ON THIS PAGE
Example: Configuring a Filter to Count IP Options Packets
This example shows how use a stateless firewall filter to count individual IP options packets:
Requirements
This example uses an interface on a 10-Gigabit Ethernet Modular
Port Concentrator (MPC), 60-Gigabit Ethernet MPC, 60-Gigabit Queuing
Ethernet MPC, or 60-Gigabit Ethernet Enhanced Queuing MPC on an MX Series
router. This interface enables you to apply an IPv4 firewall filter
(standard or service filter) that can use the count, log, and syslog nonterminating actions on packets
that match a specific ip-option value
without having to also use the discard terminating action.
No special configuration beyond device initialization is required before configuring this example.
Overview
In this example, you use a stateless firewall filter to count IP options packets but not block any traffic. Also, the filter logs packets that have loose or strict source routing.
The IP option header field is an optional field in IPv4
headers only. The ip-options and ip-options-except match conditions are supported for standard stateless firewall filters
and service filters only.
On M and T series routers, firewall filters cannot count ip-options packets on a per option type and per interface basis.
A limited work around is to use the show pfe statistics ip options command to see ip-options statistics on a per Packet
Forwarding Engine (PFE) basis. See show
pfe statistics ip for sample output.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
To configure this example, perform the following tasks:
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Stateless Firewall Filter to a Logical Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following
configuration commands into a text file, remove any line breaks, and
then paste the commands into the CLI at the [edit] hierarchy
level.
set firewall family inet filter ip_options_filter term match_strict_source from ip-options strict-source-route set firewall family inet filter ip_options_filter term match_strict_source then count strict_source_route set firewall family inet filter ip_options_filter term match_strict_source then log set firewall family inet filter ip_options_filter term match_strict_source then accept set firewall family inet filter ip_options_filter term match_loose_source from ip-options loose-source-route set firewall family inet filter ip_options_filter term match_loose_source then count loose_source_route set firewall family inet filter ip_options_filter term match_loose_source then log set firewall family inet filter ip_options_filter term match_loose_source then accept set firewall family inet filter ip_options_filter term match_record from ip-options record-route set firewall family inet filter ip_options_filter term match_record then count record_route set firewall family inet filter ip_options_filter term match_record then accept set firewall family inet filter ip_options_filter term match_timestamp from ip-options timestamp set firewall family inet filter ip_options_filter term match_timestamp then count timestamp set firewall family inet filter ip_options_filter term match_timestamp then accept set firewall family inet filter ip_options_filter term match_router_alert from ip-options router-alert set firewall family inet filter ip_options_filter term match_router_alert then count router_alert set firewall family inet filter ip_options_filter term match_router_alert then accept set firewall family inet filter ip_options_filter term match_all then accept set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.3/30 set interfaces ge-0/0/1 unit 0 family inet filter input ip_options_filter
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter ip_option_filter:
Create the stateless firewall filter
ip_option_filter.[edit] user@host# edit firewall family inet filter ip_options_filter
Configure the first term to count, log, and accept packets with the
strict_source_routeIP optional header field.[edit firewall family inet filter ip_option_filter] user@host# set term match_strict_source from ip-options strict_source_route user@host# set term match_strict_source then count strict_source_route user@host# set term match_strict_source then log user@host# set term match_strict_source then accept
Configure the next term to count, log, and accept packets with the
loose-source-routeIP optional header field.[edit firewall family inet filter ip_option_filter] user@host# set term match_loose_source from ip-options loose-source-route user@host# set term match_loose_source then count loose_source_route user@host# set term match_loose_source then log user@host# set term match_loose_source then accept
Configure the next term to count and accept packets with the
record-routeIP optional header field.[edit firewall family inet filter ip_option_filter] user@host# set term match_record from ip-options record-route user@host# set term match_record then count record_route user@host# set term match_record then accept
Configure the next term to count and accept packets with the
timestampIP optional header field.[edit firewall family inet filter ip_option_filter] user@host# set term match_timestamp from ip-options timestamp user@host# set term match_timestamp then count timestamp user@host# set term match_timestamp then accept
Configure the next term to count and accept packets with the
router-alertIP optional header field.[edit firewall family inet filter ip_option_filter] user@host# set term match_router_alert from ip-options router-alert user@host# set term match_router_alert then count router_alert user@host# set term match_router_alert then accept
Create the last term to accept any packet without incrementing any counters.
[edit firewall family inet filter ip_option_filter] user@host# set term match_all then accept
Apply the Stateless Firewall Filter to a Logical Interface
Step-by-Step Procedure
To apply the stateless firewall filter to a logical interface:
Configure the logical interface to which you will apply the stateless firewall filter.
[edit] user@host# edit interfaces ge-0/0/1 unit 0 family inet
Configure the interface address for the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set address 10.1.2.3/30
Apply the stateless firewall filter to the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set filter input ip_options_filter
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall family inet { filter ip_options_filter { term match_strict_source { from { ip-options strict-source-route; } then { count strict_source_route; log; accept; } } term match_loose_source { from { ip-options loose-source-route; } then { count loose_source_route; log; accept; } } term match_record { from { ip-options record-route; } then { count record_route; accept; } } term match_timestamp { from { ip-options timestamp; } then { count timestamp; accept; } } term match_router_alert { from { ip-options router-alert; } then { count router_alert; accept; } } term match_all { then accept; } } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces ge-0/0/1 { unit 0 { family inet { filter { input ip_option_filter; } address 10.1.2.3/30; } } }If you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working properly,
enter the show firewall filter ip_option_filter operational mode command. You can
also display the log and individual counters separately by using the
following forms of the command:
show firewall counter strict_source_routeshow firewall counter loose_source_routeshow firewall counter record_routeshow firewall counter timestampshow firewall counter router_alertshow firewall log