Date created: Sunday, May 31, 2020 11:09:33 AM. Last modified: Saturday, June 15, 2024 1:06:35 PM
MX104 Lo0 Filter Example
Example MX104 Lo0 Filter:
# Test commands:
# show policy-options prefix-list pfx-local-loopback | display inheritance
# show firewall filter lo0.0-i
# show bfd sessions
# show bgp summary
# show ospf neighbor
# show ldp neighbor
# show pim neighbors
# show ntp status no-resolve # set date ntp - Force NTP update
###################
# IP Prefix Lists #
###################
# Local loopback0 IPv4 address - This PE only
set policy-options prefix-list pfx-local-loopback apply-path "interfaces lo0 unit 0 family inet address <*>"
# Loopback subnet for all PEs - Used for iBGP
set policy-options prefix-list pfx-pe-loopbacks 192.0.41.0/29
# Any local IPv4 address - Used to police traceroute
set policy-options prefix-list pfx-any-local-ipv4 apply-path "interfaces <*> unit <*> family inet address <*>"
# Core GRT PtP interfaces - Used for OSPF, LDP, PIM etc
set policy-options prefix-list pfx-core-ptp 192.0.41.16/28
# Core OSPF link-local multicast
set policy-options prefix-list pfx-ospf-multicast 224.0.0.5/32
# ^ OSPF All SFP Routers
set policy-options prefix-list pfx-ospf-multicast 224.0.0.6/32
# ^ OSPF All Routers
# LDP link-local multicast
set policy-options prefix-list pfx-ldp-multicast 224.0.0.2/32
# ^ Multicast All Routers
# PIM Multicast
set policy-options prefix-list pfx-pim-multicast 224.0.0.13/32
# ^ All PIM Routers
# IGMP
#set policy-options prefix-list pfx-igmp-multicast 224.0.0.1/32
# ^ Multicast All Systems
# TACACS/ACS servers
set policy-options prefix-list pfx-tacacs-servers apply-path "system tacplus-server <*>"
# NTP Servers
set policy-options prefix-list pfx-ntp-servers apply-path "system ntp server <*>"
set policy-options prefix-list pfx-ntp-servers 128.0.0.0/24
# ^ Junos queries the NTPd on BSD not the remote NTP server directly!
# SNMP Servers
set policy-options prefix-list pfx-snmp-servers apply-path "snmp v3 target-address <*> address <*>"
# SSH JumpBox
set policy-options prefix-list pfx-ssh-jumpbox 192.0.40.19
# PE to CE BFD Sessions
# set policy-options prefix-list pfx-pe-to-ce apply-path "routing-instances <*> interface <*> unit <*> family inet address <*>"
# ^ This expands to nothing - IPs aren't configured under the routing-instance
set policy-options prefix-list pfx-pe-to-ce-vrf 172.31.128.0/17
# PE to CE eBGP sessions - VRFs
set policy-options prefix-list pfx-pe-to-ce-ebgp-vrf apply-path "routing-instances <*> protocols bgp group <*> neighbor <*>"
# PE to CE eBGP sessions - MGMT/GRT
set policy-options prefix-list pfx-pe-to-ce-ebgp-mgmt apply-path "protocols bgp group <CUST-*> neighbor <*>"
# PE to CE eBGP subnets - MGMT/GRT
set policy-options prefix-list pfx-pe-to-ce-ebgp-grt 192.0.40.0/22
# PE to CE PIM sessions
#set policy-options prefix-list pfx-pe-to-ce-pim apply-path "routing-instances PIM_VRF_NAME interfaces <*> unit <*> family inet address <*>"
