Juniper EX Firewall Filters

1008

Firewall Filters (ACL)

Firewall Filter Control Plane Packet
Forwarding Engine (PFE)

Firewall Filter
EX switch firewall filter(ACL) Filters.

(1) Port (Layer 2) firewall filter

Port firewall filters Layer 2 switch . port firewall filters Inbound
.
(2) VLAN firewall filter
Virtual LAN (VLAN) firewall filters Vlan VLAN firewall
filters Vlan Inbound Outbound
(3) Router (Layer 3) firewall filter
Router firewall filter Inbound Outbound Layer 3 Routed VLAN
Interfaces (RVI). router firewall filter Inbound loopback interface
firewall filter Vlan Router ,
(Inbound Outbound).

Juniper EX Firewall Filters

1008

Filter Term
Filter Term Term
Team Filter

Terminating :
(1) accept

(2) discard

(3) reject
ICMP error message (: administratively prohibited)
(4)
log, count, syslog,

Filter
(1) Layer 2 Filter
TCP /UDP /ICMP /IP /Port Layer 2 MAC
Vlan tags
(2) Layer 3 Filter
TCP /UDP /ICMP /IP /Port

Juniper EX Firewall Filters

1008

, 2 VLANs :
VLAN 10
200.2.2/24
VLAN 20
66.66.66/24

Scotch
10.10.1.9

Ge-0/0/0
10.3.9.9/24

Ge-0/0/3
10.3.9.3/24

Vodkila
10.10.1.3

10

11

12

14

13

16

15

18

17

19

20

21

22

200.2.2.1/24
EX4200 24PoE

23

200.2.2.10/24
EX2200 24 PoE
3

10

11

12

13

14

15

16

17

18

19

20

21

22

EX2200 24 PoE
0

23

10

11

12

13

14

15

16

17

18

19

20

21

22

23

SPD

ALM

SYS

ALM

SYS

Bourbon
10.10.1.7

DX
0

SPD
DX

EN

POE

EN
POE

Host 1
Rum
10.10.1.5

200.2.2.4/24

Guest Network
Vlan 20

Host 4

Vodkila SW Internet Default GW, Vlan Internet

.
Filter Internet Vodkila Filter
Case Outbound Internet Inbound Filter
:
(1) TCP Internet.
(2)
(3)
(4)
(5)

TCP fragments.
traceroutes return UDP .
Ping traceroute .
Traceroute .

Juniper EX Firewall Filters

1008
Filter Internet-In
Deny TCP Inbound
Count deny-i-tcp
:
lab@RUM# set firewall family inet filter Internet-In
lab@RUM# show firewall family inet
term deny-inbound-tcp {
from {
destination-address {
200.2.2.0/24;
66.66.66.0/24;
}
protocol tcp;
tcp-initial;
}
then {
count deny-i-tcp;
discard;
}
}
Term Internet Inbound TCP
Term deny Outbound TCP
:
term allow-outbound-tcp {
from {
200.2.2.0/24;
66.66.66.0/24;
}
protocol tcp;
}
then {
count allow-o-tcp;
accept;
}
}

Juniper EX Firewall Filters

1008
TCP fragments :
term allow-tcp-frags {
from {
is-fragment;
protocol tcp;
}
then {
count tcp-frags;
accept;
}
}
Internet UDP () Count
Outbound UDP session
:
term allow-udp {
from {
destination-address {
200.2.2.0/24;
66.66.66.0/24;
}
protocol udp;
}
then {
accept;
count count-udp;
}
ping traceroute Outbound Count input filter
( echo replies time exceeds message) unreachable
Outbound

Juniper EX Firewall Filters

1008
:
term allow-some-icmp-outbound {
from {
destination-address {
200.2.2.0/24;
66.66.66.0/24;
}
protocol icmp;
icmp-type [ echo-reply time-exceeded unreachable ];
}
then {
count icmp;
accept;
}
}
deny Term Filter deny
Count
:
term denied-traffic {
then {
count denied;
discard;
}
}

Juniper EX Firewall Filters

1008
Vodkila filter input Scotch
:
[edit interfaces ge-0/0/8]
lab@Vodkila# show
unit 0 {
family inet {
filter {
input Internet-In;
}
address 10.3.9.8/24;
}
}
lab@Vodkila# commit
match Filter Filter Count
:
lab@Vodkila# run show firewall
Filter: Internet-In
Counters:
Name
allow-o-tcp
count-udp
denied
deny-i-tcp
icmp
tcp-frags

Bytes
1904
576
408
642
812
0

Packets
28
9
4
9
8
0

jnsupport@t-tech.com.tw