Dell PowerConnect J-8216 Software Guide for JUNOS version 10.3 - Page 2821

Chapter 100: Firewall Filters-Overview vlan 10; vlan 30; The following restrictions apply to numeric filter match conditions: • You cannot specify a range of values. • You cannot specify a list of comma-separated values. • You cannot exclude a specific value in a numeric filter match condition. For example, you cannot specify a condition that would match only if the match condition was not equal to a given value. Interface Filter Match Conditions Interface filter match conditions can match interface name values in a packet. For interface filter match conditions, you specify the name of the interface, for example: [edit firewall family family-name filter filter-name term term-name from] user@host# set interface ge-0/0/1 Port and VLAN interfaces do not use logical unit numbers. However, a firewall filter that is applied to a router interface can specify the logical unit number in the interface filter match condition, for example: [edit firewall family family-name filter filter-name term term-name from] user@host# set interface ge-0/1/0.0 You can include the * wildcard as part of the interface name, for example: [edit firewall family family-name filter filter-name term term-name from] user@host# set interface ge-0/*/1 user@host# set interface ge-0/1/* user@host# set interface ge-* IP Address Filter Match Conditions Address filter match conditions can match prefix values in a packet, such as IP source and destination prefixes. For address filter match conditions, you specify a keyword that identifies the field and one prefix of that type that a packet must match. You specify the address as a single prefix. A match occurs if the value of the field matches the prefix. For example: [edit firewall family family-name filter filter-name term term-name from] user@host# set destination-address 10.2.1.0/28; Each prefix contains an implicit 0/0 except statement, which means that any prefix that does not match the prefix that is specified is explicitly considered not to match. To specify the address prefix, use the notation prefix/prefix-length. If you omit prefix-length, it defaults to /32. For example: [edit firewall family family-name filter filter-name term term-name from] user@host# set destination-address 10 [edit firewall family family-name filter filter-name term term-name from] user@host# show destination-address { 10.0.0.0/32; } 2749