Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
then {
action;
action-modifiers;
}
}
}
NOTE: You must specify either inet or inet6 as the protocol family in order to
configure a service filter.
Service filters are configured the same way as firewall filters. A subset of match conditions
and actions for firewall filters are supported for service filters.
One of the actions you configure must be service or skip:
• Specifying the service action directs packets for stateful-firewall service.
• Specifying the skip action let packets bypass stateful-firewall service.
The following actions are also supported for service filters:
• count counter-name—Count the packet in the specified counter.
• log—Log the packet header information in a buffer within the Packet Forwarding Engine.
You can access this information by issuing the show firewall log command.
• port-mirror—Send packets to a packet analyzer.
• sample—Sample the packets.
Configuring Simple Filters
For more information about services and service interfaces, see the Junos OS Services
Interfaces Configuration Guide.
Simple filters are recommended for metropolitan Ethernet applications. They are
supported on Gigabit Ethernet intelligent queuing (IQ2) and Enhanced Queuing Dense
Port Concentrator (EQ DPC) interfaces only. Simple filters are not supported on Modular
Port Concentrator (MPC) interfaces, including Enhanced Queuing MPC interfaces. Unlike
standard filters, simple filters are for IPv4 traffic only and have the following restrictions:
• The next-term action is not supported.
• Qualifiers, such as except and protocol-except match conditions, are not supported.
• Noncontiguous masks are not supported.
• Only one source-address and one destination-address prefix are allowed for each filter
term. If you configure, multiple prefixes, only the last one is used.
• Ranges are only valid as source or destination ports. For example, you can configure
source-port 400-500 or destination-port 600-700.
• Output filters are not supported. You can apply a simple filter to ingress traffic only.
Copyright © 2010, Juniper Networks, Inc.
253