Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Configuring Firewall Filters

You can configure firewall filters in a switch to control traffic that enters or exits Layer 3 (routed) interfaces. To use a firewall filter, you must configure the filter and then apply it to a Layer 3 interface.

Configuring a Firewall Filter

To configure a firewall filter:

  1. Configure the family address type, filter name, term name, and at least one match condition—for example, match on packets that contain a specific source address:

    Specify the family address type inet for IPv4 or inet6 for IPv6.

    The filter and term names can contain letters, numbers, and hyphens (-) and can be up to 64 characters long. Each filter name must be unique. A filter can contain one or more terms, and each term name must be unique within a filter.

  2. Configure additional match conditions. For example, match on packets that contain a specific source port:

    You can specify one or more match conditions in a single from statement. For a match to occur, the packet must match all the conditions in the term. The from statement is optional, but if included in a term, it cannot be empty. If you omit the from statement, all packets are considered to match.

  3. If you want to apply a firewall filter to multiple interfaces and be able to see counters specific to each interface, configure the interface-specific option:
  4. In each firewall filter term, specify the actions to take if the packet matches all the conditions in that term. You can specify an action and action modifiers:

    • To specify a filter action, for example, to discard packets that match the conditions of the filter term:

      You can specify no more than one action (accept, discard, reject, routing-instance, or vlan) per term.

    • To specify action modifiers, for example, to count and classify packets to a forwarding class. For example:

    If you omit the then statement or do not specify an action, packets that match all the conditions in the from statement are accepted. However, you should always explicitly configure an action in the then statement. You can include no more than one action statement, but you can use any combination of action modifiers. For an action or action modifier to take effect, all conditions in the from statement must match.

    Note:

    Implicit discard is also applicable to a firewall filter applied to the loopback interface, lo0.

Note:

For the complete list of match conditions, actions, and action modifiers, see Firewall Filter Match Conditions and Actions (EX4100, EX4100-F, EX4100-H, EX4400, EX4600, EX4650, QFX5100, QFX5110, QFX5120, QFX5200, QFX5210). Note that on the OCX1100 switch you can use only those match conditions that are valid for IPv4 and IPv6 interfaces.

Applying a Firewall Filter to a Layer 3 (Routed) Interface

To apply a firewall filter to a Layer 3 interface:

  1. Provide a meaningful description of the firewall filter in the configuration of the interface to which the filter will be applied:
  2. You can apply firewall filters to filter packets that enter or exit a Layer 3 interface:

    • To apply a firewall filter to filter packets that enter a Layer 3 interface:

    • To apply a firewall filter to filter packets that exit a Layer 3 interface:

    Note:

    You can apply only one filter to an interface for a given direction (ingress or egress).

Related Documentation