Dell PowerConnect J-EX4200-24T Software Manual page 2840

Dell PowerConnect J-Series Ethernet Switch Complete Software Guide for Junos OS
Configuring a VLAN Firewall Filter to Restrict Guest-to-Employee Traffic and Peer-to-Peer
Applications on the Guest VLAN
CLI Quick
Configuration
Step-by-Step
Procedure
2768
analyzer employee-monitor;
}
}
}
}
}
vlans {
employee-vlan {
description "filter at egress VLAN to count and analyze employee to Web traffic";
filter {
output egress-vlan-watch-employee;
}
}
}
To configure and apply firewall filters for port, VLAN, and router interfaces, perform these
tasks:
In the following example, the first filter term permits guests to talk with other guests but
not employees on employee-vlan
prevents them from using peer-to-peer applications on
To quickly configure a VLAN firewall filter to restrict guest-to-employee traffic, blocking
guests from talking with employees or employee hosts on
to use peer-to-peer applications on
them into the switch terminal window:
[edit]
set firewall family ethernet-switching filter ingress-vlan-limit-guest term guest-to-guest from
destination-address 192.0.2.33/28
set firewall family ethernet-switching filter ingress-vlan-limit-guest term guest-to-guest then
accept
set firewall family ethernet-switching filter ingress-vlan-limit-guest term
no-guest-employee-no-peer-to-peer from destination-mac-address 00.05.85.00.00.DF
set firewall family ethernet-switching filter ingress-vlan-limit-guest term
no-guest-employee-no-peer-to-peer then accept
set vlans guest-vlan description "restrict guest-to-employee traffic and peer-to-peer applications
on guest VLAN"
set vlans guest-vlan filter input ingress-vlan-limit-guest
To configure and apply a VLAN firewall filter to restrict guest-to-employee traffic and
peer-to-peer applications on
Define the firewall filter
1.
[edit firewall]
set firewall family ethernet-switching filter ingress-vlan-limit-guest
Define the term
guest-to-guest
2.
guests but not employees on the
[edit firewall family ethernet-switching filter ingress-vlan-limit-guest]
user@switch# set term guest-to-guest from destination-address 192.0.2.33/28
user@switch# set term guest-to-guest then accept
. The second filter term allows guests Web access but
, copy the following commands and paste
guest-vlan
:
guest-vlan
:
ingress-vlan-limit-guest
to permit guests on the
:
employee-vlan
guest-vlan .
employee-vlan or attempting
to talk with other
guest-vlan