# Multicast VRF unknown at present!
##########################
# CONTROL PLANE POLICERS #
##########################
# Core 1m Policer - Used for OSPF, BFD, iBGP, LDP, PIM
set firewall policer core-ctrl-1m if-exceeding bandwidth-limit 1m
set firewall policer core-ctrl-1m if-exceeding burst-size-limit 625k
set firewall policer core-ctrl-1m then discard
# Customer 1m Policer - Used for BFD, eBGP, PIM, IGMP
set firewall policer cust-ctrl-1m if-exceeding bandwidth-limit 1m
set firewall policer cust-ctrl-1m if-exceeding burst-size-limit 625k
set firewall policer cust-ctrl-1m then discard
###########################
# CONTROL PLANE PROTOCOLS #
###########################
# Core OSPF Filter
set firewall family inet filter accept-core-ospf term accept-ospf from source-prefix-list pfx-core-ptp
set firewall family inet filter accept-core-ospf term accept-ospf from source-prefix-list pfx-ospf-multicast
set firewall family inet filter accept-core-ospf term accept-ospf from destination-prefix-list pfx-core-ptp
set firewall family inet filter accept-core-ospf term accept-ospf from destination-prefix-list pfx-ospf-multicast
set firewall family inet filter accept-core-ospf term accept-ospf from protocol ospf
set firewall family inet filter accept-core-ospf term accept-ospf then policer core-ctrl-1m
set firewall family inet filter accept-core-ospf term accept-ospf then count accept-core-ospf
set firewall family inet filter accept-core-ospf term accept-ospf then accept
# Core BFD Filter
set firewall family inet filter accept-core-bfd term accept-bfd from source-prefix-list pfx-core-ptp
set firewall family inet filter accept-core-bfd term accept-bfd from destination-prefix-list pfx-core-ptp
set firewall family inet filter accept-core-bfd term accept-bfd from protocol udp
set firewall family inet filter accept-core-bfd term accept-bfd from source-port 49152-65535
set firewall family inet filter accept-core-bfd term accept-bfd from destination-port 3784-3785
set firewall family inet filter accept-core-bfd term accept-bfd then policer core-ctrl-1m
set firewall family inet filter accept-core-bfd term accept-bfd then count accept-core-bfd
set firewall family inet filter accept-core-bfd term accept-bfd then accept
# Core iBGP Filter
set firewall family inet filter accept-core-ibgp term accept-ibgp from source-prefix-list pfx-pe-loopbacks
set firewall family inet filter accept-core-ibgp term accept-ibgp from destination-prefix-list pfx-local-loopback
set firewall family inet filter accept-core-ibgp term accept-ibgp from protocol tcp
set firewall family inet filter accept-core-ibgp term accept-ibgp from port bgp
set firewall family inet filter accept-core-ibgp term accept-ibgp then policer core-ctrl-1m
set firewall family inet filter accept-core-ibgp term accept-ibgp then count accept-core-ibgp
set firewall family inet filter accept-core-ibgp term accept-ibgp then accept
# Core LDP Filter
set firewall family inet filter accept-core-ldp term accept-ldp-discover from source-prefix-list pfx-core-ptp
set firewall family inet filter accept-core-ldp term accept-ldp-discover from destination-prefix-list pfx-ldp-multicast
set firewall family inet filter accept-core-ldp term accept-ldp-discover from protocol udp
set firewall family inet filter accept-core-ldp term accept-ldp-discover from source-port ldp
set firewall family inet filter accept-core-ldp term accept-ldp-discover from destination-port ldp
set firewall family inet filter accept-core-ldp term accept-ldp-discover then policer core-ctrl-1m
set firewall family inet filter accept-core-ldp term accept-ldp-discover then count accept-core-ldp
set firewall family inet filter accept-core-ldp term accept-ldp-discover then accept
# Core Target LDP
set firewall family inet filter accept-core-ldp term accept-tldp from source-prefix-list pfx-pe-loopbacks
set firewall family inet filter accept-core-ldp term accept-tldp from destination-prefix-list pfx-local-loopback
set firewall family inet filter accept-core-ldp term accept-tldp from protocol tcp
set firewall family inet filter accept-core-ldp term accept-tldp from protocol udp
set firewall family inet filter accept-core-ldp term accept-tldp from port ldp
set firewall family inet filter accept-core-ldp term accept-tldp then policer core-ctrl-1m
set firewall family inet filter accept-core-ldp term accept-tldp then count accept-core-tldp
set firewall family inet filter accept-core-ldp term accept-tldp then accept
# Core PIM Filter
set firewall family inet filter accept-core-pim term accept-pim from source-prefix-list pfx-core-ptp
set firewall family inet filter accept-core-pim term accept-pim from destination-prefix-list pfx-pim-multicast
set firewall family inet filter accept-core-pim term accept-pim from protocol pim
