Discussion

number of interfaces. Another option in this case is to associate this filter with the
router’s loopback interface, lo0, which filters traffic going to the Routing Engine:
[edit interfaces]
aviva@router1# set lo0 unit 0 family inet filter input incoming-to-me
Because SSH requests are handled by the Routing Engine, instead of applying the filter
to many or all of the router’s physical interfaces, you can effect the same filtering
by setting it on the loopback interface.
As defined, this filter works only on IPv4 traffic, because you configure it at the [edit
firewall] level. To have it work for IPv6 traffic, you need to configure the filter at
the [edit firewall family inet6] hierarchy:
[edit firewall family inet6]
aviva@router1# set filter incoming-to-me term restrict-telnet-ssh from protocol tcp
...
Then apply the filter to IPv6 traffic when configuring the interface’s IPv6 address
family:
[edit]
aviva@router1# set interfaces fe-0/0/0 unit 0 family inet6 filter input incoming-tome
If your router has filters for both IPv4 and IPv6 traffic, you should define the IPv4
firewall filters at the [edit firewall family inet] hierarchy so it will be clear to someone
reading through the configuration which filters apply to IPv4 and which apply to
IPv6:
[edit firewall family inet]
aviva@router1# set filter ipv4-incoming-to-me term restrict-telnet-ssh from protocol
tcp
[edit firewall family inet6]
aviva@router1# set filter ipv6-incoming-to-me term restrict-telnet-ssh from protocol
tcp
The first three commands in the recipe, which form the from clause, set the filter’s
match conditions, defining which fields in the packet headers to examine. Firewall
filters can match various fields in the headers (see Table 9-5).
Table 9-5. Header match conditions used in firewall filters
Match term
Address matches
address prefix
destination-address
prefix
source-address prefix
destination-prefix-list
prefix-list
Match description
IP address in the source or destination field.
IP address in the destination field.
IP address in the source field.
IP destination address of one of the prefixes in the prefix list.
304 | Chapter 9: Routing Policy and Firewall Filters
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.