Errata

The description of the "is-fragment" is wrong regarding the EX series.
For most of Juniper devices the from option of the firewall give you two possibilities to match regarding the packet fragmentation:

# set firewall family inet filter test term 1 from ?
<...>
first-fragment Match if packet is the first fragment
is-fragment Match if packet is a fragment
<...>

For this devices your explanation of the "is-fragment" is correct.
but this is not the case regarding the EX

On EX there is no option "first-fragment" and "is-fragment" matches the first and all next fragments.

Here I tested on EX4200 running 11.1R6.4

{master:0}[edit]
lab@ex4200# set firewall family inet filter test term 1 from ?
Possible completions:
+ apply-groups Groups from which to inherit configuration data
+ apply-groups-except Don't inherit configuration data from these groups
> destination-address Match IP destination address
+ destination-port Match TCP/UDP destination port
> destination-prefix-list Match IP destination prefixes in named list
+ dscp Match Differentiated Services (DiffServ) code point
fragment-flags Match fragment flags (in symbolic or hex formats) - (Ingress only)
+ icmp-code Match ICMP message code
+ icmp-type Match ICMP message type
> interface Match interface name
+ ip-options Match IP options
is-fragment Match if packet is a fragment
+ precedence Match IP precedence value
+ protocol Match IP protocol type
> source-address Match IP source address
+ source-port Match TCP/UDP source port
> source-prefix-list Match IP source prefixes in named list
tcp-established Match packet of an established TCP connection
tcp-flags Match TCP flags (in symbolic or hex formats)
tcp-initial Match initial packet of a TCP connection
+ ttl Match IP ttl type
{master:0}[edit]

The filter terms for ssh and snmp can not be correct.

You will almost never see ssh traffic both come from and to the ssh port. The source-port ssh should be removed.

For term snmp it should be destination-port [ snmp snmptrap ], not source-port.

The configuration for applying the voice VLAN to an interface is shown in the book as:

lab@Ethanol> show configuration interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
vlan {
members voice;
}
}

When configuring a voice vlan, you do as the book previously explains, by a voice vlan to an interface under [ edit ethernet-switching-options voip interface ], but the member vlan configured via [ edit interface family ethernet-switching vlan ] should be the DATA vlan, otherwise tagged and untagged frames would not be isolated.... voiding the point of this entire section of the book.

Configuration should read something like:

lab@Ethanol> show configuration interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
vlan {
members DATA;
}
}

Descriptions to the config should be modified accordingly. This discrepency is confirmed in the application note "Deploying IP Telephony with EX Series Switches" published by Juniper Networks: http://forums.juniper.net/jnet/attachments/jnet/switch/8009/1/deploying%20IP%20Telephony%20with%20EX-en.pdf


Configuration in book also does not show the interface being placed int "port-mode access" which should be added for clarity.

The