Discussion

aviva@RouterF# set term utility then accept
aviva@RouterF# set term icmp from protocol icmp
aviva@RouterF# set term icmp from icmp-type [ echo-request echo-reply unreachable
time-exceeded source-quench ]
aviva@RouterF# set term icmp then policer icmp
aviva@RouterF# set term icmp then accept
A final term in the filter counts and discards all remaining traffic:
[edit firewall filter protect-RE2]
aviva@RouterF# set term final-term then count discarded-packets
aviva@RouterF# set term final-term then discard
To have the filter take effect, apply it to the router’s lo0 interface:
[edit interfaces]
aviva@RouterF# set lo0 unit 0 family inet filter input protect-RE2
Discussion
It is considered good practice to apply policers to Routing Engine firewall filter terms
to keep unwanted traffic and possible attacks from overwhelming the routing-protocol
software, which runs on the Routing Engine. You want to police control traffic and
traffic that is not time-dependent and you don’t want to police critical traffic, such as
BGP protocol exchanges. This section provides a second example of a Routing
Engine firewall filter that includes policers. It is based on a JUNOS secure template
publicly available from Team Cymru at http://www.cymru.com.
First, create policers for control and low-priority traffic. The first policer, configured
with the set policer ssh commands, discards all SSH traffic when the bandwidth
exceeds 1 MBor when the traffic burst size is greater than 100 Kbps. The second and
third policers provide similar limits for ICMP and TCP traffic.
The terms of the first three policers are the same, so you might wonder why you
should bother creating separate policers. You could use just one, which is fine if you
know that you will always want to use the same bandwidth and burst-size limits for
these three types of traffic. However, if you think you might need to tweak the policers
individually, this will be easier to do if you create separate policers initially.
When you change the values, you will just need to reconfigure the policer. Otherwise,
you will have to reconfigure both the policer and the firewall term in which the
policer is used.
The last policer in this recipe, configured with the set policer utility commands, is
for background applications, including SNMP, NTP, and RADIUS. This policer drops
traffic when the bandwidth is greater than 3 MB or a traffic burst exceeds 300 Kbps.
You then apply the policers in the then clause of the firewall terms. You need a term
for each type of traffic. The first term, configured with the set term tcp commands,
accepts TCP control traffic only from trusted sources and rate-limits this traffic. The
first two commands match prefix lists defined in the [edit policy] section of the
configuration. As with the routing-policy prefix lists, you use these to keep a single
328 | Chapter 9: Routing Policy and Firewall Filters
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.