Description

This article explain about How to re-order the terms in existing firewall filters on SRX

Symptoms

A filter in Junos is a set of terms that are evaluated in order, starting from the top. The first term that matches the traffic will execute its action (accept, discard, deny, etc.). After a match is found and an action is taken, no further terms are evaluated for that packet. If no terms match the traffic, then the default action (if specified) is applied (which is typically either accept or discard depending on the filter configuration)

Solution

Under the filter filter-name statement, you can include term term-name statements to create and name filter terms.

  • You must configure at least one term in a firewall filter.

  • You must specify a unique name for each term within a firewall filter. The term name can contain letters, numbers, and hyphens (-) and can be up to 64 characters long. To include spaces in the name, enclose the entire name in quotation marks (“ ”).

  • The order in which you specify terms within a firewall filter configuration is important. Firewall filter terms are evaluated in the order in which they are configured. By default, new terms are always added to the end of the existing filter. You can use the insert configuration mode command to reorder the terms of a firewall filter.

This is the Syntax for using insert command
insert <statement-path> identifier1 (before | after) identifier2

Example:-
insert firewall family inet filter abc-filter term "X" before term "Y"


Documents referred:-
Guidelines for Configuring Firewall Filters
insert

 

Modification History

2024-12-05 : Article Created

2024-12-28 : added QFX series