Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Overview of Class-Based Match Conditions
Class-based filter conditions match packet fields based on source class or destination
class. A source class is a set of source prefixes grouped together and given a class name.
A destination class is a set of destination prefixes grouped together and given a class
name.
Use the source-class class-name statement to match on one or more source classes.
Use the destination-class class-name statement to match on one or more destination
classes.
NOTE: Both match conditions are supported for IPv4 and IPv6 traffic.
You can specify the destination class in the following ways:
• Destination-class usage (DCU) enables you can track how much traffic is sent to a
specific prefix in the core of the network originating from one of the specified interfaces
However, DCU limits your ability to keep track of traffic moving in the reverse direction.
It can account for all traffic that arrives on a core interface and heads toward a specific
customer, but it cannot count traffic that arrives on a core interface from a specific
prefix.
• Source-class usage (SCU) enables you to monitor the amount of traffic originating
from a specific prefix. With this feature, usage can be tracked and customers can be
billed for the traffic they receive
You can specify a source class or destination class for an output firewall filter. Although
you can specify a source class and destination class for an input firewall filter, the counters
are incremented only if the firewall filter is applied on the output interface.
The class-based filter match condition works only for output filters, because the SCU
and DCU are determined after route lookup.
NOTE: SCU and DCU are not supported on the interfaces you configure as
the output interface for tunnel traffic for transit packets exiting the router
through the tunnel.
For more information about SCU and DCU, see the Source Class Usage Feature Guide.
Copyright © 2010, Juniper Networks, Inc.
219