You can specify any of the following action modifiers in a
then
statement:
•
analyzer analyzer-name
—Mirror port traffic to a specified destination port or VLAN
that is connected to a protocol analyzer application. An
analyzer
must be
configured under the
ethernet-switching
family address type. See “Configuring
Port Mirroring to Analyze Traffic (CLI Procedure)” on page 3555.
•
count counter-name
—Count the number of packets that pass this filter term.
NOTE:
We recommend that you configure a counter for each term in
a firewall filter, so that you can monitor the number of packets that
match the conditions specified in each filter term.
•
forwarding-class class
—Classify packets in a forwarding class.
•
loss-priority priority
—Set the priority of dropping a packet.
•
policer policer-name
—Apply rate-limiting to the traffic.
If you omit the
then
statement or do not specify an action, packets that match all the
conditions in the
from
statement are accepted. However, you must always explicitly
configure an action and/or action modifier in the
then
statement. You can include no
more than one action statement, but you can use any combination of action modifiers.
For an action or action modifier to take effect, all conditions in the
from
statement
must match.
NOTE:
Implicit discard is also applicable to a firewall filter applied to the
loopback interface, lo0.
Applying a Firewall Filter to a Port on a Switch
To apply a firewall filter to an ingress port on a switch:
1.
Specify the interface name and provide a meaningful description of the firewall filter
and the interface to which the filter is applied:
[edit
interfaces
]
user@switch#
set ge-0/0/1 description "filter to limit tcp traffic filter at trunk port
for employee-vlan and voice-vlan applied on the interface"
NOTE:
Providing the description is optional.
2.
Specify the unit number and family address type for the interface:
[edit interfaces]
user@switch#
set ge-0/0/1 unit 0
family
ethernet-switching
Copyright © 2010, Juniper Networks, Inc.
3066
Complete Software Guide for Junos
®
OS for EX Series Ethernet Switches, Release 10.3
Summary of Contents for JUNOS OS 10.3 - SOFTWARE
Page 325: ...CHAPTER 17 Operational Mode Commands for System Setup 229 Copyright 2010 Juniper Networks Inc ...
Page 1323: ...CHAPTER 56 Operational Mode Commands for Interfaces 1227 Copyright 2010 Juniper Networks Inc ...
Page 2841: ...CHAPTER 86 Operational Commands for 802 1X 2745 Copyright 2010 Juniper Networks Inc ...
Page 3367: ...CHAPTER 113 Operational Mode Commands for CoS 3271 Copyright 2010 Juniper Networks Inc ...
Page 3435: ...CHAPTER 120 Operational Mode Commands for PoE 3339 Copyright 2010 Juniper Networks Inc ...
Page 3529: ...CHAPTER 126 Operational Mode Commands for MPLS 3433 Copyright 2010 Juniper Networks Inc ...
