Sometime we need to match multiple IP subnets to match in a filter. It is good to define a prefix list with IP ranges needed and call the prefix-list in filter
Firewall filter sample config:set firewall family inet filter Secure_ssh term terminal_access from source-addressset firewall family inet filter Secure_ssh term terminal_access from protocol tcpset firewall family inet filter Secure_ssh term terminal_access from port sshset firewall family inet filter Secure_ssh term terminal_access then acceptset firewall family inet filter Secure_ssh term terminal_access_denied from protocol tcp port sshset firewall family inet filter Secure_ssh term terminal_access_denied discard
You can use prefix list for the group of IPs and call them directly in firewall filter.
Example:-
(below is the sample config for your reference, you can modify this according to your requirement. )
-> set policy-options prefix-list SSH-IP-RANGE (subnet) -> set policy-options prefix-list SSH-IP-RANGE 10.x.x.x/16-> set policy-options prefix-list SSH-IP-RANGE 192.x.x.x/24 set firewall family inet filter Secure_ssh term terminal_access from source-prefix-list SSH-IP-RANGE
set firewall family inet filter Secure_ssh term terminal_access from protocol tcp
set firewall family inet filter Secure_ssh term terminal_access from port ssh
set firewall family inet filter Secure_ssh term terminal_access then accept
set firewall family inet filter Secure_ssh term terminal_access_denied from protocol tcp port ssh
set firewall family inet filter Secure_ssh term terminal_access_denied discard
2024-09-24 : Article Created
2024-10-07 : Article Validated
https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/example/policy-prefix-list.html
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/prefix-list-edit-policy-options.html
https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/concept/policy-configuring-prefix-lists-for-use-in-routing-policy-match-conditions.html