To negate a match, precede the value with an exclamation point. For example, a match
occurs only if the RST bit in the TCP flags field is not set:
[edit firewall family
family-name
filter
filter-name
term
term-name
from]user@host#
set tcp-flags "!rst"
In the following example of a logical AND operation, a match occurs if the packet is the
initial packet on a TCP session:
[edit firewall family
family-name
filter
filter-name
term
term-name
from]user@host#
set tcp-flags "syn&!ack"
In the following example of a logical OR operation, a match occurs if the packet is not
the initial packet on a TCP session:
[edit firewall family
family-name
filter
filter-name
term
term-name
from]user@host#
set tcp-flags "syn|ack"
For a logical OR operation, you can specify a maximum of two match conditions in a
single term. If you need to match more than two bit-field values in a logical OR operation,
configure the same match condition in consecutive terms with additional bit-field values.
In the following example, the two terms configured match the SYN, ACK, FIN, or RST bit
in the TCP flags field:
[edit firewall family
family-name
filter
filter-name
term
term-name1
from]user@host#
set tcp-flags "syn|ack"
[edit firewall family
family-name
filter
filter-name
term
term-name2
from]user@host#
set tcp-flags "fin|rst"
You can use text synonyms to specify some common bit-field matches. You specify
these matches as a single keyword. In the following example of a text synonym, a match
occurs if the packet is the initial packet on a TCP session:
[edit firewall family
family-name
filter
filter-name
term
term-name
from]user@host#
set tcp-flags tcp-initial
Related
Documentation
Firewall Filters for EX Series Switches Overview on page 3001
•
•
Understanding How Firewall Filters Test a Packet's Protocol on page 3036
•
Example: Configuring Firewall Filters for Port, VLAN, and Router Traffic on EX Series
Switches on page 3039
•
Example: Using Filter-Based Forwarding to Route Application Traffic to a Security
Device on EX Series Switches on page 3058
•
Firewall Filter Match Conditions and Actions for EX Series Switches on page 3009
3035
Copyright © 2010, Juniper Networks, Inc.
Chapter 100: Firewall Filters—Overview
Summary of Contents for JUNOS OS 10.3 - SOFTWARE
Page 325: ...CHAPTER 17 Operational Mode Commands for System Setup 229 Copyright 2010 Juniper Networks Inc ...
Page 1323: ...CHAPTER 56 Operational Mode Commands for Interfaces 1227 Copyright 2010 Juniper Networks Inc ...
Page 2841: ...CHAPTER 86 Operational Commands for 802 1X 2745 Copyright 2010 Juniper Networks Inc ...
Page 3367: ...CHAPTER 113 Operational Mode Commands for CoS 3271 Copyright 2010 Juniper Networks Inc ...
Page 3435: ...CHAPTER 120 Operational Mode Commands for PoE 3339 Copyright 2010 Juniper Networks Inc ...
Page 3529: ...CHAPTER 126 Operational Mode Commands for MPLS 3433 Copyright 2010 Juniper Networks Inc ...
