Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
then {
count ce1;
log;
routing-instance ce1;
}
}
term 1 {
from {
source-address {
::10.34.2.0/120;
}
}
then {
count ce2;
log;
routing-instance ce2;
}
}
term default {
then {
count default;
accept;
}
}
}
}
}
Configuring Forwarding Table Filters
The following sections describe the following topics:
• Overview of Forwarding Table Filters on page 271
• Configuring a Forwarding Table Filter on page 272
Overview of Forwarding Table Filters
Forwarding table filters are defined the same as other firewall filters, but you apply them
differently:
• Instead of applying forwarding table filters to interfaces, you apply them to forwarding
tables, each of which is associated with a routing instance and a virtual private network
(VPN).
• Instead of applying input and output filters by default, you can apply an input forwarding
table filter only.
All packets are subjected to the input forwarding table filter that applies to the forwarding
table. A forwarding table filter controls which packets the router accepts and then
performs a lookup for the forwarding table, thereby controlling which packets the router
forwards on the interfaces.
When the router receives a packet, it determines the best route to the ultimate destination
by looking in a forwarding table, which is associated with the VPN on which the packet
Copyright © 2010, Juniper Networks, Inc.
271