Dell PowerConnect J-8216 Software Guide for JUNOS version 10.3 - Page 2822

Dell PowerConnect J-Series Ethernet Switch Complete Software Guide for Junos OS To specify more than one IP address in a filter term, you enter each address in its own match statement. For example, a match occurs in the following term if the value of the source-address field matches either of the following source-address prefixes: [edit firewall family family-name filter filter-name term term-name from] user@host# set source-address 10.0.0.0/8 user@host# set source-address 10.1.0.0/16 MAC Address Filter Match Conditions MAC address filter match conditions can match source and destination MAC address values in a packet. For MAC address filter match conditions, you specify a keyword that identifies the field and one value of that type that a packet must match. You can specify the MAC address as six hexadecimal bytes in the following formats: [edit firewall family family-name filter filter-name term term-name from] user@host# set destination-mac-address 0011.2233.4455 [edit firewall family family-name filter filter-name term term-name from] user@host# set destination-mac-address 00:11:22:33:44:55 [edit firewall family family-name filter filter-name term term-name from] user@host# set destination-mac-address 001122334455 To specify more than one MAC address in a filter term, you enter each MAC address in its own match statement. For example, a match occurs in the following term if the value of the source-mac-address field matches either of the following addresses. [edit firewall family family-name filter filter-name term term-name from] user@host# set source-mac-address 00:11:22:33:44:55 user@host# set source-mac-address 00:11:22:33:20:15 Bit-Field Filter Match Conditions Bit-field filter conditions match packet fields if particular bits in those fields are or are not set. You can match the IP options, TCP flags, and IP fragmentation fields. For bit-field filter match conditions, you specify a keyword that identifies the field and tests to determine that the option is present in the field. To specify the bit-field value to match, enclose the value in double quotation marks. For example, a match occurs if the RST bit in the TCP flags field is set: [edit firewall family family-name filter filter-name term term-name from] user@host# set tcp-flags "rst" Typically, you specify the bits to be tested by using keywords. Bit-field match keywords always map to a single bit value. You also can specify bit fields as hexadecimal or decimal numbers. To match multiple bit-field values, use the logical operators, which are described in Table 339 on page 2750. The operators are listed in order from highest precedence to lowest precedence. Operations are left-associative. Table 339: Actions for Firewall Filters Logical Operators Description ! Negation. 2750