Description

Firewall Filter to block mac address in ex series switch

Symptoms

There might be scenarios where you need to block a source-mac or an specific suspicious mac address , this can be always achieved from switch by using firewall filter.

Solution

Firewall filter example

topology 

desktop (aa:bb:cc:dd:ee:dd ) ---------switch-access---------------------ge-1/0/1-core switch

Lets assume that we have  to block MAC address aa:bb:cc:dd:ee:dd from accessing  the switch , then we will have to use firewall filter as next using source-mac-address in term 1 , also in same term we are adding count which is going to count the packets being blocked or discarded and at the same time we are logging all this traffic is being discarded. 

Important to consider 

1) It is important to know that the example has term 2 or a second term allowing all traffic, if we do not allow this term the rest of the traffic will be discarded 
2) Please use commit confirmed before applying any filter or testing filters 

switch # show firewall
family ethernet-switching {
    filter test {
        term 1 {
            from {
                source-mac-address {
                    50:c7:09:d0:91:00/48;
                    aa:bb:cc:dd:ee:ff/48;
                }
            }
            then {
                discard;
                log;   <<<<<<<<<<<<<<< logging all traffic being discarded 
                count counter;  <<<<<<<<<<< counting traffic being discarded 
            }
        }
        term 2 {    <<<<<<<<<<<<most important term as this will allow all the rest of traffic 
            then accept;
        }
    }
}

Once that this filter is created please assign the filter towards the AE interface or port in which you need the filter to apply or vlan if applies 

switch# show interfaces ge-1/0/1
unit 0 {
    family ethernet-switching {
        interface-mode trunk;
        vlan {
            members 900;
        }
        filter {
            input test;
        }
    }
}


switch# show vlans
v900 {
    vlan-id 900;
    l3-interface irb.900;
    forwarding-options {
        filter {
            input test;
        }
    }
}

display set 

switch# show firewall | display set
set firewall family ethernet-switching filter test term 1 from source-mac-address aa:bb:cc:dd:ee:ff/48
set firewall family ethernet-switching filter test term 1 then discard
set firewall family ethernet-switching filter test term 1 then log
set firewall family ethernet-switching filter test term 1 then count counter
set firewall family ethernet-switching filter test term 2 then accept

switch# show interfaces ge-1/0/1 | display set
set interfaces ge-1/0/1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-1/0/1 unit 0 family ethernet-switching vlan members 900
set interfaces ge-1/0/1 unit 0 family ethernet-switching filter input test



switch# show vlans | display set
set vlans v900 vlan-id 900
set vlans v900 l3-interface irb.900
set vlans v900 forwarding-options filter input test


To check if firewall is counting packets being blocked use 

switch> show firewall filter test

Filter: test
Counters:
Name                                                Bytes              Packets
counter                                              4488                   66

switch> show firewall filter test

Filter: test
Counters:
Name                                                Bytes              Packets
counter                                              5032                   74

Also to check if it is logging and reporting what is being blocked use as  next 

switch> show firewall log
Log :
Time      Filter    Action Interface           Protocol        Src Addr                         Dest Addr
12:11:29  pfe       D      ge-1/0/1.0          0384:0806      aa:bb:cc:dd:ee:f                ff:ff:ff:ff:ff:ff
12:11:29  pfe       D      ge-1/0/1.0          0384:0806      aa:bb:cc:dd:ee:f                ff:ff:ff:ff:ff:ff
12:11:28  pfe       D      ge-1/0/1.0          0384:0806      aa:bb:cc:dd:ee:f                ff:ff:ff:ff:ff:ff
12:11:27  pfe       D      ge-1/0/1.0          0384:0806      aa:bb:cc:dd:ee:f               ff:ff:ff:ff:ff:ff

Modification History

01/23/24

Related Information

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/concept/firewall-filter-ex-series-overview.html