Policy Framework Configuration Guide - Juniper Networks

Chapter 9: Firewall Filter Configuration
[edit]
routing-instances instance-name {
instance-type forwarding;
}
To apply a forwarding table filter to a VPN routing and forwarding (VRF) table, include
the filter and input statements at the [edit routing-instance instance-name
forwarding-options family family-name] hierarchy level:
[edit routing-instances instance-name]
instance-type forwarding;
forwarding-options {
family family-name {
filter {
input filter-name;
}
}
}
To apply a forwarding table filter to a forwarding table, include the filter and input
statements at the [edit forwarding-options family family-name] hierarchy level:
[edit forwarding-options family family-name]
filter {
input filter-name;
}
To apply a forwarding table filter to the default forwarding table inet.0, which is not
associated with a specific routing instance, include the filter and input statements at the
[edit forwarding-options family inet] hierarchy level:
[edit forwarding-options family inet]
filter {
input filter-name;
}
For more information about applying forwarding table filters, see “Applying Filters to
Forwarding Tables” on page 363. For information about routing instances, see the Junos
OS Routing Protocols Configuration Guide.
Configuring System Logging of Firewall Filter Operations
System logging can be configured for the firewall filter process. You can set system
logging to record messages of a particular level or all levels. The messages are sent to a
system logging file.
The following is a sample system logging configuration for the firewall filter icmp-syslog.
For more information about configuring system logging, see the Junos OS System Basics
Configuration Guide.
[edit]
system {
syslog {
file filter {
firewall any;
archive no-world-readable;
Copyright © 2010, Juniper Networks, Inc.
273