Mac Address Filter Match Conditions; Bit-Field Filter Match Conditions; Table 420: Actions For Firewall Filters - Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual

MAC Address Filter Match Conditions

Bit-Field Filter Match Conditions

Table 420: Actions for Firewall Filters

Logical Operators
!
&
|
Copyright © 2010, Juniper Networks, Inc.
MAC address filter match conditions can match source and destination MAC address
values in a packet. For MAC address filter match conditions, you specify a keyword that
identifies the field and one value of that type that a packet must match.
You can specify the MAC address as six hexadecimal bytes in the following formats:
[edit firewall family family-name filter filter-name term term-name from]user@host#
set destination-mac-address 0011.2233.4455
[edit firewall family family-name filter filter-name term term-name from]user@host#
set destination-mac-address 00:11:22:33:44:55
[edit firewall family family-name filter filter-name term term-name from]user@host#
set destination-mac-address 001122334455
To specify more than one MAC address in a filter term, you enter each MAC address in
its own match statement. For example, a match occurs in the following term if the value
of the
source-mac-address
[edit firewall family family-name filter filter-name term term-name from]user@host#
set source-mac-address 00:11:22:33:44:55user@host# set source-mac-address 00:11:22:33:20:15
Bit-field filter conditions match packet fields if particular bits in those fields are or are
not set. You can match the IP options, TCP flags, and IP fragmentation fields. For bit-field
filter match conditions, you specify a keyword that identifies the field and tests to
determine that the option is present in the field.
To specify the bit-field value to match, enclose the value in double quotation marks. For
example, a match occurs if the
[edit firewall family family-name filter filter-name term term-name from]user@host#
set tcp-flags "rst"
Typically, you specify the bits to be tested by using keywords. Bit-field match keywords
always map to a single bit value. You also can specify bit fields as hexadecimal or decimal
numbers.
To match multiple bit-field values, use the logical operators, which are described in Table
420 on page 3257. The operators are listed in order from highest precedence to lowest
precedence. Operations are left-associative.
Description
Negation.
Logical AND.
Logical OR.
To negate a match, precede the value with an exclamation point. For example, a match
occurs only if the RST bit in the TCP flags field is not set:
field matches either of the following addresses.
bit in the TCP flags field is set:
RST
Chapter 106: Firewall Filters—Overview
3257