Discussion

then accept;
}
term allow-ntp {
from {
source-address {
10.10.0.1/32;
10.10.5.1/32;
}
port ntp;
}
then accept;
}
term allow-icmp {
from {
protocol icmp;
icmp-type [ echo-request echo-reply unreachable time-exceeded sourcequench
];
}
then accept;
}
term allow-snmp-from-nms {
from {
source-address {
10.0.0.1/32;
10.0.5.1/32;
}
protocol udp;
destination-port snmp;
}
then accept;
}
term allow-nothing-else {
then {
count reject-counter;
log;
syslog;
reject;
}
}
}
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter input protect-RE;
address 192.168.16.1
}
}
}
326 | Chapter 9: Routing Policy and Firewall Filters
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.