Discussion

+ protocol Match IP protocol type
+ protocol-except Do not match IP protocol type
> source-address Match IP source address
+ source-class Match source class
+ source-class-except Do not match source class
+ source-port Match TCP/UDP source port
+ source-port-except Do not match TCP/UDP source port
> source-prefix-list Match IP source prefixes in named list
tcp-established Match packet of an established TCP connection
tcp-flags
Match TCP flags
tcp-initial
Match initial packet of a TCP connection
You use the separate keyword with all match conditions that do not have an -except
version.
9.10 Reordering Firewall Terms
Problem
You want to change the order of terms in a firewall filter.
Solution
Use the CLI insert command to rearrange the terms in a firewall filter:
[edit firewall filter incoming-to-me]
aviva@RouterF# insert term restrict-bgp before term restrict-telnet-ssh
Discussion
One difference between routing policies and firewall filters is that while you can
apply several routing policies to a routing protocol, chaining them together as necessary,
you can apply only one incoming and one outgoing firewall filter to an interface.
This means that firewall filters generally contain a large number of terms.
As with routing policies, the order of the terms in a firewall filter is significant. Packets
are tested against each term in the order. For performance and packet-handling
efficiency, design each filter so the most important or time-critical packets are processed
first. When you add a term to an existing filter, it appears at the end:
[edit firewall filter incoming-to-me]
aviva@router1# set term restrict-bgp from protocol tcp
aviva@router1# set term restrict-bgp from port bgp
aviva@router1# set term restrict-bgp from source-address 10.0.31.0/24
aviva@router1# set term restrict-bgp then accept
aviva@router1# show
term restrict-telnet-ssh {
from {
source-address {
10.0.0.0/8;
}
310 | Chapter 9: Routing Policy and Firewall Filters
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.