ON THIS PAGE
Example: Configuring a Filter to Accept OSPF Packets from a Prefix
This example shows how to configure a standard stateless firewall filter to accept packets from a trusted source.
Requirements
No special configuration beyond device initialization is required before configuring this example.
Overview
In this example, you create a filter that accepts only OSPF packets from an address in the prefix 10.108.0.0/16, discarding all other packets with an administratively-prohibited ICMP message
Configuration
The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode.
To configure this example, perform the following tasks:
- CLI Quick Configuration
- Configure the Stateless Firewall Filter
- Apply the Firewall Filter to the Loopback Interface
- Confirm and Commit Your Candidate Configuration
CLI Quick Configuration
To quickly configure this example, copy the following configuration commands
into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.
set firewall family inet filter ospf_filter term term1 from source-address 10.108.0.0/16 set firewall family inet filter ospf_filter term term1 from protocol ospf set firewall family inet filter ospf_filter term term1 then accept set firewall family inet filter ospf_filter term default-term then reject administratively-prohibited set interfaces lo0 unit 0 family inet address 10.1.2.3/30 set interfaces lo0 unit 0 family inet filter input ospf_filter
Configure the Stateless Firewall Filter
Step-by-Step Procedure
To configure the stateless firewall filter ospf_filter:
Create the filter.
[edit] user@host# edit firewall family inet filter ospf_filter
Configure the term that accepts packets.
[edit firewall family inet filter ospf_filter] user@host# set term term1 from source-address 10.108.0.0/16 user@host# set term term1 from protocol ospf user@host# set term term1 then accept
Configure the term that rejects all other packets.
[edit firewall family inet filter ospf_filter] user@host# set term default_term then reject administratively-prohibited
Apply the Firewall Filter to the Loopback Interface
Step-by-Step Procedure
To apply the firewall filter to the loopback interface:
Configure the interface.
[edit] user@host# edit interfaces lo0 unit 0 family inet
Configure the logical interface IP address.
[edit interfaces lo0 unit 0 family inet] user@host# set address 10.1.2.3/30
Apply the filter to the input.
[edit interfaces lo0 unit 0 family inet] user@host# set filter input ospf_filter
Confirm and Commit Your Candidate Configuration
Step-by-Step Procedure
To confirm and then commit your candidate configuration:
Confirm the configuration of the stateless firewall filter by entering the
show firewallconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show firewall family inet { filter ospf_filter { term term1 { from { source-address { 10.108.0.0/16; } protocol ospf; } then { accept; } } term default_term { then { reject administratively-prohibited; # default reject action } } } }Confirm the configuration of the interface by entering the
show interfacesconfiguration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.[edit] user@host# show interfaces lo0 { unit 0 { family inet { filter { input ospf_filter; } address 10.1.2.3/30; } } }If you are done configuring the device, commit your candidate configuration.
[edit] user@host# commit
Verification
To confirm that the configuration is working properly, enter the show firewall filter ospf_filter operational
mode command.