Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
Table 37: Unsupported Firewall Actions and Action Modifiers for Logical Systems (continued)
Action or Action
Modifier
Example
Description
sample
[edit]
logical-systems {
ls1 {
firewall {
family inet {
filter foo {
term one {
from {
source-address 10.1.0.0/16;
}
then {
sample;
}
}
}
}
}
}
}
In this example, the sample action
depends on the sampling configuration
defined under the [edit
forwarding-options] hierarchy.
Therefore, the sample action is not
supported.
syslog
[edit]
logical-systems {
ls1 {
firewall {
family inet {
filter icmp-syslog {
term icmp-match {
from {
address {
192.168.207.222/32;
}
protocol icmp;
}
then {
count packets;
syslog;
accept;
}
}
term default {
then accept;
}
}
}
}
}
}
In this example, there must be at least
one system log (system syslog file
filename) with the firewall facility
enabled for the icmp-syslog filter's logs
to be stored.
Because this firewall configuration
relies on a configuration outside the
logical system, the syslog action
modifier is not supported.
Copyright © 2010, Juniper Networks, Inc.
267