On EX4300 Series switches, firewall filters can be configured to accept, count, and discard packets among other actions based on matching criteria. These filters can be applied in ingress and egress directions on VLANs and on physical or logical (including IRBs) interfaces. To properly apply filters on VLANs and IRBs, it is necessary to understand how a switch behaves while analyzing inbound and outbound traffic flows.
This article explains how EX4300 switches react and handle matching destination and source filter criteria on IRBs and VLANs.
Consider the following filter traffic from Host A to Host B and from Host B to Host A.
When using matching criteria for the source and destination firewall filters, such as IP addresses on IRBs and VLANs, traffic will pass through the filter only if the filter is applied in the right direction.
If the goal is to capture traffic from Host A to B, then filters must be applied in the ingress direction on VLAN A and/or in the egress direction on VLAN B:
Example configuration on VLAN filters
set firewall family ethernet-switching filter L2_From_A_To_B term 1 from icmp-type echo-request set firewall family ethernet-switching filter L2_From_A_To_B term 1 from ip-source-address 10.10.10.2/32 set firewall family ethernet-switching filter L2_From_A_To_B term 1 from ip-destination-address 20.20.20.2/32 set firewall family ethernet-switching filter L2_From_A_To_B term 1 then discard set firewall family ethernet-switching filter L2_From_A_To_B term 1 then count L2_Counter set firewall family ethernet-switching filter L2_From_A_To_B term 2 then accept set vlans Vlan_A vlan-id 1 set vlans Vlan_A l3-interface irb.1 set vlans Vlan_A forwarding-options filter input L2_From_A_To_B set vlans Vlan_B vlan-id 2 set vlans Vlan_B l3-interface irb.2 set vlans Vlan_B forwarding-options filter output L2_From_A_To_B
Result (filter either on VLAN A or VLAN B)
HostA> ping 20.20.20.2 PING 20.20.20.2 (20.20.20.2): 56 data bytes ... --- 20.20.20.2 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss show firewall Filter: L2_From_A_To_B Counters: Name Bytes Packets L2_Counter 204 2
Example configuration on IRB filters
set firewall family inet filter L3_From_A_To_B term 1 from source-address 10.10.10.2/32 set firewall family inet filter L3_From_A_To_B term 1 from destination-address 20.20.20.2/32 set firewall family inet filter L3_From_A_To_B term 1 from icmp-type echo-request set firewall family inet filter L3_From_A_To_B term 1 then count L3_Counter set firewall family inet filter L3_From_A_To_B term 1 then discard set firewall family inet filter L3_From_A_To_B term 2 then accept set interfaces irb unit 1 family inet address 10.10.10.1/24 set interfaces irb unit 1 family inet filter input L3_From_A_To_B set interfaces irb unit 2 family inet address 20.20.20.1/24 set interfaces irb unit 2 family inet filter output L3_From_A_To_B
Result (IRB.1 incoming traffic)
HostA> ping 20.20.20.2 PING 20.20.20.2 (20.20.20.2): 56 data bytes ... --- 20.20.20.2 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss show firewall Filter: L3_From_A_To_B-irb.1-i Counters: Name Bytes Packets L3_Counter-irb.1-i 204 2
Result (IRB.2 outgoing traffic)
HostA> ping 20.20.20.2 PING 20.20.20.2 (20.20.20.2): 56 data bytes ... --- 20.20.20.2 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss show firewall Filter: L3_From_A_To_B-irb.2-o Counters: Name Bytes Packets L3_Counter-irb.2-o 204 2
If, on the other hand, we need to capture traffic from Host B to Host A, filters must be configured as ingress on VLAN B and as egress on VLAN A:
set firewall family ethernet-switching filter L2_From_B_To_Aterm 1 from icmp-type echo-reply set firewall family ethernet-switching filter L2_From_B_To_Aterm 1 from ip-source-address 20.20.20.2/32 set firewall family ethernet-switching filter L2_From_B_To_Aterm 1 from ip-destination-address 10.10.10.2/32 set firewall family ethernet-switching filter L2_From_B_To_Aterm 1 then discard set firewall family ethernet-switching filter L2_From_A_To_B term 1 then count L2_Counter set firewall family ethernet-switching filter L2_From_B_To_Aterm 2 then accept set vlans Vlan_A vlan-id 1 set vlans Vlan_A l3-interface irb.1 set vlans Vlan_A forwarding-options filter output From_B_To_A set vlans Vlan_B vlan-id 2 set vlans Vlan_B l3-interface irb.2 set vlans Vlan_B forwarding-options filter input From_B_To_A
The result in this case is the same as that in example 1.
set firewall family inet filter L3_From_B_To_A term 1 from source-address 20.20.20.2/32 set firewall family inet filter L3_From_B_To_A term 1 from destination-address 10.10.10.2/32 set firewall family inet filter L3_From_B_To_A term 1 from icmp-type echo-reply set firewall family inet filter L3_From_B_To_A term 1 then discard set firewall family inet filter L3_From_B_To_A term 2 then accept set interfaces irb unit 1 family inet address 10.10.10.1/24 set interfaces irb unit 1 family inet filter output L3_From_B_To_A set interfaces irb unit 2 family inet address 20.20.20.1/24 set interfaces irb unit 2 family inet filter input L3_From_B_To_A
The result in this case is the same as that in example 2 but in the opposite direction.
Note: When inter-VLAN traffic handling occurs, the packets are moved internally from one VLAN to the next one. This under-layer movement goes beyond firewall filter capabilities, which means that filters will not analyze PFE traffic moving from VLAN A to VLAN B and from VLAN B to VLAN A. It may then be required to apply filters on multiple VLANs/IRBs to achieve the desired results.