Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
}
then discard;
}
filter filter1 {
term one {
from {
source-address 12.1.0.0/16;
}
then {
reject host-unknown;
}
}
term two {
from {
source-address 12.2.0.0/16;
}
then policer pol1;
}
}
}
}
}
Scenario 2: Nonfirewall Objects Reference Firewall Objects
When an object is configured within a logical system (but is not included in the firewall
configuration for the logical system) and that object references a firewall object, the
following logic is used to resolve the configuration:
• If firewall configuration statements are defined within the same logical system, the
[edit logical-systems logical-system-name firewall] hierarchy is searched to resolve the
configuration. The main [edit firewall] hierarchy is not searched.
• If no firewall configuration statements are defined within the same logical system, the
firewall configuration defined at the [edit firewall] hierarchy level is searched to resolve
the configuration. This search option is provided for legacy purposes. The main [edit
firewall] hierarchy is searched only if firewall configuration statements are not defined
within the same logical system.
• Firewall configurations that belong to other logical systems are not searched.
In the following example, the filter fred is applied to an interface in the logical system ls1.
However, fred is defined in the main firewall configuration instead of in the ls1 firewall
configuration. Therefore, in this first example, the configuration is not valid.
[edit]
logical-systems {
ls1 {
interfaces {
fe-0/3/2 {
unit 0 {
family inet {
filter {
input-list [ filter1 fred ];
}
Copyright © 2010, Juniper Networks, Inc.
257