set firewall family inet filter accept-core-pim term accept-pim then policer core-ctrl-1m
set firewall family inet filter accept-core-pim term accept-pim then count accept-core-pim
set firewall family inet filter accept-core-pim term accept-pim then accept
# Customer BFD Filter
set firewall family inet filter accept-cust-bfd term accept-bfd from source-prefix-list pfx-pe-to-ce-vrf
set firewall family inet filter accept-cust-bfd term accept-bfd from destination-prefix-list pfx-pe-to-ce-vrf
set firewall family inet filter accept-cust-bfd term accept-bfd from protocol udp
set firewall family inet filter accept-cust-bfd term accept-bfd from source-port 49152-65535
set firewall family inet filter accept-cust-bfd term accept-bfd from destination-port 3784-3785
set firewall family inet filter accept-cust-bfd term accept-bfd then policer cust-ctrl-1m
set firewall family inet filter accept-cust-bfd term accept-bfd then count accept-cust-bfd
set firewall family inet filter accept-cust-bfd term accept-bfd then accept
# Customer eBGP Filter - VRFs
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf from source-prefix-list pfx-pe-to-ce-ebgp-vrf
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf from destination-prefix-list pfx-pe-to-ce-vrf
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf from protocol tcp
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf from port bgp
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf then policer cust-ctrl-1m
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf then count accept-cust-ebgp
set firewall family inet filter accept-cust-ebgp-vrf term accept-ebgp-vrf then accept
# Customer eBGP Filter - MGMT/GRT
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt from source-prefix-list pfx-pe-to-ce-ebgp-mgmt
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt from destination-prefix-list pfx-pe-to-ce-ebgp-grt
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt from protocol tcp
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt from port bgp
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt then policer cust-ctrl-1m
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt then count accept-cust-ebgp
set firewall family inet filter accept-cust-ebgp-grt term accept-ebgp-grt then accept
# Customer PIM Filter
#set firewall family inet filter accept-cust-pim term accept-pim from source-prefix-list pfx-pe-to-ce-pim
#set firewall family inet filter accept-cust-pim term accept-pim from destination-prefix-list pfx-pim-multicast
#set firewall family inet filter accept-cust-pim term accept-pim from protocol pim
#set firewall family inet filter accept-cust-pim term accept-pim then policer cust-ctrl-1m
#set firewall family inet filter accept-cust-pim term accept-pim then count accept-cust-pim
#set firewall family inet filter accept-cust-pim term accept-pim then accept
# Customer IGMP
#set firewall family inet filter accept-cust-igmp term accept-igmp from source-prefix-list pfx-core-ptp
#set firewall family inet filter accept-cust-igmp term accept-igmp from destination-prefix-list pfx-igmp-multicast
#set firewall family inet filter accept-cust-igmp term accept-igmp from protocol igmp
#set firewall family inet filter accept-cust-igmp term accept-igmp then policer cust-ctrl-1m
#set firewall family inet filter accept-cust-igmp term accept-igmp then count accept-cust-igmp
#set firewall family inet filter accept-cust-igmp term accept-igmp then accept
# Control plane filters
set firewall family inet filter ctrl-plane-services term accept-core-ospf filter accept-core-ospf
set firewall family inet filter ctrl-plane-services term accept-core-bfd filter accept-core-bfd
set firewall family inet filter ctrl-plane-services term accept-core-ibgp filter accept-core-ibgp
set firewall family inet filter ctrl-plane-services term accept-core-ldp filter accept-core-ldp
set firewall family inet filter ctrl-plane-services term accept-core-pim filter accept-core-pim
set firewall family inet filter ctrl-plane-services term accept-cust-bfd filter accept-cust-bfd
set firewall family inet filter ctrl-plane-services term accept-cust-ebgp-vrf filter accept-cust-ebgp-vrf
set firewall family inet filter ctrl-plane-services term accept-cust-ebgp-grt filter accept-cust-ebgp-grt
#set firewall family inet filter ctrl-plane-services term accept-cust-pim filter accept-cust-pim
#set firewall family inet filter ctrl-plane-services term accept-cust-ctrl filter accept-cust-igmp
#############################
# MANAGEMENT PLANE POLICERS #
#############################
# Management 1m Policer - Used for ICMP, TACACS+, NTP, Syslog, SNMP
set firewall policer core-mgmt-1m if-exceeding bandwidth-limit 1m
