ON THIS PAGE
Example: Configuring a Filter to Match on Port and Protocol Fields
This example shows how to configure a standard stateless firewall filter to match on destination port and protocol fields.
Requirements
No special configuration beyond device initialization is required before configuring this example.
Overview
In this example, you configure a stateless firewall filter that accepts all IPv4 packets except for TCP and UDP packets. TCP and UDP packets are accepted if destined for the SSH port or the Telnet port. All other packets are rejected.
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Stateless Firewall Filter to a Logical Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following
configuration commands into a text file, remove any line breaks, and
then paste the commands into the CLI at the [edit] hierarchy
level:
set firewall family inet filter filter1 term term1 from protocol-except tcp set firewall family inet filter filter1 term term1 from protocol-except udp set firewall family inet filter filter1 term term1 then accept set firewall family inet filter filter1 term term2 from address 192.168.0.0/16 set firewall family inet filter filter1 term term2 then reject set firewall family inet filter filter1 term term3 from destination-port ssh set firewall family inet filter filter1 term term3 from destination-port telnet set firewall family inet filter filter1 term term3 then accept set firewall family inet filter filter1 term term4 then reject set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.3/30 set interfaces ge-0/0/1 unit 0 family inet filter input filter1
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter filter1:
Create the IPv4 stateless firewall filter.
[edit] user@host# edit firewall family inet filter filter1
Configure a term to accept all traffic except for TCP and UDP packets.
[edit firewall family inet filter filter1] user@host# set term term1 from protocol-except tcp user@host# set term term1 from protocol-except udp user@host# set term term1 then accept
Configure a term to reject packets to or from the
192.168/16prefix.[edit firewall family inet filter filter1] user@host# set term term2 from address 192.168.0.0/16 user@host# set term term2 then reject
Configure a term to accept packets destined for either the SSH port or the Telnet port.
[edit firewall family inet filter filter1] user@host# set term term3 from destination-port ssh user@host# set term term3 from destination-port telnet user@host# set term term3 then accept
Configure the last term to reject all packets.
[edit firewall family inet filter filter1] user@host# set term term4 then reject
Apply the Stateless Firewall Filter to a Logical Interface
Step-by-Step Procedure
To apply the stateless firewall filter to a logical interface:
Configure the logical interface to which you will apply the stateless firewall filter.
[edit] user@host# edit interfaces ge-0/0/1 unit 0 family inet
Configure the interface address for the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set address 10.1.2.3/30
Apply the stateless firewall filter to the logical interface.
[edit interfaces ge-0/0/1 unit 0 family inet] user@host# set filter input filter1
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall family inet { filter filter1 { term term1 { from { protocol-except [tcp udp]; } then { accept; } } term term2 { from { address 192.168/16; } then { reject; } } term term3 { from { destination-port [ssh telnet]; } then { accept; } } term term4 { then { reject; } } } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces ge-0/0/1 { unit 0 { family inet { filter { input filter1; } address 10.1.2.3/30; } } }If you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working
properly, enter the show firewall filter filter1 operational mode command.