Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
Table 33: Layer 2 Bridging Firewall Filter Match Conditions (MX Series Ethernet Services Routers
Only) (continued)
Match Condition
isid-priority-code-point-except
number
Description
(Supported with PBB) Do not match internet service identifier priority code point.
learn-vlan-1p-priority
value
(Supported with bridging, VPLS, and Layer 2 circuit cross-connect [CCC] traffic only) IEEE 802.1p
learned VLAN priority field. Specify a single value or multiple values from 0 through 7.
learn-vlan-1p-priority-except
value
(Supported with bridging, VPLS, and Layer 2 circuit cross-connect [CCC] traffic only) Do not match
on the IEEE 802.1p learned VLAN priority field. Specify a single value or multiple values from 0 through
7.
learn-vlan-dei number
(Supported with bridging) Match user virtual LAN (VLAN) identifier DEI bit.
learn-vlan-dei-except
number
(Supported with bridging) Do not match user VLAN identifier DEI bit.
learn-vlan-id number
VLAN identifier used for MAC learning.
learn-vlan-id-except
number
Do not match on the VLAN identifier used for MAC learning.
loss-priority level
Packet loss priority (PLP) level. Specify a single level or multiple levels: low, medium-low, medium-high,
or high.
For information about using behavior aggregate (BA) classifiers to set the PLP level of incoming
packets, see the Junos Class of Service Configuration Guide.
loss-priority-except
level
Do not match on the packet loss priority level. Specify a single level or multiple levels: low, medium-low,
medium-high, or high.
For information about using behavior aggregate (BA) classifiers to set the PLP level of incoming
packets, see the Junos Class of Service Configuration Guide.
port number
TCP or UDP source or destination port. You cannot specify both the port match condition and either
the destination-port or source-port match conditions in the same term.
source-mac-address
address
Source MAC address of a Layer 2 packet.
source-port number
TCP or UDP source port field. You cannot specify the port and source-port match conditions in the
same term.
tcp-flags flags
One or more of the following TCP flags:
• Bit-name: fin, syn, rst, push, ack, urgent
• Numerical value: 0x01 through 0x20
• Text synonym: tcp-established, tcp-initial
You can string together multiple flags using logical operators.
Configuring the tcp-flags match condition requires that you configure the next-header-tcp match
condition.
216
Copyright © 2010, Juniper Networks, Inc.