Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
Table 24: Firewall Filter Application Points (continued)
Application Point
Filter Type
Supported Hierarchy
Comments
Protocol family on
interface—Filter is applied to
a specific protocol family on
the logical interface.
Address resolution protocol
(ARP) policer you define at
the [edit firewall policer
hierarchy level.
[edit interfaces interface-name
unit unit-number family inet
policer arp policer-name]
Only the protocol family inet is
supported.
Define and apply an ARP
policer to override the ARP
policer that is installed by
default. The default ARP
policer is shared by all
interfaces configured on
the router. An ARP policer
you define can be applied
to one or more specific
interfaces only.
ARP policers are supported
on Ethernet, Gigabit
Ethernet, and aggregated
Ethernet interfaces, routing
interfaces, and logical
tunnel interfaces. For
logical tunnel interfaces,
only Ethernet and virtual
LAN (VLAN) encapsulation
is supported.
Protocol family on
interface—Filter is applied to
a specific protocol family on
the logical interface.
Service filter applied as an
output or input filter to a
service set that you define at
the [edit firewall family
family-name service-filter
filter-name] hierarchy level.
Only the protocol families
inet and inet6 are supported.
• [edit interfaces interface-name
unit unit-number family (inet |
inet6) service input service-set
service-set-name service-filter
filter-name]
• [edit interfaces interface-name
unit unit-number family (inet |
inet6) service output
service-set service-set-name
service-filter filter-name]
Supported only on
Adaptive Services (AS) and
Multiservices (MS) PICs.
For the service-set-name,
specify a service set
configured at the [edit services
service-set] hierarchy level.
Protocol family on
interface—Filter is applied to
a specific protocol family on
the logical interface.
Postservice filter you define
at the [edit firewall family
family-name service-filter
filter-name] hierarchy level.
Only the protocol families
inet and inet6 are supported.
[edit interfaces interface-name
unit unit-number family (inet |
inet6) service input
post-service-filter filter-name]
A postservice filter is
applied to traffic returning
to the services interface
after service processing.
The filter is applied only if
a service set is configured
and selected.
Protocol family on
interface—Filter is applied to
a specific protocol family on
the logical interface.
Reverse packet forwarding
(RPF) check filter you define
at the [edit firewall family
family-name filter filter-name]
[edit interfaces interface-name
unit unit-number family (inet |
inet6) rpf-check fail-filter
filter-name]
Supported on MX Series
routers only.
Only the protocol families
inet and inet6 are supported.
188
Copyright © 2010, Juniper Networks, Inc.