Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Table 32: VPLS Firewall Filter Match Conditions (continued)
Match Condition
prefix-list name
Description
(MX Series routers only) Destination or source prefixes in the specified list name. Specify the name of
a prefix list defined at the [edit policy-options prefix-list prefix-list-name] hierarchy level.
NOTE: VPLS prefix lists support only IPV4 addresses. IPV6 addresses included in a VPLS prefix list will
be discarded.
source-mac-address
address
Source MAC address of a VPLS packet.
source-port number
(MX Series routers only) TCP or UDP source port field. You cannot specify the port and source-port
match conditions in the same term.
source-port-except
number
(MX Series routers only) Do not match on the TCP or UDP source port field. You cannot specify the port
and source-port match conditions in the same term.
source-prefix-list
name
(MX Series routers only) Source prefixes in the specified prefix list. Specify a prefix list name defined
at the [edit policy-options prefix-list prefix-list-name] hierarchy level.
NOTE: VPLS prefix lists support only IPV4 addresses. IPV6 addresses included in a VPLS prefix list will
be discarded.
tcp-flags flags
(MX Series routers only) One or more of the following TCP flags:
• Bit-name: fin, syn, rst, push, ack, urgent
• Numerical value: 0x01 through 0x20
• Text synonym: tcp-established, tcp-initial
You can string together multiple flags using logical operators.
Configuring the tcp-flags match condition requires that you configure the next-header-tcp match
condition.
traffic-type
type-name
(MX Series routers only) Traffic type. Specify broadcast, multicast, unknown-unicast, or known-unicast.
traffic-type-except
type-name
(MX Series routers only) Do not match on the traffic type. Specify broadcast, multicast, unknown-unicast,
or known-unicast.
user-vlan-1p-priority
number
IEEE 802.1p user priority field. Specify a single value or multiple values from 0 through 7.
user-vlan-1p-priority-except
number
Do not match on the IEEE 802.1p user priority field. Specify a single value or multiple values from 0
through 7.
user-vlan-id number
(MX Series routers only) First VLAN identifier that is part of the payload.
user-vlan-id-except
number
(MX Series routers only) Do not match on the first VLAN identifier that is part of the payload.
vlan-ether-type value
VLAN Ethernet type field of a VPLS packet.
Copyright © 2010, Juniper Networks, Inc.
213