Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Example: Configuring a Filter to Count and Sample Accepted Packets

This example shows how to configure a standard stateless firewall filter to count and sample accepted packets.


No special configuration beyond device initialization is required before configuring this example.

Before you begin, configure traffic sampling by including the sampling statement at the [edit forwarding-options] hierarchy level.


In this example, you use a standard stateless firewall filter to count and sample all packets received on a logical interface.


When you enable reverse path forwarding (RPF) on an interface with an input filter for firewall log and count, the input firewall filter does not log the packets rejected by RPF, although the rejected packets are counted. To log the rejected packets, use an RPF check fail filter.


On MX Series routers with MPC3 or MPC4, if firewall filters are configured to count Two-Way Active Measurement Protocol (TWAMP) packets then the count is doubled for all TWAMP packets. There may also be a small increase in round trip time (RTT) when the TWAMP server is hosted on MPC3 or MPC4. This warning does not apply for routers with MPC1 or MPC2 cards.


On QFX5130 and QFX5700 when a packet hits multiple firewall filters which has counter action, only the highest priority group counter will increment. For example, assume the packet has hit a IPACL (Port ACL) filter and a IRACL (Routed ACL) filter, both having counter action. According to priority, IRACL has high priority over IPACL. Hence only IRACL counter will increment. If there is no hit in IRACL, then IPACL counter will increment.

Below is the order of priority of user configured ACLs (from highest to lowest),

  • Loopback





The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following configuration commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Configure the Stateless Firewall Filter

Step-by-Step Procedure

To configure the stateless firewall filter sam:

  1. Create the stateless firewall filter sam.

  2. Configure the term to count and sample all packets.

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

To apply the stateless firewall filter to a logical interface:

  1. Configure the logical interface to which you will apply the stateless firewall filter.

  2. Configure the interface address for the logical interface.

  3. Apply the stateless firewall filter to the logical interface.


    The Junos OS does not sample packets originating from the router or switch. If you configure a filter and apply it to the output side of an interface, then only the transit packets going through that interface are sampled. Packets that are sent from the Routing Engine to the Packet Forwarding Engine are not sampled.

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

To confirm and then commit your candidate configuration:

  1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  3. If you are done configuring the device, commit your candidate configuration.


Confirm that the configuration is working properly.

Displaying the Packet Counter


Verify that the firewall filter is evaluating packets.


Displaying the Firewall Filter Log Output


Display the packet header information for all packets evaluated by the firewall filter.



This output file contains the following fields:

  • Time—Time at which the packet was received (not shown in the default).

  • Filter—Name of a filter that has been configured with the filter statement at the [edit firewall] hierarchy level. A hyphen (-) or the abbreviation pfe indicates that the packet was handled by the Packet Forwarding Engine. A space (no hyphen) indicates that the packet was handled by the Routing Engine.

  • A—Filter action:

    • A—Accept (or next term)

    • D—Discard

    • R—Reject

  • Interface—Interface on which the filter is configured.


    We strongly recommend that you always explicitly configure an action in the then statement.

  • Pro—Packet’s protocol name or number.

  • Source address—Source IP address in the packet.

  • Destination address—Destination IP address in the packet.

Displaying the Sampling Output


Verify that the sampling output contains appropriate data.