Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
• service-filter-hit (service filters and family inet or inet6 only)
• syslog (family inet and inet6 only)
• three-color-policer policer-name
• topology topology-name (family inet and inet6 only)
• traffic-class code-point (family inet6) only
NOTE: You can specify only one of the following actions in a single term:
accept, discard, logical-system logical-system-name, next term, reject,
routing-instance routing-instance-name, or topology topology-name. You
can, however, specify one of these actions with one or more nonterminating
actions in a single term. For example, within a term, you can specify accept
with count and syslog.
Related
Documentation
• Overview of Match Conditions in Firewall Filter Terms on page 197
• How to Specify Firewall Filter Match Conditions on page 220
• Configuring Actions in Firewall Filter Terms on page 226
How Firewall Filters Are Evaluated
When a firewall filter consists of a single term, the filter is evaluated as follows:
• If the packet matches all the conditions, the action in the then statement is taken.
• If the packet matches all the conditions and if there is no action specified in the
then statement, the default action accept is used.
• If the packet does not match all the conditions, it is discarded.
When a firewall filter consists of more than one term, the terms in the filter are evaluated
sequentially:
1. The packet is evaluated against the conditions in the from statement in the first term.
2. If the packet matches the from statement, the action in the then statement is
performed. Then:
• If the next term action is not specified, the evaluation ends. Subsequent terms in
the filter are not evaluated.
• If the next term action is present, the evaluation continues to the next term.
3. If the packet does not match the from statement in the first term, it is evaluated against
the conditions in the from statement in the second term.
This process continues until either the packet matches the from conditions in one of
the subsequent terms or there are no more terms.
196
Copyright © 2010, Juniper Networks, Inc.