Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Table 33: Layer 2 Bridging Firewall Filter Match Conditions (MX Series Ethernet Services Routers
Only) (continued)
Match Condition
traffic-type type
Description
Traffic type. Specify broadcast, multicast, unknown-unicast, or known-unicast.
traffic-type-except type
Do not match on the traffic type.
user-vlan-1p-priority
value
(Supported with bridging, VPLS, and Layer 2 CCC traffic only) IEEE 802.1p user priority field. Specify
a single value or multiple values from 0 through 7.
user-vlan-1p-priority-except
value
(Supported with bridging, VPLS, and Layer 2 CCC traffic only) Do not match on the IEEE 802.1p user
priority field. Specify a single value or multiple values from 0 through 7.
user-vlan-id number
First VLAN identifier that is part of the payload.
user-vlan-id-except
number
Do not match on the first VLAN identifier that is part of the payload.
vlan-ether-type value
VLAN Ethernet type field of a Layer 2 bridging or VPLS packet.
vlan-ether-type-except
value
Do not match on the VLAN Ethernet type field of a Layer 2 bridging or VPLS packet.
Related
Documentation
• How to Specify Firewall Filter Match Conditions on page 220
• Overview of Protocol Match Conditions on page 217
Overview of Protocol Match Conditions
In a standard firewall filter, if you specify a port match condition or a match of the ICMP
type, ICMP code, or TCP flags field or the TCP establish or TCP initial match conditions,
there is no implied protocol match. If you use one of the following match conditions in a
term, you should also explicitly specify the protocol as a match condition in the same
term:
• destination-port—For IPv4, specify the match protocol tcp or protocol udp in the same
term. For IPv6, specify the match next-header tcp or next-header udp in the same term.
• icmp-code—For IPv4, specify the match protocol icmp in the same term. For IPv6,
specify the match next-header icmp or next-header icmp6 in the same term.
• icmp-type—For IPv4, specify the match protocol icmp in the same term. For IPv6, specify
the match next-header icmp or next-header icmp6 in the same term
• port—For IPv4, specify the match protocol tcp or protocol udp in the same term. For
IPv6, specify the match next-header tcp or next-header udp in the same term.
• source-port—For IPv4, specify the match protocol tcp or protocol udp in the same term.
For IPv6, specify the match next-header tcp or next-header udp in the same term.
Copyright © 2010, Juniper Networks, Inc.
217