Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
log;
reject host-unknown;
}
}
}
filter filter1 {
term one {
from {
source-address 12.1.0.0/16;
}
then {
reject host-unknown;
}
}
term two {
from {
source-address 12.2.0.0/16;
}
then policer pol1;
}
}
}
}
Scenario 3: Firewall Objects Reference Nonfirewall Objects
In many cases, a firewall configuration references objects outside the firewall
configuration. As a general rule, the referenced object must be defined under the same
logical system as the referencing object. However, there are cases when the configuration
of the referenced object is not supported at the [edit logical-systems logical-system-name]
hierarchy level.
In the following example, the service filter inetsf1 references prefix list prefix1. The service
set fred cannot be defined under the logical system lr1. In this case, the [edit services]
hierarchy is searched for the definition of the fred service set. This configuration is allowed
because the [edit logical-systems logical-system logical-system-name] hierarchy already
had the capability to reference service sets outside the logical system hierarchy.
[edit]
logical-systems {
ls1 {
interfaces {
fe-0/3/2 {
unit 0 {
family inet {
service {
input {
service-set fred service-filter lr1inetsf1;
}
}
}
}
}
}
policy-options {
Copyright © 2010, Juniper Networks, Inc.
261