Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
}
then accept;
}
}
filter of2 {
term 0 {
from {
is-fragment;
}
then accept;
}
}
filter of3 {
term 0 {
from {
protocol ospf;
}
then accept;
}
}
}
}
To apply the filters in this example on incoming and outbound traffic, use the input-list
[ filter-names] and output-list [ filter-names] statements. In the following example, a list
of three input filters and a list of three output filters are applied to the ge-1/3/0 interface.
The filters are processed in the order in which they are applied.
[edit]
interfaces {
ge-1/3/0 {
unit 0 {
family inet {
filter {
input-list [ if1 if2 if3 ];
output-list [ of1 of2 of3 ];
}
address 1.1.1.2/30;
}
}
}
}
NOTE: The input-list filter-names and output-list filter-names statements for
firewall filters for the ccc and mpls protocol families are supported on all
interfaces except management and internal Ethernet (fxp) interfaces,
loopback (lo0) interfaces, and USB modem (umd) interfaces.
Nested firewall filters also give you the ability to apply each filter within the filter in a
multiple OR order. When you specify more than one match condition within a single term,
both conditions (for example, source port and source address) must be met for a packet
to match. In a nested firewall filter, a packet can match either the source port as defined
Copyright © 2010, Juniper Networks, Inc.
241