Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
NOTE: Configuration of interface-specific counters also creates separate
instances of any policers and counters you have configured for the same
interface.
To configure interface-specific counters, include the interface-specific statement at the
[edit firewall family family-name filter filter-name] hierarchy level:
[edit firewall family filter filter-name]
interface-specific;
NOTE: The suffixes -i (input) and -o (output) are added to the counter names
automatically. The counter name is restricted to 24 bytes, and if the renamed
counter exceeds this maximum length, the policy framework software might
reject it.
Example: Configuring Interface-Specific Counters
Configure an interface-specific counter:
Defining Interface Groups
[edit firewall]
family inet {
filter test {
interface-specific;
term 1 {
from {
address {
10.0.0.0/12;
}
protocol tcp;
}
then {
count sample1;
accept;
}
}
}
}
When you apply this filter to the input interface of at-1/1/1.0 and the output interface of
so-2/2/2.2, the counters are named sample1-at-1/1/1.0-i and sample1-so-2/2/2/.2-o. The
suffixes -i (input) and -o (output) are added to the counter names automatically.
The Junos OS does not sample packets originating from the router. If you configure a
filter and apply it to the output side of an interface, then only the transit packets going
through that interface are sampled. Packets that are sent from the Routing Engine to
the Packet Forwarding Engine are not sampled.
When applying a firewall filter, you can define an interface to be part of an interface group.
Packets received on that interface are tagged as being part of the group. You then can
Copyright © 2010, Juniper Networks, Inc.
237