Errata

I have read the demo chapter provided on the JUNIPER website and I have found an
error.

On the solution part of point 2.9 (Creating a Group Login Account) a noc user is
defined. But on the comments of the Discusion section you can read "This second
command, set user remote full-name, provides a description of the account". It
should say "This second command, set user noc full-name, provides a description of
the account"

In the commands example, all of the "edit policy-options" term should be "edit firewall".

From JUNOS 8.0R, apply multiple firewall filters on an input/output interface is allowed.

In the statement "Here, the action is to accept the packet (set then accept).", the word packet should be changed to route to match the recipe example. The example is a policy-statement and would be applied on routes only.

In the statement "..., if the packet matches all the .....", the word "packet" should be "route" to match the recipe example.

Although there are lots of restrictions, we can apply more than only one filter on single interface since JUNOS 8.0R.

After comparing the discussion on page.313, all the "ICMP/icmp" word here should be "OSPF/ospf".

BTW, this recipe is an example for an eBGP border router, add a term to permit ospf packets is unnecessary.

For the statement "You can log accepted and rejected packets but not discarded ones.", as same with in page.306 Table 9-6.

Here is a piece of filter on our border router:
(The address was changed to private address)

filter peer_in {
interface-specific;
term ddos_filter {
from {
destination-address {
/* ddos filtering for customer */
192.168.157.186/32;
}
}
then {
log;
discard;
}
}
}

I use this term to discard packets flow to my customer, and actually I could use "show firewall log" to view the discard packets log.

In JUNOS configuration guide, is says "Discarded packets cannot be logged or sampled." before JUNOS 7.5. Since JUNOS7.6, the statement was removed.
We use JUNOS version 7.4R2.6 on our border router.
It confused me.

A command statement "set from destination-port 3221" is necessary to exactly match xnm traffic.

In the statement "when sending routes to local PE router", the word "local" should be "remote" to match the meaning followed the statement.

I do not know what JUNOS version that the author used, but the command "routing-options" here is unnecessary.