JUNOS Enterprise Switching

Firewall Filters

In order to protect the switch and the network, packet filters can be deployed to allow only certain traffic into the switch’s control plane (routing engine, or RE) or to transmit the switch out of a Packet Forwarding Engine (PFE) interface. These filters have different names on each switch OS, but they operate in the same stateless manner. On a Cisco device these filters are called access lists, and on a Juniper switch they are called firewall filters. These filters look very similar to the policy we discussed in the previous section; however, firewall filters operate on the actual data forwarding plane. Table 8-1 gives a comparison of the two features.

Table 8-1. Firewall filters versus routing policies

Feature	Firewall filter	Routing policy
Operates in…	Forwarding plane	Control plane
Match keyword	from	from
Action keyword	then	then
Match attributes	Packet fields	Route attributes
Default action	Discard	Depends on default policy
Applied to…	Interfaces	Routing protocols/tables
Named terms required	Yes	No
Chains allowed	Yes	Yes
Absence of from	Match all	Match all

Firewall filter syntax takes a human-friendly, intuitive form:

firewall {
    family inet {
        filter filter-1 {
            term term-1 {
                from {
                    protocol tcp;
                    destination-port telnet;
                }
                then {
                    accept;
                }
            }
        }
    }
}

This filter matches on Telnet traffic and accepts the packets. As you can see, the syntax is very similar to a routing policy with the match conditions in the from term and the actions specified in a then term.

In the EX Series switches, firewall filters ...