Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
then {
accept;
}
}
}
To apply this filter to an interface, include the rpf-check fail-filter statement at the [edit
interface interface-name unit logical-unit-number family family-name] hierarchy level:
[edit interface interface-name unit logical-unit-number family inet]
rpf-check fail-filter rpf-dhcp;
Example: Defining a Policer for a Destination Class
Define a policer for destination class class1:
[edit]
firewall {
family inet {
filter filter1 {
policer police-class1 {
if-exceeding {
bandwidth-limit 25;
burst-size-limit 1000;
}
then {
discard;
}
}
term term1 {
from {
destination-class class1;
}
then {
policer police-class1;
}
}
}
}
}
Example: Counting IP Option Packets
Count individual IP option packets, but do not block any traffic. Also, log packets that
have loose or strict source routing:
[edit]
firewall {
family inet {
filter ip-option-filter {
term match-strictsource {
from {
ip-options strict-source-route;
}
then {
246
Copyright © 2010, Juniper Networks, Inc.