This article provides information about the position at which the firewall filter should be correctly applied on the loopback interface in any routing instance.

When applying the firewall filter on the loopback interface, due to certain reasons (such as Routing Engine protection), the position at which the firewall filter is applied should be carefully considered.

You can create an individual loopback interface logical unit for each and every Routing Instance, such as lo0.x (x>1)

When assigning the loopback interface logical unit to one Routing Instance, you can also apply the firewall filter on the sub-interface.

Additionally, the loopback0.0 logical unit (also referred as the default loopback interface), which is associated with the default routing table, can also have its own firewall filter. You can define multiple firewall filters and apply them on different logical units of the loopback interface. Which filter should take effect can be decided by the following three rules:
 

• If you configure Filter A on the default loopback interface and Filter B on the VRF loopback interface, then the VRF routing instance uses Filter B.

• If you configure Filter A on the default loopback interface, but do not configure a filter on the VRF loopback interface, then the VRF routing instance does not use a filter.

• If you configure Filter A on the default loopback interface, but do not even configure a VRF loopback interface, the VRF routing instance uses Filter A.