Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
To configure a firewall filter:
1. Include the family family-name statement at the [edit firewall] hierarchy level to specify
the protocol family for which you want to filter traffic.
For family-name, specify one of the following:
• inet—IPv4
• inet6—IPv6
• ccc—Layer 2 circuit cross-connects
• mpls—MPLS
• any—Protocol-independent (Use this protocol family to apply a firewall filter to a
physical interface.)
• vpls—VPLS
• bridge—(MX Series Ethernet Services Routers only) Layer 2 bridging
2. Include the filter filter-name statement at the [edit firewall family family-name]
hierarchy level to specify a name for the firewall filter.
The filter name can contain letters, numbers, and hyphens (-) and be up to 64
characters long. To include spaces in the name, enclose the entire name in quotation
marks (“ ”).
3. Include the term term-name statement at the [edit firewall family family-name filter
filter-name] hierarchy level to configure a term.
Each firewall filter consists of one or more terms. For each term you specify one or
more match conditions and one or more actions. The term name can contain letters,
numbers, and hyphens (-) and can be up to 74 characters long. To include spaces in
the name, enclose the entire name in quotation marks (“ ”).
You can specify multiple terms in a filter, effectively chaining together a series of
match-action operations to apply to the packets on an interface.
4. Include the from match-conditions statement at the [edit firewall family family-name
filter filter-name term term-name] hierarchy level to specify the fields or values that
the packet must contain (match conditions).
For a match to occur, the packet must match all the conditions in the term. An
individual match condition in a from statement can contain a list of values. For example,
you can specify numeric range or multiple source and destination addresses. When
a condition defines a list of values, a match occurs if any of the values matches the
packet.
194
Copyright © 2010, Juniper Networks, Inc.