set firewall policer core-mgmt-1m if-exceeding burst-size-limit 625k
set firewall policer core-mgmt-1m then discard
# Management 5m Policer - Used for SSH
set firewall policer core-mgmt-5m if-exceeding bandwidth-limit 5m
set firewall policer core-mgmt-5m if-exceeding burst-size-limit 625k
set firewall policer core-mgmt-5m then discard
##############################
# MANAGEMENT PLANE PROTOCOLS #
##############################
# ICMP
set firewall family inet filter accept-icmp term no-icmp-fragments from is-fragment
set firewall family inet filter accept-icmp term no-icmp-fragments from protocol icmp
set firewall family inet filter accept-icmp term no-icmp-fragments then count discard-icmp-fragments
set firewall family inet filter accept-icmp term no-icmp-fragments then log
set firewall family inet filter accept-icmp term no-icmp-fragments then discard
set firewall family inet filter accept-icmp term accept-icmp from protocol icmp
set firewall family inet filter accept-icmp term accept-icmp from icmp-type echo-reply
set firewall family inet filter accept-icmp term accept-icmp from icmp-type echo-request
set firewall family inet filter accept-icmp term accept-icmp from icmp-type time-exceeded
set firewall family inet filter accept-icmp term accept-icmp from icmp-type unreachable
set firewall family inet filter accept-icmp term accept-icmp from icmp-type router-advertisement
set firewall family inet filter accept-icmp term accept-icmp then policer core-mgmt-1m
set firewall family inet filter accept-icmp term accept-icmp then count accept-icmp
set firewall family inet filter accept-icmp term accept-icmp then accept
# SNMP
set firewall family inet filter accept-snmp term accept-snmp from source-prefix-list pfx-snmp-servers
set firewall family inet filter accept-snmp term accept-snmp from destination-prefix-list pfx-local-loopback
set firewall family inet filter accept-snmp term accept-snmp from protocol udp
set firewall family inet filter accept-snmp term accept-snmp from destination-port snmp
set firewall family inet filter accept-snmp term accept-snmp then policer core-mgmt-1m
set firewall family inet filter accept-snmp term accept-snmp then count accept-snmp
set firewall family inet filter accept-snmp term accept-snmp then accept
# TACACS/ACS
set firewall family inet filter accept-tacacs term accept-tacacs from source-prefix-list pfx-tacacs-servers
set firewall family inet filter accept-tacacs term accept-tacacs from destination-prefix-list pfx-local-loopback
set firewall family inet filter accept-tacacs term accept-tacacs from protocol udp
set firewall family inet filter accept-tacacs term accept-tacacs from protocol tcp
set firewall family inet filter accept-tacacs term accept-tacacs from source-port tacacs
set firewall family inet filter accept-tacacs term accept-tacacs then policer core-mgmt-1m
set firewall family inet filter accept-tacacs term accept-tacacs then count accept-tacacs
set firewall family inet filter accept-tacacs term accept-tacacs then accept
# NTP (Junos queries the NTPd running on BSD not the remote NTP server directly)
set firewall family inet filter accept-ntp term accept-ntp from source-prefix-list pfx-ntp-servers
set firewall family inet filter accept-ntp term accept-ntp from source-prefix-list pfx-local-loopback
set firewall family inet filter accept-ntp term accept-ntp from destination-prefix-list pfx-local-loopback
set firewall family inet filter accept-ntp term accept-ntp from protocol udp
set firewall family inet filter accept-ntp term accept-ntp from port ntp
set firewall family inet filter accept-ntp term accept-ntp then policer core-mgmt-1m
set firewall family inet filter accept-ntp term accept-ntp then count accept-ntp
set firewall family inet filter accept-ntp term accept-ntp then accept
# SSH
set firewall family inet filter accept-ssh term accept-ssh from source-prefix-list pfx-ssh-jumpbox
set firewall family inet filter accept-ssh term accept-ssh from destination-prefix-list pfx-local-loopback
set firewall family inet filter accept-ssh term accept-ssh from protocol tcp
set firewall family inet filter accept-ssh term accept-ssh from destination-port ssh
set firewall family inet filter accept-ssh term accept-ssh then policer core-mgmt-5m
set firewall family inet filter accept-ssh term accept-ssh then count accept-ssh
set firewall family inet filter accept-ssh term accept-ssh then accept
# Management plane filters
set firewall family inet filter mgmt-plane-services term accept-icmp filter accept-icmp
set firewall family inet filter mgmt-plane-services term accept-snmp filter accept-snmp
set firewall family inet filter mgmt-plane-services term accept-tacacs filter accept-tacacs
