Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Example: Configuring Statistics Collection for a Firewall Filter

This example shows how to configure and apply a firewall filter that collects data according to parameters specified in an associated accounting profile.

Requirements

Firewall filter accounting profiles are supported for all traffic types except family any.

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you create a firewall filter accounting profile and apply it to a firewall filter. The accounting profile specifies how frequently to collect packet and byte count statistics and the name of the file to which the statistics are written. The profile also specifies that statistics are to be collected for three firewall filter counters.

Topology

The firewall filter accounting profile filter_acctg_profile specifies that statistics are collected every 60 minutes, and the statistics are written to the file /var/log/ff_accounting_file. Statistics are collected for counters named counter1, counter2, and counter3.

The IPv4 firewall filter named my_firewall_filter increments a counter for each of three filter terms. The filter is applied to logical interface ge-0/0/1.0.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following configuration commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Configure an Accounting Profile

Step-by-Step Procedure

To configure an accounting profile:

  1. Create the accounting profile filter_acctg_profile.

  2. Configure the accounting profile to filter and collect packet and byte count statistics every 60 minutes and write them to the /var/log/ff_accounting_file file.

  3. Configure the accounting profile to collect filter profile statistics (packet and byte counts) for three counters.

Configure a Firewall Filter That References the Accounting Profile

Step-by-Step Procedure

To configure a firewall filter that references the accounting profile:

  1. Create the firewall filter my_firewall_filter.

  2. Apply the filter-accounting profile filter_acctg_profile to the firewall filter.

  3. Configure the first filter term and counter.

  4. Configure the second filter term and counter.

  5. Configure the third filter term and counter.

Apply the Firewall Filter to an Interface

Step-by-Step Procedure

To apply the firewall filter to a logical interface:

  1. Configure the logical interface to which you will apply the firewall filter.

  2. Configure the interface address for the logical interface.

  3. Apply the firewall filter to the logical interface.

Confirm Your Candidate Configuration

Step-by-Step Procedure

To confirm your candidate configuration:

  1. Confirm the configuration of the accounting profile by entering the show accounting-options configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  2. Confirm the configuration of the firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  3. Confirm the configuration of the interfaces by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Clear the Counters and Commit Your Candidate Configuration

Step-by-Step Procedure

To clear the counters and commit your candidate configuration:

  1. From operational command mode, use the clear firewall all command to clear the statistics for all firewall filters.

    To clear only the counters incremented in this example, include the name of the firewall filter.

  2. Commit your candidate configuration.

Verification

To verify that the filter is applied to the logical interface, run the show interfaces command with the detail or extensive output level.

To verify that the three counters are collected separately, run the show firewall filter my_firewall_filter command.