Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
all these functions are standard firewall filters. The Junos OS also supports two additional
specialized firewall filter types: simple filters and service filters.
NOTE: There is no limit to the number of filters and counters you can set, but
there are some practical considerations. More counters require more terms,
and a large number of terms can take a long time to process during a commit
operation. However, filters with more than 4000 terms and counters have
been implemented successfully.
Firewall Filter Components
A firewall filter consists of a protocol family and one or more terms that specify the
filtering criteria and the action to take if a match occurs. After you define a firewall filter,
you apply it to specific interfaces. Because the firewall filter process consists of two
aspects—creating filters and then applying them—you can reuse the same filters on your
router. Also, when you need to update the firewall filter itself, you have to make the
change only in one place.
Protocol Family
When writing a firewall filter, you start by selecting the protocol family for which you
want to specify filtering criteria. Firewall filters support the following protocol families:
• IPv4 (inet)
• IPv6 (inet6)
• MPLS (mpls)
• VPLS (vpls)
• Circuit cross-connects (ccc)
• (MX Series Ethernet Services routers only) Bridge (bridge)
• Protocol-independent (any)
Terms
Firewall filters require that you use terms. Each term can include both match criteria and
actions.
The order in which you configure firewall filter terms is important. Terms are evaluated
in the order in which they are configured. By default, new terms are always added to the
end of the existing filter. You can use the insert command to reorder the terms of a firewall
filter.
By default, each firewall filter ends with an implicit deny-all term. The final default action
is to discard all packets. Packets that do not match any of the configured match conditions
in a firewall filter are silently discarded.
184
Copyright © 2010, Juniper Networks, Inc.