Understanding How Firewall Filters Test A Packet's Protocol - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Related
Documentation
Copyright © 2010, Juniper Networks, Inc.
To negate a match, precede the value with an exclamation point. For example, a match
occurs only if the RST bit in the TCP flags field is not set:
[edit firewall family family-name filter filter-name term term-name from]user@host#
set tcp-flags "!rst"
In the following example of a logical AND operation, a match occurs if the packet is the
initial packet on a TCP session:
[edit firewall family family-name filter filter-name term term-name from]user@host#
set tcp-flags "syn&!ack"
In the following example of a logical OR operation, a match occurs if the packet is not
the initial packet on a TCP session:
[edit firewall family family-name filter filter-name term term-name from]user@host#
set tcp-flags "syn|ack"
For a logical OR operation, you can specify a maximum of two match conditions in a
single term. If you need to match more than two bit-field values in a logical OR operation,
configure the same match condition in consecutive terms with additional bit-field values.
In the following example, the two terms configured match the SYN, ACK, FIN, or RST bit
in the TCP flags field:
[edit firewall family family-name filter filter-name term term-name1
from]user@host# set tcp-flags "syn|ack"
[edit firewall family family-name filter filter-name term term-name2
from]user@host# set tcp-flags "fin|rst"
You can use text synonyms to specify some common bit-field matches. You specify
these matches as a single keyword. In the following example of a text synonym, a match
occurs if the packet is the initial packet on a TCP session:
[edit firewall family family-name filter filter-name term term-name from]user@host#
set tcp-flags tcp-initial
Firewall Filters for EX Series Switches Overview on page 3001
Understanding How Firewall Filters Test a Packet's Protocol on page 3036
Example: Configuring Firewall Filters for Port, VLAN, and Router Traffic on EX Series
Switches on page 3039
Example: Using Filter-Based Forwarding to Route Application Traffic to a Security
Device on EX Series Switches on page 3058
Firewall Filter Match Conditions and Actions for EX Series Switches on page 3009
Chapter 100: Firewall Filters—Overview
3035