Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
Configuring MPLS Match Conditions
Table 29 on page 208, Table 30 on page 208, and Table 31 on page 209 describe the firewall
filter match conditions supported for MPLS traffic.
To configure firewall filter match conditions for MPLS traffic, include the match-conditions
statement at one of the hierarchy levels described below.
• At the [edit firewall family mpls filter filter-name term term-name from] hierarchy level:
Table 29: MPLS Firewall Filter Match Conditions (Hierarchy Level 1)
Match Condition
exp number
Description
Experimental (EXP) bit number or range of bit numbers in the MPLS header. For number, you can specify
one or more values from 0 through 7 in decimal, binary, or hexadecimal format.
exp-except number
Do not match on the EXP bit number or range of bit numbers in the MPLS header. For number, you can
specify one or more values from 0 through 7.
forwarding-class class
Forwarding class. Specify assured-forwarding, best-effort, expedited-forwarding, or network-control.
forwarding-class-except
class
Do not match on the forwarding class. Specify assured-forwarding, best-effort, expedited-forwarding,
or network-control.
interface
interface-name
Interface on which the packet was received. You can configure a match condition that matches packets
based on the interface on which they were received.
interface-set
interface-set-name
(MX Series routers and routers with Enhanced IQ2 [IQ2E] PICs only) Interface set on which the packet
was received. An interface set is a set of logical interfaces used to configure hierarchical class-of- service
schedulers. For information about configuring an interface set, see the Junos Class of Service Configuration
Guide and the Junos Network Interfaces Configuration Guide.
ip-version number
(MPLS-tagged IPv4 packets only) Inner IP version.
• (MPLS-tagged IPv4 packets only) At the [edit firewall family mpls filter filter-name
term term-name from ip-version ipv4] hierarchy level:
Table 30: MPLS Firewall Filter Match Conditions (Hierarchy Level 2)
Match Condition
destination-addressaddress
Description
Destination prefix.
protocol number
IP protocol field. In place of the numeric value, you can specify one of the following text synonyms (the
field values are also listed): ah (51), egp (8), esp (50), gre (47), icmp (1), igmp (2), ipip (4), ipv6 (41),
ospf (89), pim (103), rsvp (46), tcp (6), or udp (17).
source-addressaddress
Address of the source node sending the packet in IPv4 address format; 32 bits in length.
• (MPLS-tagged IPv4 packets only) At the [edit firewall family mpls filter filter-name
term term-name from ip-version ipv4 protocol protocol-name] hierarchy level:
208
Copyright © 2010, Juniper Networks, Inc.