This article explains whether an interface can be configured with one or more firewall filters.

An interface can be configured with a firewall filter in both input and output directions. However, if another filter is configured, it will override the previously configured filter.

By design, an interface can only have one firewall filter configured in each direction. If you attempt to configure a second filter, it will replace the existing one.

To capture multiple types of traffic, rather than creating multiple filters, configure multiple terms within a single filter to capture the desired traffic.

Note: For example, if a PCAP filter is configured in the input direction on an interface but not in the output direction, and you attempt to configure another filter (PCAP2) in the output direction, the new filter will be applied without overriding the existing one, as no filter is configured for output. However, if you attempt to configure the PCAP2 filter in both the input and output directions, it will override the existing PCAP filter on the input side, since an interface can only have one filter configured in each direction.

2024-08-29 : Article Created

2025-02-03: Added information on capturing multiple types of traffic using multiple terms instead of a filter