Filter action reject is not supported if it is applied as an output filter
A filter that is configured with action as reject cannot be applied as an output filter to an interface. When a commit is performed, it fails throwing the error "Referenced filter can not be used as reject not supported on egress"
Here the firewall filter is configured with action reject.
root@qfx5100# show firewall family inet filter monitor
term last {
then {
reject;
}
root@qfx5100# show interfaces xe-0/0/10
unit 0 {
family inet {
address 10.1.1.1/24;
When the filter is applied to the interface xe-0/0/10 on the outbound or as output filter then commit fails with error.
{master:0}[edit]
root@qfx5100# set interfaces xe-0/0/10 unit 0 family inet filter output monitor
root@qfx5100# commit
[edit interfaces xe-0/0/10 unit 0 family inet]
'filter'
Referenced filter 'monitor' can not be used as reject not supported on egress
error: Failed to read config
commit-check failed
error: configuration check-out failed
root@qfx5100#
Configure a filter with action as discard than using reject if the filter will be used as output filter.
From the above example, modify the filter with action set to discard
root@qfx5100# delete firewall family inet filter monitor term last then reject
root@qfx5100# set firewall family inet filter monitor term last then discard
root@qfx5100# show | compare
[edit firewall family inet filter monitor term last then]
- reject;
+ discard;
configuration check succeeds
commit complete
Apply the filter to the interface xe-0/0/10
root@qfx5100# set interfaces xe-0/0/10.0 family inet filter output monitor
discard;