Juniper POLICY MANAGEMENT - CONFIGURATION GUIDE V11.1.X Configuration Manual page 38

JUNOSe 11.1.x Policy Management Configuration Guide
Using IP Classifier Control Lists to Match Route Class Values
You can set up classifier control lists to match route-class values. In this example,
svale20 matches the source address lookup route-class value of 1, svale30 matches
the destination address lookup route-class value of 1 and a ToS byte value of 10,
svale40 matches the source address lookup route-class value of 1 and the packets
destined to a local interface, and west20 matches the source address lookup
route-class value of 1 and packets that are not destined for a local interface (packets
destined for remote interfaces).
Creating IP Classifier Control Lists for TCP and UDP Ports
You can specify a single TCP or UDP port or a range of ports, where packets are
matched with source address 198.168.30.100 and UDP source port numbers in the
range 1–10.
12
Using IP Classifier Control Lists to Match Route Class Values
Issue the ip classifier-list command to classify traffic on any source or destination
address:
host1(config)#ip classifier-list YourListName ip any any
host1(config)#ip classifier-list YourListName ip host 10.10.10.10 any
host1(config)#ip classifier-list YourListName ip 10.10.0.0 0.0.255.255 host
10.10.10.2
Issue the ip classifier-list command:
host1(config)#ip classifier-list svale20 source-route-class 1 ip any any
host1(config)#ip classifier-list svale30 destination-route-class 1 ip any any
tos 10
host1(config)#ip classifier-list svale40 source-route-class 1 local true ip any any
host1(config)#ip classifier-list west25 source-route-class 1 local false ip any
any
Issue the ip classifier-list command to create a CLACL on a UDP host:
host1(config)#ip classifier-list YourListName udp host 192.168.30.100 range
1 10 any
To create a CLACL that matches all traffic on UDP source ports greater than 100:
host1(config)#ip classifier-list XYZCorpUdp udp any gt 100 172.17.2.1
0.0.255.255
To match a non-TCP packet originating from IP address 172.28.100.52:
host1(config)#ip classifier-list YourListName not tcp host 172.28.100.52 any
To specify a single TCP or UDP port or range of ports, an ICMP code and optional
type, or an IGMP type, which matches packets with source address
198.168.30.100 and ICMP type 2 and code 10:
host1(config)#ip classifier-list YourListName icmp host 192.168.30.100 any 2
10