juniper EX系列交换机 包过滤（Packet Filtering）配置
Juniper EX交换机支持基于物理端口、VLAN和三层VLAN接口的包过滤技术：
在二层过滤下支持：
■?Ingress port firewall filter
■?Ingress VLAN firewall filter
■?Egress VLAN firewall filter
在三层过滤下支持：
■?Ingress port firewall filter
■?Ingress VLAN firewall filter (Layer 2 CoS)
■?Ingress router firewall filter (Layer 3 CoS)
■?Egress router firewall filter
■?Egress VLAN firewall filter
配置命令：
firewall?{
family?family-name {
filter?filter-name {
term?term-name {
match-conditions;
}
then?{
action;
action-modifiers;
}
}
}
}
policer?policer-name {
bandwidth-limit?bps;
burst-size-limit?bytes;
}
policer-action;
}
}
}
在接口下配置：
[edit interfaces]
user@switch# set ge-0/0/1 unit 0 family ethernet-switching filter input?ingress-port-filter
在VLAN接口下配置：
[edit vlans]
user@switch# set employee-vlan vlan 20 filter output egress-vlan-filter
在RVI接口下配置：
[edit interfaces]
user@switch# set ge-0/1/0 unit 0 family inet source-address 10.10.10.1/24
filter input ingress-router-filter
[edit interfaces]
user@switch# set ge-0/1/0 unit 0 family inet source-address 10.10.10.1/24
filter output egress-router-filter
配置接口限速：
(1)
firewall {
policer AAAAAAAAAAAAAAAAAAA {
if-exceeding {
bandwidth-limit 1m;
burst-size-limit 30k;
}
then {
discard;
}
}
family ethernet-switching {
filter ccccccccccccccccccc {
term xxxxx-connection {
then {
policer? AAAAAAAAAAAAAAAAAA
}
}
(2)
interfaces {
ge-0/0/0 {
unit 0 {
family ethernet-switching {
filter {
input ccccccccccccccccccc;
}
}
}
}
查看命令：
user@Shiraz> show firewall
user@Shiraz> show firewall?log
user@Shiraz> show firewall?log detail
user@Shiraz> show firewall?log messages
user@Shiraz> show interfaces filters
user@Shiraz> show interfaces policers
本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。 如若内容造成侵权/违法违规/事实不符，请联系我的编程经验分享网邮箱：veading@qq.com进行投诉反馈，一经查实，立即删除！