Figure 12: Firewall Filter To Protect Against Tcp And Icmp Floods - Juniper EX9200 Features Manual

Configuration
CLI Quick
Configuration
Device R1
Device R2
Copyright © 2016, Juniper Networks, Inc.
You can apply a stateless firewall to the input or output sides, or both, of an interface.
To filter packets transiting the device, apply the firewall filter to any non-Routing Engine
interface. To filter packets originating from, or destined for, the Routing Engine, apply the
firewall filter to the loopback (lo0) interface.
Figure 12 on page 87 shows the sample network.

Figure 12: Firewall Filter to Protect Against TCP and ICMP Floods

172.16.0.0/16
fe-1/2/0 fe-1/2/0
10.0.0.1 10.0.0.2
R1
lo0:
R1 192.168.0.1
R2 192.168.0.2
Because this firewall filter limits Routing Engine traffic to TCP packets, routing protocols
that use other transport protocols for Layer 4 cannot successfully establish sessions
when this filter is active. To demonstrate, this example sets up OSPF between Device R1
and Device R2.
"CLI Quick Configuration" on page 87
Figure 12 on page 87.
The section "Step-by-Step Procedure" on page 88
To quickly configure the stateless firewall filter, copy the following commands to a text
file, remove any line breaks, and then paste the commands into the CLI.
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.1/30
set interfaces lo0 unit 0 family inet address 192.168.0.1/32 primary
set interfaces lo0 unit 0 family inet address 172.16.0.1/32
set protocols bgp group ext type external
set protocols bgp group ext export send-direct
set protocols bgp group ext peer-as 200
set protocols bgp group ext neighbor 10.0.0.2
set protocols ospf area 0.0.0.0 interface fe-1/2/0.0
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set policy-options policy-statement send-direct term 1 from protocol direct
set policy-options policy-statement send-direct term 1 then accept
set routing-options router-id 192.168.0.1
set routing-options autonomous-system 100
set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.2/30
set interfaces lo0 unit 0 family inet filter input protect-RE
set interfaces lo0 unit 0 family inet address 192.168.0.2/32 primary
set interfaces lo0 unit 0 family inet address 172.16.0.2/32
Chapter 9: Filter-Specific Counters and Policers
R2
shows the configuration for all of the devices in
describes the steps on Device R2.
87