Description

This article provides an example of how to block unidirectional inter-vlan TCP communication from one VLAN to another VLAN.


Symptoms

 

Solution

 


Scenario:

The host on VLAN 10 can reach the host on VLAN 20, with the requirement to block the TCP connections originated from vlan 10 only.

Topology:
alt
  • A firewall filter is used to achieve this requirement by filtering traffic based on TCP flags.
  • This firewall filter discards any SYN packet but not the ACK packet from source (192.168.5.0) to the destination (192.168.4.0)
user@switch #set firewall family ethernet-switching filter F1 term T1 from source-address 192.168.5.0/24
user@switch #set firewall family ethernet-switching filter F1 term T1 from destination-address 192.168.4.0/24
user@switch #set firewall family ethernet-switching filter F1 term T1 from protocol tcp
user@switch #set firewall family ethernet-switching filter F1 term T1 from tcp-flags "syn&!ack"
user@switch #set firewall family ethernet-switching filter F1 term T1 then discard
user@switch #set firewall family ethernet-switching filter F1 term T2 then accept
user@switch #set vlans vlan20 filter input F1