Juniper J2300 User Manual page 18

J-series™ Services Router User Guide
Chapter 18
Chapter 19
Chapter 20
xviii
Table of Contents
Stateless Firewall Filter Match Conditions, Actions, and Action
Modifiers. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..363
Class-of-Service Overview. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..366
Benefits of DiffServ CoS .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..367
DSCPs and Forwarding Service Classes . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..367
JUNOS CoS Functions. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..369
How Forwarding Classes and Schedulers Work. .. .. .. .. .. .. .. .. .. .. .. .. .. ..370
Default Forwarding Class Queue Assignments. .. .. .. .. .. .. .. .. .. .. .. ..370
Default Scheduler Settings. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 371
Default Behavior Aggregate (BA) Classifiers .. .. .. .. .. .. .. .. .. .. .. .. .. ..372
DSCP Rewrites.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..373
Sample BA Classification .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..373
Configuring Routing Policies
Before You Begin. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..376
Configuring a Routing Policy with a Configuration Editor .. .. .. .. .. .. .. .. .. .. ..376
Configuring the Policy Name. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..377
Configuring a Policy Term .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..377
Rejecting Known Invalid Routes . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..378
Injecting OSPF Routes into the BGP Routing Table . .. .. .. .. .. .. .. .. .. .. .. ..380
Grouping Source and Destination Prefixes in a Forwarding Class .. .. .. ..382
Configuring Policy to Prepend the AS Path . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..383
Configuring Damping Parameters . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..385
Configuring Firewall Filters and NAT
Before You Begin. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..389
Configuring a Stateful Firewall Filter with Quick Configuration .. .. .. .. .. .. .. ..390
Configuring a Stateful Firewall Filter with a Configuration Editor.. .. .. .. .. .. ..393
Configuring a Stateless Firewall Filter with a Configuration Editor .. .. .. .. .. ..399
Stateless Firewall Filter Strategies . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..400
Strategy for a Typical Stateless Firewall Filter.. .. .. .. .. .. .. .. .. .. .. .. ..400
Strategy for Handling Packet Fragments . .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..400
Configuring a Routing Engine Firewall Filter for Services and Protocols from
Trusted Sources . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..400
Configuring a Routing Engine Firewall Filter to Protect Against TCP and
ICMP Floods . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..404
Configuring a Routing Engine Firewall Filter to Handle Fragments . .. .. ..409
Applying a Stateless Firewall Filter to an Interface . .. .. .. .. .. .. .. .. .. .. .. .. 414
Verifying Firewall Filter Configuration . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 415
Displaying Firewall Filter Configurations.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 415
Verifying a Stateful Firewall Filter.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..420
Displaying Firewall Filter Logs . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 421
Displaying Firewall Filter Statistics .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..422
Verifying a Services, Protocols, and Trusted Sources Firewall Filter. .. .. ..423
Verifying a TCP and ICMP Flood Firewall Filter. .. .. .. .. .. .. .. .. .. .. .. .. .. ..424
Verifying a Firewall Filter That Handles Fragments .. .. .. .. .. .. .. .. .. .. .. ..425
Configuring Class of Service with DiffServ
Before You Begin. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..428
Configuring CoS with DiffServ with a Configuration Editor .. .. .. .. .. .. .. .. .. ..428
.. 375
. . 389
. . 427