Policy Framework Configuration Guide - Juniper Networks

Chapter 15: Traffic Forwarding and Monitoring Configuration
}
}
Applying Filters to Forwarding Tables
A forwarding table filter allows you to filter data packets based on their components and
perform an action on packets that match the filter. You can apply a filter on the ingress
or egress packets of a forwarding table. You configure the filter at the [edit firewall family
family-name] hierarchy level; for more information, see “Configuring Forwarding Table
Filters” on page 271.
To apply a forwarding table filter on ingress packets of a forwarding table, include the
filter and input statements at the [edit forwarding-options family family-name] hierarchy
level:
[edit forwarding-options family family-name]
filter {
input filter-name;
}
On the MX Series router only, to apply a forwarding table filter for a virtual switch, include
the filter and input statements at the [edit routing-instances routing-instance-name
bridge-domains bridge-domain-name forwarding-options] hierarchy level:
[edit routing-instances routing-instance-name bridge-domains bridge-domain-name
forwarding-options]
filter {
input filter-name;
}
For more information about how to configure a virtual switch, see the Junos Layer 2
Configuration Guide.
You can filter based upon destination-class information by applying a firewall filter on
the egress packets of the forwarding table. By applying firewall filters to packets that
have been forwarded by a routing table, you can match based on certain parameters
that are decided by the route lookup. For example, routes can be classified into specific
destination and source classes. Firewall filters used for policing and mirroring are able
to match based upon these classes.
To apply a firewall filter on egress packets of a forwarding table, include the filter and
output statements at the [edit forwarding-options family family-name] hierarchy level:
[edit forwarding-options family family-name]
filter {
output filter-name;
}
NOTE: The egress forwarding table filter is applied on the ingress interface
of the Flexible PIC Concentrator (FPC). If different packets to the same
destination arrive on different FPCs, they might encounter different policers.
Copyright © 2010, Juniper Networks, Inc.
363