Dell PowerConnect J-8216 Software Guide for JUNOS version 10.3 - Page 2820

Dell PowerConnect J-Series Ethernet Switch Complete Software Guide for Junos OS Understanding Firewall Filter Match Conditions Before you define terms for firewall filters, you must understand how the conditions that you specify in a term are handled and how to specify interface filter, numeric filter, address filter, and bit-field filter match conditions to achieve the desired filtering results. • Filter Match Conditions on page 2748 • Numeric Filter Match Conditions on page 2748 • Interface Filter Match Conditions on page 2749 • IP Address Filter Match Conditions on page 2749 • MAC Address Filter Match Conditions on page 2750 • Bit-Field Filter Match Conditions on page 2750 Filter Match Conditions In the from statement of a firewall filter term, you specify the conditions that the packet must match for the action in the then statement to be taken. All conditions in the from statement must match for the action to be taken. The order in which you specify match conditions is not important, because a packet must match all the conditions in a term for a match to occur. If you specify no match conditions in a term, that term matches all packets. An individual condition in a from statement cannot contain a list of values. For example, you cannot specify numeric ranges or multiple source or destination addresses. Individual conditions in a from statement cannot be negated. A negated condition is an explicit mismatch. Numeric Filter Match Conditions Numeric filter conditions match packet fields that are identified by a numeric value, such as port and protocol numbers. For numeric filter match conditions, you specify a keyword that identifies the condition and a single value that a field in a packet must match. You can specify the numeric value in one of the following ways: • Single number-A match occurs if the value of the field matches the number. For example: source-port 25; • Text synonym for a single number- A match occurs if the value of the field matches the number that corresponds to the synonym. For example: source-port http; To specify more than one value in a filter term, you enter each value in its own match statement. For example, a match occurs in the following term if the value of vlan field is 10 or 30. [edit firewall family family-name filter filter-name term term-name from] 2748