Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Both for filters with a single term and for filters with multiple terms, if a term does not
contain a from statement, the action in the term’s then statement is performed on all
packets.
If a term does not contain a then statement or if you do not specify an action in the
then statement, and if the packet matches the conditions in the term’s from statement,
the packet is accepted.
Each firewall filter has an implicit discard action at the end of the filter, which is equivalent
to the following explicit filter term:
term implicit-rule {
then discard;
}
Therefore, if a packet matches none of the terms in the filter, it is discarded.
Overview of Match Conditions in Firewall Filter Terms
Configuring IPv4 Match Conditions
In the from statement in a firewall filter term, you specify characteristics that the packet
must have for the action in the subsequent then statement to be performed. The
characteristics are referred to as match conditions. The packet must match all conditions
in the from statement for the action to be performed, which also means that their order
in the from statement is not important.
Each protocol family supports a different set of match conditions, and some match
conditions are supported only on certain routers. For example, a number of match
conditions for VPLS traffic are supported only on the MX Series Ethernet Services Routers.
Table 25 on page 197 describes the firewall filter match conditions that are supported for
IPv4 traffic.
To configure firewall filter match conditions for IPv4 traffic:
• Include the match-conditions statement at the [edit firewall family family-name filter
filter-name term term-name from]
Table 25: IPv4 Firewall Filter Match Conditions
Match Condition
Description
keyword-except
Negate a match. For example, destination-port-except number.
ah-spi spi-value
IPsec authentication header (AH) security parameter index (SPI) value. Match on this specific SPI
value.
ah-spi-except
spi-value
IPsec AH SPI value. Do not match on this specific SPI value.
destination-address
address
Destination prefix.
Copyright © 2010, Juniper Networks, Inc.
197