This article outlines key considerations to review when configuring a firewall filter. If the filter is applied to an interface without proper validation, it may drop packets and negatively affect services.

When configuring a new firewall filter to capture or filter packets, or to implement filter-based forwarding, there is a risk that it may affect all traffic, whether it matches the filter criteria or not.
Packets that do not meet the specified conditions will be dropped silently unless a counter is set up to track the number of dropped packets.

If you intend to perform packet capture using a firewall filter, please ensure the following criteria are met:

• Mirror Only Essential Packets: Limit packet mirroring to reduce potential performance impacts. We recommend disabling any configured mirroring settings when they are not in use.
• Configure Counters: Set up a counter for each term in the firewall filter to monitor the number of packets that match the specified conditions.
• Support for IPv4 and IPv6: Configure firewall filters for both IPv4 and IPv6 traffic on the same Layer 3 interface. You need to include two separate terms—one for IPv4 traffic and another for IPv6 traffic.
• Matching Conditions for IPv6: If a term includes either the ether-type ipv6 or ip-version ipv6 match conditions without any other IPv6 match conditions specified, it will match all IPv6 traffic. Conversely, if neither condition is present, the term defaults to apply to IPv4 traffic.
• Filter Application Limitations: Only one firewall filter can be applied per VLAN in each direction.
• Limit Mirrored Traffic: Use firewall filters to restrict the amount of mirrored traffic.
• Avoid Large Prefix Lists: Refrain from using prefix lists with /8 or /10 subnets, as these cover extensive address spaces that could overlap with local IP addresses. For instance, an /8 subnet can include millions of IP addresses, potentially affecting local IP addresses.
• Action Configuration: If you omit the then statement or fail to specify an action, packets matching the conditions in the from statement will be accepted by default. However, it is essential to explicitly configure an action and/or action modifier in the then statement. You may include only one action, but can use any combination of action modifiers.

Finally, If an outage is caused by these firewall filter configurations, please roll back immediately and review the points above before proceeding with any planned maintenance. If making changes to the firewall filter on the fly, remember to use the commit confirm command.

2024-05-28 : Article Created

2024-09-28: Article modified

2026-03-18: Category updated