Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Apr 7 15:48:55 192.168.9.194 192.168.9.195 0 0 1 0x0 84 8 0x0 0x0
Apr 7 15:48:56 192.168.9.194 192.168.9.195 0 0 1 0x0 84 8 0x0 0x0
NOTE: When you enable reverse path forwarding (RPF) on an interface with
an input filter for firewall log and count, the input firewall filter does not log
the packets rejected by RPF, although the rejected packets are counted. To
log the rejected packets, use an RPF check fail filter.
For more information about sampling output, see “Applying Filters to Forwarding Tables”
on page 363.
Example: Setting the DSCP Bit to Zero
Set the DSCP bit to 0 (zero) using a firewall filter:
firewall {
filter filter1 {
term 1 {
from {
dscp 2;
}
then {
dscp 0;
forwarding-class best-effort;
}
}
term 2 {
from {
dscp 3;
}
then {
forwarding-class best-effort;
}
}
}
}
Apply this filter to the logical interface corresponding to the VPN routing and forwarding
(VRF) instance:
interfaces so-0/1/0 {
unit 0 {
family inet {
filter input filter1;
}
}
}
Configuring Nested Firewall Filters
You can configure a filter within the term of another filter to minimize the work needed
to configure terms common to numerous filters. Each firewall filter consists of one or
more terms. You can configure one filter with the common desired terms, and apply them
Copyright © 2010, Juniper Networks, Inc.
233