Interface Filter Match Conditions; Ip Address Filter Match Conditions - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos
Understanding Firewall Filter Match Conditions
Filter Match Conditions
Numeric Filter Match Conditions
3032
®
OS for EX Series Ethernet Switches, Release 10.3
Before you define terms for firewall filters, you must understand how the conditions that
you specify in a term are handled and how to specify interface filter, numeric filter, address
filter, and bit-field filter match conditions to achieve the desired filtering results.
Filter Match Conditions on page 3032
Numeric Filter Match Conditions on page 3032
Interface Filter Match Conditions on page 3033
IP Address Filter Match Conditions on page 3033
MAC Address Filter Match Conditions on page 3034
Bit-Field Filter Match Conditions on page 3034
In the statement of a firewall filter term, you specify the conditions that the packet
from
must match for the action in the
statement must match for the action to be taken. The order in which you specify match
conditions is not important, because a packet must match all the conditions in a term
for a match to occur.
If you specify no match conditions in a term, that term matches all packets.
An individual condition in a
you cannot specify numeric ranges or multiple source or destination addresses.
Individual conditions in a
from
explicit mismatch.
Numeric filter conditions match packet fields that are identified by a numeric value, such
as port and protocol numbers. For numeric filter match conditions, you specify a keyword
that identifies the condition and a single value that a field in a packet must match.
You can specify the numeric value in one of the following ways:
Single number—A match occurs if the value of the field matches the number. For
example:
source-port 25;
Text synonym for a single number— A match occurs if the value of the field matches
the number that corresponds to the synonym. For example:
source-port http;
To specify more than one value in a filter term, you enter each value in its own match
statement. For example, a match occurs in the following term if the value of
is 10 or 30.
[edit firewall family family-name filter filter-name term term-name from]
statement to be taken. All conditions in the
then
statement cannot contain a list of values. For example,
from
statement cannot be negated. A negated condition is an
vlan
Copyright © 2010, Juniper Networks, Inc.
from
field