Juniper JUNOS OS 10.3 - SOFTWARE Manual page 3149

Step-by-Step
Procedure
Results
Copyright © 2010, Juniper Networks, Inc.
set vlans guest-vlan description "restrict guest-to-employee traffic and peer-to-peer
applications on guest VLAN"
set vlans guest-vlan filter input ingress-vlan-limit-guest
To configure and apply a VLAN firewall filter to restrict guest-to-employee traffic and
peer-to-peer applications on
Define the firewall filter
1.
[edit firewall]
set firewall family ethernet-switching filter ingress-vlan-limit-guest
Define the term
2. guest-to-guest
guests but not employees on the
[edit firewall family ethernet-switching filter ingress-vlan-limit-guest]
user@switch# set term guest-to-guest from destination-address 192.0.2.33/28
user@switch# set term guest-to-guest then accept
Define the term no-guest-employee-no-peer-to-peer
3.
Web access but prevent them from using peer-to-peer applications on the
.
guest-vlan
NOTE: The
any host in a VLAN is the next-hop router.
[edit firewall family ethernet-switching filter ingress-vlan-limit-guest]
user@switch# set term no-guest-employee-no-peer-to-peer from
destination-mac-address 00.05.85.00.00.DF
user@switch# set term no-guest-employee-no-peer-to-peer then accept
Apply the firewall filter
4.
for guest-vlan :
[edit]
user@switch# set vlans guest-vlan description "restrict guest-to-employee traffic
and peer-to-peer applications on guest VLAN"
user@switch# set vlans guest-vlan filter input ingress-vlan-limit-guest
Display the results of the configuration:
user@switch# show
firewall {
family ethernet-switching {
filter ingress-vlan-limit-guest {
term guest-to-guest {
from {
destination-address 192.0.2.33/28;
}
then {
accept;
}
}
term no-guest-employee-no-peer-to-peer {
Chapter 101: Examples of Firewall Filters Configuration
:
guest-vlan
ingress-vlan-limit-guest
to permit guests on the
employee-vlan
destination-mac-address
as an input filter to the interface
ingress-vlan-limit-guest
:
to talk with other
guest-vlan
:
to allow guests on guest-vlan
is the default gateway, which for
3053