Firewall Filters

In order to protect the switch and the network, packet filters can be deployed to allow only certain traffic into the switch’s control plane (routing engine, or RE) or to transmit the switch out of a Packet Forwarding Engine (PFE) interface. These filters have different names on each switch OS, but they operate in the same stateless manner. On a Cisco device these filters are called access lists, and on a Juniper switch they are called firewall filters. These filters look very similar to the policy we discussed in the previous section; however, firewall filters operate on the actual data forwarding plane. Table 8-1 gives a comparison of the two features.

Table 8-1. Firewall filters versus routing policies


Firewall filter

Routing policy

Operates in…

Forwarding plane

Control plane

Match keyword



Action keyword



Match attributes

Packet fields

Route attributes

Default action


Depends on default policy

Applied to…


Routing protocols/tables

Named terms required



Chains allowed



Absence of from

Match all

Match all

Firewall filter syntax takes a human-friendly, intuitive form:

firewall {
    family inet {
        filter filter-1 {
            term term-1 {
                from {
                    protocol tcp;
                    destination-port telnet;
                then {

This filter matches on Telnet traffic and accepts the packets. As you can see, the syntax is very similar to a routing policy with the match conditions in the from term and the actions specified in a then term.

In the EX Series switches, firewall ...

Get JUNOS Enterprise Switching now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.