Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
The following conditions match on bit-field values:
• first-fragment
• fragment-flags
• is-fragment
• tcp-established
• tcp-flags
• tcp-initial
NOTE: The Junos OS does not automatically check the first fragment bit
when matching TCP flags. For IPv4 traffic only, to include the first fragment
bit, include the fragment-offset match condition. This condition is not
supported for any other protocol family.
Single Bit-Field Value
To specify the bit-field value to match, enclose the value in quotation marks (“ ”). For
example, a match occurs if the RST bit in the TCP flags field is set:
tcp-flags “rst”;
Generally, you specify the bits being tested using text synonyms. Bit-field match text
values always map to a single bit value. You also can specify bit fields as hexadecimal
or decimal numbers.
To negate a match, precede the value with an exclamation point. For example, a match
occurs only if the RST bit in the TCP flags field is not set:
tcp-flags “!rst”;
Multiple Bit-Field Values
To match multiple bit-field values, use the logical operators list in Table 34 on page 225.
The operators are listed in order, from highest precedence to lowest precedence.
Operations are left-associative.
Table 34: Bit-Field Logical Operators
Logical Operator
Description
(...)
Grouping
!
Negation
& or +
Logical AND
| or ,
Logical OR
Copyright © 2010, Juniper Networks, Inc.
225