user@host> show interfaces queue ge-0/0/1 ingress
For information about the command output, see “show interfaces queue” in the CLI Explorer.