set firewall family inet filter mgmt-plane-services term accept-ntp filter accept-ntp
set firewall family inet filter mgmt-plane-services term accept-ssh filter accept-ssh
#######################
# DATA PLANE POLICERS #
#######################
# Data 1m Policer - Traceroute (UDP + ICMP)
set firewall policer data-plane-1m if-exceeding bandwidth-limit 1m
set firewall policer data-plane-1m if-exceeding burst-size-limit 625k
set firewall policer data-plane-1m then discard
########################
# DATA PLANE PROTOCOLS #
########################
# Traceroute
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp from destination-prefix-list pfx-any-local-ipv4
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp from ttl 1
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp from protocol udp
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp from destination-port 33435-33655
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp then policer data-plane-1m
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp then count accept-traceroute-udp
set firewall family inet filter accept-traceroute-udp term accept-traceroute-udp then accept
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp from destination-prefix-list pfx-any-local-ipv4
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp from ttl 1
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp from protocol icmp
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp from icmp-type echo-request
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp then policer data-plane-1m
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp then count accept-traceroute-icmp
set firewall family inet filter accept-traceroute-icmp term accept-traceroute-icmp then accept
# Data plane filters
set firewall family inet filter data-plane-services term accept-traceroute-udp filter accept-traceroute-udp
set firewall family inet filter data-plane-services term accept-traceroute-icmp filter accept-traceroute-icmp
################
# DEFAULT DROP #
################
set firewall family inet filter discard-all term discard-ip-options from ip-options any
set firewall family inet filter discard-all term discard-ip-options then count discard-ip-options
set firewall family inet filter discard-all term discard-ip-options then log
set firewall family inet filter discard-all term discard-ip-options then discard
set firewall family inet filter discard-all term discard-tcp from protocol tcp
set firewall family inet filter discard-all term discard-tcp then count discard-tcp
set firewall family inet filter discard-all term discard-tcp then log
set firewall family inet filter discard-all term discard-tcp then discard
set firewall family inet filter discard-all term discard-udp from protocol udp
set firewall family inet filter discard-all term discard-udp then count discard-udp
set firewall family inet filter discard-all term discard-udp then log
set firewall family inet filter discard-all term discard-udp then discard
set firewall family inet filter discard-all term discard-icmp from protocol icmp
set firewall family inet filter discard-all term discard-icmp then count discard-icmp
set firewall family inet filter discard-all term discard-icmp then log
set firewall family inet filter discard-all term discard-icmp then discard
set firewall family inet filter discard-all term discard-unknown then count discard-unknown
set firewall family inet filter discard-all term discard-unknown then log
set firewall family inet filter discard-all term discard-unknown then discard
##################
# DROP FRAGMENTS #
##################
set firewall family inet filter discard-frags term discard-1st-frag from first-fragment
set firewall family inet filter discard-frags term discard-1st-frag then count discard-frags
set firewall family inet filter discard-frags term discard-1st-frag then log
set firewall family inet filter discard-frags term discard-1st-frag then discard
set firewall family inet filter discard-frags term discard-frags from is-fragment
set firewall family inet filter discard-frags term discard-frags then count discard-frags
set firewall family inet filter discard-frags term discard-frags then log
set firewall family inet filter discard-frags term discard-frags then discard
#########
# APPLY #
#########
set interfaces lo0 unit 0 family inet filter input-list discard-frags
set interfaces lo0 unit 0 family inet filter input-list ctrl-plane-services
set interfaces lo0 unit 0 family inet filter input-list mgmt-plane-services
set interfaces lo0 unit 0 family inet filter input-list data-plane-services
set interfaces lo0 unit 0 family inet filter input-list discard-all
Previous page: MX Loopback0 Filter - From j-nsp mailing list
Next page: Base IPv6 IS-IS SR-MPLS Topology