Discussion

Because the policy and filter conditions are referenced, you don’t have to repeat the
same information in many places throughout a configuration but can instead modify
the conditions in a single place and reuse them as needed. This modularity is useful,
especially when you consider that for larger ISPs, the routing policy and firewall filter
sections of the JUNOS configuration file make up a very large percentage of the
router’s configuration, sometimes 50 percent or more.
Defining Policies and Filters
In the JUNOS configuration, routing policies and firewall filters have the same basic
structure:
Name
Identifies each policy and filter. You specify and use this name to reference the
policy or filter when configuring a routing protocol or interface. You set the
name like this:
[edit policy-options]
aviva@router1# edit policy-statement add-community
[edit firewall]
aviva@router1# edit filter incoming-to-me
Here, the edit policy-statement command creates a routing policy named addcommunity,
and the edit filter command creates a filter called incoming-to-me.
Term
Groups match conditions with corresponding actions. Policies and filters can
have one or more terms, which are evaluated in order. Terms are also identified
by name, such as:
[edit policy-options filter incoming-to-me]
aviva@router1# edit term allow-snmp-from-nms-systems
The edit term command creates a term called allow-snmp-from-nms-system.
Match conditions
For policies, the match conditions apply to routes; for firewall filters, they apply
to packets. Match conditions are generally identified by a from clause to indicate
information in the received route or packet. Here, the from clause matches UDP
packets:
[edit policy-options filter incoming-to-me term allow-snmp-from-nms-systems]
aviva@router1# set from protocol udp
Match conditions sometimes have a to clause to match information about the
route or packet destination.
Action
Specifies what to do when a match occurs. The action is identified by a then
clause:
[edit policy-options filter incoming-to-me term allow-snmp-from-nms-systems]
aviva@router1# set then accept
Here, the action is to accept the packet.
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Introduction | 283