Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
[edit]
firewall {
family inet6 {
filter tcpfilt {
term 1 {
from {
next-header tcp;
tcp-flags syn;
}
then {
count tcp_syn_pkt;
log;
accept;
}
}
}
}
}
Example: Setting a Rate Limit for Incoming Layer 2 Control Packets
Configure rate limiting for incoming Layer 2 control packets. In order to meet this
requirement, you must configure an input filter with the family type any and apply this
filter to the interface:
[edit]
firewall {
policer p1 {
if-exceeding {
bandwidth-limit 5m;
burst-size-limit 10m;
}
then discard;
}
policer p2 {
if-exceeding {
bandwidth-limit 40m;
burst-size-limit 100m;
}
then discard;
}
policer p3 {
if-exceeding {
bandwidth-limit 600m;
burst-size-limit 1g;
}
then discard;
}
interface-set ifset {
fe-*;
}
family any {
filter L2-filter {
term t1 {
from {
Copyright © 2010, Juniper Networks, Inc.
251