Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
multiple firewall filters to the incoming traffic on an interface. You use an output list to
apply multiple firewall filters to the outbound traffic on an interface. You can include up
to 16 filters in an input or an output list.
See Table 24 on page 186 for a detailed description of each supported application point,
the types of firewall filters supported by each application point, and any limitations.
Table 24: Firewall Filter Application Points
Application Point
Filter Type
Supported Hierarchy
Comments
Physical interface—Filter
affects packets for all logical
interfaces configured on the
physical interface.
Hierarchical policer you
define at the [edit firewall
hierarchical-policer
hierarchical-policer-name]
hierarchy level.
[edit interfaces interface-name
layer2-policer inputhierarchical-policer]
Supported only on Gigabit
Ethernet intelligent queuing
(IQ2) PICs on the M120,
M320 and T Series routers
and on Enhanced Queuing
Dense Port Concentrators
(EQ DPC) on MX Series
routers.
Logical interface—Filter
affects all protocol families
configured on the logical
interface.
Firewall filter you define for
the protocol family any at the
[edit firewall] hierarchy level.
• [edit interfaces interface-name
unit unit-number filter input
filter-name]
• [edit interfaces interface-name
unit unit-number output
filter-name]
Supported only on M320
and T Series routers, on M7i
and M10i routers with the
enhanced CFEB (CFEB-e)
and on 10-Gigabit Ethernet
Modular Port Concentrator
(MPC), 60-Gigabit
Ethernet MPC, 60-Gigabit
Ethernet Queuing MPC, and
60-Gigabit Ethernet
Enhanced Queuing MPC on
MX Series routers.
Logical interface—Filter
applied affects all protocol
families configured on the
logical interface.
Layer 2 policer you define at:
• [edit firewall policer
policer-name] hierarchy
level for input policers and
output policers
• [edit firewall
three-color-policer
policer-name hierarchy
level for input three color
policers and output three
color policers
• [edit interfaces interface-name
unit unit-number layer2-policer
input-policer policer-name]
• [edit interfaces interface-name
unit unit-number layer2-policer
output-policer policer-name]
• [edit interfaces interface-name
unit unit-number
input-three-color policer-name]
• [edit interfaces interface-name
unit unit-number
output-three-color
policer-name]
MX Series routers do not
support layer 2 policers
applied to a logical
interface. On MX Series
routers, layer 2 policers an
only be applied as
hierarchical policers.
Logical interface—Filter
applied affects all protocol
families configured on the
logical interface.
Hierarchical policer you
define at the [edit firewall
hierarchical-policer
hierarchical-policer-name]
hierarchy level.
[edit interfaces interface-name
unit unit-number layer2-policer
inputhierarchical-policer
policer-name]
Supported only on Gigabit
Ethernet intelligent queuing
(IQ2) PICs on the M120,
M320 and T Series routers.
186
Copyright © 2010, Juniper Networks, Inc.