Example: Implementing a Filter for Households That Use ACI-Based VLANs
In the following example using an interface-shared filter, you
configure a dynamic profile that is used to implement agent-circuit-identifier
VLAN household filtering. If $junos-input-filter is FILTER1
and $junos-interface-set-name is ACI1, then a filter with
the name FILTER1-ACI1-in is created and attached to the demux0 unit.
When a subsequent login from the same household occurs, it is in the
same VLAN. If $junos-input-filter is also FILTER1, the
next demux0 interface also has the FILTER1-ACI1-in filter attached.
A low value precedence was used with the interface-shared filter.
If you want to have the interface-shared filter applied first, give
a higher precedence to any other filters that are attached to the
same interfaces.
Filter with interface-set match cannot be used on dynamic interface—dynamic interface-set match is not supported. The shared-name of an interface-shared filter can now be populated from the $junos-svlan-interface-set-name variable. This means interface-shared filter can also be attached to dynamic SVLAN interface-set, before which the shared-name could only be taken from the $junos-interface-set-name variable.
To configure an interface-shared filter using a dynamic profile that is used to implement agent-circuit-identifier VLAN household filtering:
[edit]
dynamic-profile {
client-profile {
interfaces {
demux0 {
unit $junos-interface-unit {
family inet {
filter {
input $junos-input-filter shared-name $junos-interface-set-name precedence 10;
}
}
}
}
}
}
}
firewall {
family inet {
filter FILTER1 {
interface-shared;
term… # the filter’s terms
}
}
}