Applying A Firewall Filter To A Layer 3 (Routed) Interface - Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual

Applying a Firewall Filter to a Layer 3 (Routed) Interface

Copyright © 2010, Juniper Networks, Inc.
Apply firewall filters to filter packets that are entering or exiting the VLAN:
2.
To apply a firewall filter to filter packets that are entering the VLAN:
[edit vlans]
user@switch# set employee-vlan vlan-id 20 filter input ingress-vlan-filter
To apply a firewall filter to filter packets that are exiting the VLAN:
[edit vlans]
user@switch# set employee-vlan vlan-id 20 filter output egress-vlan-filter
NOTE: You can apply no more than one firewall filter per VLAN, per
direction.
You can apply a firewall filter to a Layer 3 (routed) interface to filter ingress or egress
traffic on the switch. When you configure the firewall filter, you can specify any match
condition, action, and action modifiers specified in "Firewall Filter Match Conditions and
Actions for EX Series Switches" on page 3233. The action specified in the match condition
indicates the action for the matched packets in the ingress or egress traffic.
To apply a firewall filter to a Layer 3 interface on a switch:
Specify the interface name and provide a meaningful description of the firewall filter
1.
and the interface to which the filter is applied:
[edit interfaces]
user@switch# set ge-0/1/0 description "filter to count and monitor employee-vlan
traffic applied on layer 3 interface"
NOTE: Providing the description is optional.
Specify the unit number, family address type, and address for the interface:
2.
[edit interfaces]
user@switch# set ge-0/1/0 unit 0 family inet address 10.10.10.1/24
For firewall filters applied to Layer 3 interfaces, the family address type must be
(for IPv4 traffic) or
inet6
You can apply firewall filters to filter packets that are entering or exiting a Layer 3
3.
(routed) interface:
To apply a firewall filter to filter packets that are entering a Layer 3 interface:
[edit interfaces]
user@switch# set ge-0/1/0 unit 0 family inet address 10.10.10.1/24 filter input
ingress-router-filter
To apply a firewall filter to filter packets that are exiting a Layer 3 interface:
(for IPv6 traffic).
Chapter 108: Configuring Firewall Filters
inet
3295