Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Table 26: IPv6 Firewall Filter Match Conditions (continued)
Match Condition
Description
source-port number
TCP or UDP source port field. You cannot specify the port and source-port match conditions in the
same term.
Normally, you specify this match in conjunction with the protocol match statement to determine which
protocol is being used on the port. For more information, see “Overview of Protocol Match Conditions”
on page 217.
In place of the numeric field, you can specify one of the text synonyms listed under destination-port.
source-prefix-list name
Source prefixes in the specified prefix list. Specify a prefix list name defined at the [edit policy-options
prefix-list prefix-list-name] hierarchy level.
tcp-established
TCP packets other than the first packet of a connection. This is a synonym for "(ack | rst)".
This condition does not implicitly check that the protocol is TCP. To check this, specify the protocol
tcp match condition.
tcp-flags flags
One or more of the following TCP flags:
• bit-name: fin, syn, rst, push, ack, urgent
You can string together multiple flags using logical operators.
• numerical value: 0x01 through 0x20
• text synonym: tcp-established, tcp-initial
Configuring the tcp-flags match condition requires that you configure the next-header tcp match
condition.
tcp-initial
Initial packet of a TCP connection. Configuring the tcp-initial match condition also requires that you
configure the next-header match condition.
traffic-class number
8-bit field that specifies the class-of-service (CoS) priority of the packet. The traffic-class field is used
to specify a DiffServ code point (DSCP) value.
This field was previously used as the type-of-service (ToS) field in IPv4. However, the semantics of
this field (for example, DSCP) are identical to those of IPv4.
You can specify a numeric value from 0 through 63. To specify the value in hexadecimal form, include
0x as a prefix. To specify the value in binary form, include b as a prefix.
In place of the numeric value, you can specify one of the following text synonyms (the field values are
also listed):
• RFC 3246, An Expedited Forwarding PHB (Per-Hop Behavior), defines one code point: ef (46).
• RFC 2597, Assured Forwarding PHB Group, defines 4 classes, with 3 drop precedences in each class,
for a total of 12 code points:
• af11 (10), af12 (12), af13 (14)
• af21 (18), af22 (20), af23 (22)
• af31 (26), af32 (28), af33 (30)
• af41 (34), af42 (36), af43 (38)
Copyright © 2010, Juniper Networks, Inc.
205