This article explains the impact of applying the prefix-list with IPV4 and IPV6 prefixes as source-prefix-list or destination-prefix-list to the firewall terms under the same family.

In the below example firewall filter is applied in the outbound direction with source-prefix-list under the family inet which contains both IPV4 and IPV6 addresses.

set interfaces ae1 unit 4055 family inet filter output zone5-outbound

set firewall family inet filter zone5-outbound term deny-prefixes-ipv4 from source-prefix-list zone5-prefixes-noexternal-ipv4

set firewall family inet filter zone5-outbound term deny-prefixes-ipv4 then reject

set firewall family inet filter zone5-outbound term deny-prefixes-ipv6 from source-prefix-list zone5-prefixes-noexternal-ipv6

set firewall family inet filter zone5-outbound term deny-prefixes-ipv6 then reject

set firewall family inet filter zone5-outbound term permit-all then accept

set policy-options prefix-list zone5-prefixes-noexternal-ipv4 10.0.0.0/16

set policy-options prefix-list zone5-prefixes-noexternal-ipv6 fc00::/7

Traffic Drop can be noticed

Firewall filters are based on per family, so family inet firewall filter handles the prefixes corresponding to IPV4 and family inet6 handles the prefixes related to ipv6 family.

If the IPV6 address is added to family inet filter, commit will fail.

If the IPV4 address is added to family inet6 filter, commit will fail.


However, when applying the firewall filter with the prefix-lists, there is no such commit error.

So please double check the firewall filter family and apply the corresponding family prefix-lists.