Discussion

Table 9-5. Header match conditions used in firewall filters (continued)
Match term
tcp-flags number
first-fragment
is-fragment
tcp-established
tcp-initial
Packet field operators
& or +
Logical AND
| or , Logical OR
! Negation
( ) Grouping
Match description
TCP flag field, specified as a number or name. Use with the protocol match condition
to determine the protocol being used on a port.
Flag names and numbers: ack (0x10), fin (0x01), push (0x08), rst (0x04), syn (0x02),
urgent (0x20)
First fragment of a fragmented packet.
Packet fragment other than the first one.
TCP packets other than the first one in a connection (equivalent to "(ack | rst)").
Use with protocol tcp to match TCP packets.
First packet of a TCP connection (equivalent to "(syn & !ack)"). Use with protocol
tcp to match TCP packets.
The fourth command in the recipe is the then clause, which specifies the action to
take when a route matches the condition (or conditions) in the from clause, which is
to accept the packet (then accept). Table 9-6 lists the actions you can use in a firewall
filter.
Table 9-6. Actions to take on matching packets
Action term
accept
reject
discard
next term
counter name
log
policer name
syslog
Description
Accept the packet and send it to its destination. This is the default action.
Do not accept the packet and send an ICMP unreachable message. Rejected packets can be logged.
Discard a packet silently, without sending an ICMP unreachable message. Discarded packets can be
counted but not logged.
Evaluate the next term in the filter.
Count the packet, keeping track of the count in the named counter.
Log the packet’s header.
Rate-limit traffic on an interface.
Keep a record of the packet in a system logfile.
As with routing policy, the JUNOS software evaluates a firewall filter term by term,
and, when a term matches, the action is taken and evaluation ends. If the packet
matches none of the terms, the default action is to discard the packet, which is equivalent
to the following:
aviva@RouterF# set term last-term then discard
The default firewall action, to discard packets, is the opposite of the default policy
action of accepting routes. You would not be alone in thinking that this behavior is
306 | Chapter 9: Routing Policy and Firewall Filters
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.