Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Example: Configuring a Stateless Firewall Filter to Protect a Logical System Against ICMP Floods

This example shows how to configure a stateless firewall filter that protects against ICMP denial-of-service attacks on a logical system.


In this example, no special configuration beyond device initialization is required.


This example shows a stateless firewall filter called protect-RE that polices ICMP packets. The icmp-policer limits the traffic rate of the ICMP packets to 1,000,000 bps and the burst size to 15,000 bytes. Packets that exceed the traffic rate are discarded.

The policer is incorporated into the action of a filter term called icmp-term.

In this example, a ping is sent from a directly connected physical router to the interface configured on the logical system. The logical system accepts the ICMP packets if they are received at a rate of up to 1 Mbps (bandwidth-limit). The logical system drops all ICMP packets when this rate is exceeded. The burst-size-limit statement accepts traffic bursts up to 15 Kbps. If bursts exceed this limit, all packets are dropped. When the flow rate subsides, ICMP packets are again accepted.


Figure 1 shows the topology used in this example.

Figure 1: Logical System with a Stateless FirewallLogical System with a Stateless Firewall


CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.


Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure an ICMP firewall filter on a logical system:

  1. Configure the interface on the logical system.

  2. Explicitly enable ICMP packets to be received on the interface.

  3. Create the policer.

  4. Apply the policer to a filter term.

  5. Apply the policer to the logical system interface.

  6. If you are done configuring the device, commit the configuration.


Confirm your configuration by issuing the show logical-systems LS1 command.


Confirm that the configuration is working properly.

Verifying That Ping Works Unless the Limits Are Exceeded


Make sure that the logical system interface is protected against ICMP-based DoS attacks.


Log in to a system that has connectivity to the logical system and run the ping command.


When you send a normal ping, the packet is accepted. When you send a ping packet that exceeds the filter limit, the packet is discarded.