Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
To configure match conditions that include both the source and destination prefixes for
the vpls protocol family, specify the ip-address keyword (instead of source-ip-address or
destination-ip-address). If either source-ip-address or destination-ip-address falls within
the address range, then it is a match. If you configure an except string, it must match both
source-ip-address and destination-ip-address before the exception applies.
You can also configure match conditions that include both source and destination
addresses for the inet or inet6 families. Specify the address keyword (instead of
source-address or destination-address). If either source-address or destination-address
falls within the address range, then it is a match. If you configure an except string, it must
match both source-address and destination-address before the exception applies.
In the following example for the vpls family, the ip-address prefix is configured with an
except string:
family vpls {
filter fvpls {
term 1 {
from {
ip-address {
55.0.0.0/8;
55.0.1.0/255.0.255.0 except;
}
}
then {
count from-55/8;
discard;
}
}
}
}
In this example, if source-ip-address falls within the exception range of
55.0.1.0/255.0.255.0 except, but destination-ip-address matches 55.0.0.0/8, the packet
is considered a match.
To specify the address prefix, use the notation prefix/prefix-length. If you do not specify
prefix-length, it defaults to /32, as shown in this example:
[edit firewall family family-name filter filter-name term term-name from]
user@host# set destination-address 10
[edit firewall family family-name filter filter-name term term-name from]
user@host# show
destination-address {
10.0.0.0/32;
}
You can also specify a netmask value rather than a prefix length, for example:
[edit firewall family inet filter filter-name]
term term-name {
address 10.0.0.10/255.0.0.255;
}
Noncontiguous Address Prefixes
222
Copyright © 2010, Juniper Networks, Inc.