Table of Contents
Advertisement
Dell PowerConnect J-Series Ethernet Switch Complete Software Guide for Junos OS
Understanding How Firewall Filters Are Evaluated
2746
Understanding Firewall Filter Match Conditions on page 2748
Understanding How Firewall Filters Are Evaluated on page 2746
Understanding How Firewall Filters Test a Packet's Protocol on page 2752
Understanding the Use of Policers in Firewall Filters on page 2752
Understanding Filter-Based Forwarding for J-EX Series Switches on page 2753
A firewall filter consists of one or more terms, and the order of the terms within a firewall
filter is important. Before you configure firewall filters, you should understand how J-EX
Series Switches evaluate the terms within a firewall filter and how packets are evaluated
against the terms.
When a firewall filter consists of a single term, the filter is evaluated as follows:
If the packet matches all the conditions, the action in the
If the packet matches all the conditions, and no action is specified in the
the default action
accept
When a firewall filter consists of more than one term, the firewall filter is evaluated
sequentially:
The packet is evaluated against the conditions in the
1.
If the packet matches all the conditions in the term, the action in the
2.
is taken and the evaluation ends. Subsequent terms in the filter are not evaluated.
If the packet does not match all the conditions in the term, the packet is evaluated
3.
against the conditions in the
This process continues until either the packet matches the conditions in the
statement in one of the subsequent terms or there are no more terms in the filter.
If a packet passes through all the terms in the filter without a match, the packet is
4.
discarded.
Figure 77 on page 2747 shows how a J-EX Series switch evaluates the terms within a firewall
filter.
is taken.
from
statement in the second term.
statement is taken.
then
then
statement,
statement in the first term.
from
statement
then
from
Advertisement
Chapters
Table of Contents
Troubleshooting
