Description

A number of terms are configured in a firewall filter, but they are not included in the "show firewall" command output. This article explains why and provides an example of how to correct it.

Symptoms

The following configuration is created, but the policer "BESTEFFORT" and counter "BESTEFFORTCOUNTER" are not shown in the output of 'show firewall'.

FIREWALL CONFIGURATION 

# show firewall 
family inet {
    filter testfilter {
        interface-specific;
        term VOICE {
            from {
                forwarding-class VOICE;
            }
            then {
                policer VOICE;
                count VOICECOUNTER;
                loss-priority low;
                accept;
            }
        }
        term STANDARD {
            then {
                policer STANDARD;
                count STANDARDCOUNTER;
                loss-priority low;
                accept;
            }                           
        }
        term BESTEFFORT {
            from {
                forwarding-class BestEffort;
            }
            then {
                policer BESTEFFORT;
                count BESTEFFORTCOUNTER;
                loss-priority high;
                forwarding-class BestEffort;
                accept;
            }
        }
    }
}
policer VOICE {
    if-exceeding {
        bandwidth-limit 390k;
        burst-size-limit 625k;
    }
    then discard;
}
policer STANDARD {                      
    if-exceeding {
        bandwidth-limit 390k;
        burst-size-limit 625k;
    }
    then discard;
}
policer BESTEFFORT {
    if-exceeding {
        bandwidth-limit 390k;
        burst-size-limit 625k;
    }
    then discard;
}

SHOW FIREWALL 

# run show firewall 

Filter: __default_bpdu_filter__                                

Filter: testfilter-ge-1/2/4.0-i                                
Counters:
Name                                                Bytes              Packets
STANDARDCOUNTER-ge-1/2/4.0-i                            0                    0
VOICECOUNTER-ge-1/2/4.0-i                               0                    0
Policers:
Name                                                Bytes              Packets
STANDARD-STANDARD-ge-1/2/4.0-i                          0                    0
VOICE-VOICE-ge-1/2/4.0-i                                0                    0

Note that the policer "BESTEFFORT" and counter "BESTEFFORTCOUNTER" are not shown.

Solution

This behavior is expected because no traffic can be matched by the term "BESTEFFORT". All traffic would be matched by the term "STANDARD"; therefore the policer and counter in the term will not be shown.

The configuration can be improved by defining match criteria for the term STANDARD. Here's an example.

FIREWALL CONFIGURATION 

# show firewall 
family inet {
    filter testfilter {
        interface-specific;
        term VOICE {
            from {
                forwarding-class VOICE;
            }
            then {
                policer VOICE;
                count VOICECOUNTER;
                loss-priority low;
                accept;
            }
        }
        term STANDARD {
            from {
                forwarding-class STANDARD;    //Define match criteria
            }
            then {
                policer STANDARD;
                count STANDARDCOUNTER;
                loss-priority low;
                accept;
            }                           
        }
        term BESTEFFORT {
            from {
                forwarding-class BestEffort;
            }
            then {
                policer BESTEFFORT;
                count BESTEFFORTCOUNTER;
                loss-priority high;
                forwarding-class BestEffort;
                accept;
            }
        }
    }
}
policer VOICE {
    if-exceeding {
        bandwidth-limit 390k;
        burst-size-limit 625k;
    }
    then discard;
}
policer STANDARD {                      
    if-exceeding {
        bandwidth-limit 390k;
        burst-size-limit 625k;
    }
    then discard;
}
policer BESTEFFORT {
    if-exceeding {
        bandwidth-limit 390k;
        burst-size-limit 625k;
    }
    then discard;
}

SHOW FIREWALL 

# run show firewall                     

Filter: __default_bpdu_filter__                                

Filter: testfilter-ge-1/2/4.0-i                                
Counters:
Name                                                Bytes              Packets
BESTEFFORTCOUNTER-ge-1/2/4.0-i                          0                    0
STANDARDCOUNTER-ge-1/2/4.0-i                            0                    0
VOICECOUNTER-ge-1/2/4.0-i                               0                    0
Policers:
Name                                                Bytes              Packets
BESTEFFORT-BESTEFFORT-ge-1/2/4.0-i                      0                    0
STANDARD-STANDARD-ge-1/2/4.0-i                          0                    0
VOICE-VOICE-ge-1/2/4.0-i                                0                    0

Now, the all the policers and counters configured are shown.