Discussion

var/etc/filters/dfwc.out to see the actions taken by the different terms in the filter.
The following is some of the output for the protect-RE filter:
aviva@RouterF> file show /var/etc/filters/dfwc.out
**************************************************************
* filter "protect-RE" protocol ip: 8 rules, 24 matches
* Stage: after match reduction and useless match elimination
* Optimizations: max-reduction,skip,flatness,level-compress,
* max-level-compress,branch,action-elimination
**************************************************************
rule "ospf-neighbors" matches 3
match protocol unreferenced type range
ranges 1
89
match source-address unreferenced type addrmask
number of address-masks: 2
10.0.8/24
10.0.13/24
match action unreferenced type action
accept
rule "dns-servers" matches 4
match protocol unreferenced type range
ranges 1
17
match port unreferenced type range
ranges 1
53
match source-address unreferenced type addrmask
number of address-masks: 1
10/8
match action unreferenced type action
accept
The header shows the name of the filter and the number of rules (terms) it has, along
with the number of packets that have matched:
* filter "protect-RE" protocol ip: 8 rules, 24 matches
Again, because the firewall filter is fairly complicated, here is the complete configuration
so you can see the structure:
[edit firewall]
aviva@RouterF# show
filter protect-RE {
term bgp-peers {
from {
source-address {
10.0.8.0/24;
10.0.13.0/24;
}
destination-port bgp;
}
then accept;
}
term ospf-neighbors {
324 | Chapter 9: Routing Policy and Firewall Filters
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.