This article provides information on how to apply the VPLS filter to a logical-tunnel (lt-) interface.

There is no explicit configuration knob to enable the VPLS protocol family under the logical-tunnel interface, which means that the user may not able to assign a VPLS firewall filter.

The protocol family for a logical tunnel interface is determined by the selection of an encapsulation type. By default, when a user selects the encapsulation type as ethernet-vpls or vlan-vpls , family vpls is assigned. However, the user does not explicitly get the VPLS protocol family to apply the VPLS firewall filter under the interface configuration, as seen below:

user1@PE# set interfaces lt-5/2/0.0 family ?
Possible completions:
> ccc                  Circuit cross-connect parameters
> inet                 IPv4 parameters
> inet6                IPv6 protocol parameters
> iso                  OSI ISO protocol parameters
> mpls                 MPLS protocol parameters
> tcc                  Translational cross-connect parameters

As there is no explicit VPLS family, the user may not be able to configure the VPLS firewall filter. The workaround is to use apply-groups to attach a VPLS firewall filter.

1. Configure a group that will attach a firewall filter for the indicated interface:

   [edit]
   user1@PE# show groups VPLS-FILTER-LT
   interfaces {
       <lt-*> {
           unit 0 {
               family vpls {
                   filter {
                       input vpls-fw;
                   }
               }
           }
       }
   }
   
   
   [edit]
   user1@PE# show firewall family vpls
   filter vpls-fw {
       term a {
           from {
               ::::::::::::::::::
   	    ::::::::::::::::::
           }
           then accept;
       }
   }
   
   [edit]
   user1@PE# show routing-instances
   VPLS-A {
       instance-type vpls;
       :::::::::::::::::::::
       :::::::::::::::::::::
       interface lt-5/2/0.0;
       :::::::::::::::::::::
       :::::::::::::::::::::    
   }

• Apply the group configurations, to the intended logical tunnel interface, to attach the VPLS firewall filter:

  [edit]
  user1@PE# show interfaces
  lt-5/2/0 {
      unit 0 {
          apply-groups VPLS-FILTER-LT;
          encapsulation ethernet-vpls;
          peer-unit 1;
      }
  :::::::::::::::::::
  :::::::::::::::::::

• Verify the protocol and filter:

  [edit]
  user1@PE# run show interfaces lt-5/2/0.0 terse
  Interface               Admin Link Proto    Local                 Remote
  lt-5/2/0.0              up    up   vpls
  
  
  [edit]
  user1@PE# run show interfaces lt-5/2/0.0 extensive
    Logical interface lt-5/2/0.0 (Index 92) (SNMP ifIndex 6445) (Generation 257)
      Flags: SNMP-Traps 0x4000 Encapsulation: Ethernet-VPLS
      Traffic statistics:
       Input  bytes  :                    0
       Output bytes  :                    0
       Input  packets:                    0
       Output packets:                    0
      Local statistics:
       Input  bytes  :                    0
       Output bytes  :                    0
       Input  packets:                    0
       Output packets:                    0
      Transit statistics:
       Input  bytes  :                    0                    0 bps
       Output bytes  :                    0                    0 bps
       Input  packets:                    0                    0 pps
       Output packets:                    0                    0 pps
      Protocol vpls, MTU: 1514, Generation: 358, Route table: 6
        Flags: Is-Primary
        Input Filters: vpls-fw