Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
then {
log;
discard;
}
}
}
filter filter1 {
term term1 {
filter common-filter;
}
}
filter filter2 {
term term1 {
filter common-filter;
}
}
}
Applying Firewall Filters to Interfaces
For a firewall filter to work, you must apply it to at least one interface. To do this, include
the filter statement when configuring the logical interface at the [edit interfaces
interface-name unit logical-unit-number family family-name] hierarchy level:
[edit interfaces interface-name unit logical-unit-number family family-name]
filter {
input filter-name;
input-list [ filter-names ];
output filter-name;
output-list [ filter-names ];
}
In the input statement, list the name of one firewall filter to be evaluated when packets
are received on the interface. Input filters applied to the loopback interface, lo0, affect
only inbound traffic destined for the Routing Engine.
In the output statement, list the name of one firewall filter to be evaluated when packets
are transmitted on the interface. Output filters applied to the loopback interface, lo0,
affect only outbound traffic sent from the Routing Engine.
NOTE: When you create an additional loopback interface, it is important to
apply a filter to it so the Routing Engine is protected. We recommend that
when you apply a filter to the loopback interface lo0, you include the
apply-groups statement. Doing so ensures that the filter is automatically
inherited on every loopback interface, including lo0 and other loopback
interfaces. For more information, see the Junos OS CLI User Guide.
Copyright © 2010, Juniper Networks, Inc.
235