ABC-training_mod_06-fw.pptVIP

3/01/01 JUNOS Bootcamp Module 6 Firewall Filters JUNOS Bootcamp Module 6 Firewall Filters What Are Firewall Filters? Firewall filters allow you to: Match packets in a stateless fashion (from statement) Take actions on the selected packets (then statement) Always compiled Implemented in the PFE Filter Terms Contain if…then statements A from statement describes the match conditions A then statement describes the actions that should be taken if the from statement is matched Example: How Filters Are Evaluated Single-term filters If the packet matches all the conditions, the action in the then statement is taken If the packet does not match all the conditions, it is discarded Multiple-term filters (terms evaluated sequentially) JUNOS software sequentially evaluates the packet against the conditions in each terms from statement, beginning with the first term: If the packet matches, the action in the then statement is taken If a packet passes through all the terms in the filter without matching any of them, it is discarded Filter Terms A filter can reference another filter Filter lists (chains) are concatenated into a single filter What Traffic Matches a Filter? Match packets in a stateless fashion Each packet is processed independently of previous or subsequent packets in a given flow Can match based on most header fields Different categories of match conditions: Numeric-range Address Bit field Numeric Range Filter Match Condition Match packet fields that can be identified by a numeric value Port and protocol numbers Specify a keyword that identifies the condition and a value that a field in a packet must match source-port 1024-65535; source-port ssh; source-port [ telnet smtp ]; Keywords identifying available fields: destination-port, dscp, esp-spi, forwarding-class, fragment-offset, icmp-code, icmp-type,interface-group, ip-options, packet-length, port, precedence, protocol, source-port, *-except Address Filter Match Condition IP source and destination addresses Lo