ON THIS PAGE
Example: Configuring a Filter to Count and Discard IP Options Packets
This example shows how to configure a standard stateless firewall to count packets.
Requirements
No special configuration beyond device initialization is required before configuring this example.
Because the filter term matches on any IP option
value, the filter term can use the count nonterminating
action without the discard terminating action or (alternatively)
without requiring an interface on a 10-Gigabit Ethernet Modular Port
Concentrator (MPC), 60-Gigabit Ethernet MPC, 60-Gigabit Queuing Ethernet
MPC, or 60-Gigabit Ethernet Enhanced Queuing MPC on an MX Series
router.
Overview
In this example, you use a standard stateless firewall filter to count and discard packets that include any IP option value but accept all other packets.
The IP option header field is an optional field in IPv4
headers only. The ip-options and ip-options-except match conditions are supported for standard stateless firewall filters
and service filters only.
On M and T series routers, firewall filters cannot count ip-options packets on a per option type and per interface basis.
A limited work around is to use the show pfe statistics ip options command to see ip-options statistics on a per Packet
Forwarding Engine (PFE) basis. See show
pfe statistics ip for sample output.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
To configure this example, perform the following tasks:
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Stateless Firewall Filter to a Logical Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following
configuration commands into a text file, remove any line breaks, and
then paste the commands into the CLI at the [edit] hierarchy
level.
set firewall family inet filter block_ip_options term 10 from ip-options any set firewall family inet filter block_ip_options term 10 then count option_any set firewall family inet filter block_ip_options term 10 then discard set firewall family inet filter block_ip_options term 999 then accept set interfaces ge-0/0/1 unit 0 family inet filter input block_ip_options set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.3/30
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter:
Create the stateless firewall filter
block_ip_options.[edit] user@host# edit firewall family inet filter block_ip_options
Configure the first term to count and discard packets that include any IP options header fields.
[edit firewall family inet filter block_ip_options] user@host# set term 10 from ip-options any user@host# set term 10 then count option_any user@host# set term 10 then discard
Configure the other term to accept all other packets.
[edit firewall family inet filter block_ip_options] user@host# set term 999 then accept
Apply the Stateless Firewall Filter to a Logical Interface
Step-by-Step Procedure
To apply the stateless firewall filter to a logical interface:
Configure the logical interface to which you will apply the stateless firewall filter.
[edit] user@host# edit interfaces ge-0/0/1 unit 0 family inet
Configure the interface address for the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set address 10.1.2.3/30
Apply the stateless firewall filter to the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set filter input block_ip_options
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall family inet { filter block_ip_options { term 10 { from { ip-options any; } then { count option_any; discard; } } term 999 { then accept; } } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces ge-0/0/1 { unit 0 { family inet { filter { input block_ip_options; } address 10.1.2.3/30; } } }If you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working
properly, enter the show firewall filter block_ip_options operational mode command. To display the count of discarded packets
separately, enter the show firewall count option_any form
of the command.