Download Chapter Review Questions

}
}
from {
protocol tcp;
port telnet;
}
then accept;
}
Bit field matching such as IP options and TCP flags also support numeric
values or more user-friendly terms. In these cases, the numeric support
must be written in hex format, so a TCP flag match for SYN packets could
be written with the keyword syn or the value 0x2. No reason to break
out the hex converter—make life easy and use the keywords!
Filter Actions
Besides the terminating actions already discussed (accept, discard, reject), other common action modifiers include:
analyzer <analyzer name>
Mirrors port traffic to a specified destination port or VLAN that is connected to a
protocol analyzer application. Mirroring copies all packets seen on one switch port
to a network monitoring connection on another switch port. The analyzer-name
and mirroring parameters must be configured under [edit ethernet-switchingactions analyzer].
You can specify mirroring for ingress ports, VLANs, and router firewall filters only.
count <counter name>
Counts the total number of packets and bytes that match a term. Counters can be
viewed with the show firewall command.
policer
Rate-limits traffic based on bandwidth and burst size limits (discussed later in this
chapter).
forwarding-class
Sends packets to a forwarding class, which maps to a queue.
Applying a Filter
The final step after writing the filter is actually applying it to the interface. Filters can
be applied to either transit or non-transit traffic. To apply a filter to transit traffic, apply
the filter to any PFE interface as either an input or output filter.
Remember, a filter can be applied in one of three places: the port level, VLAN level, or
logical unit level. Also, only a single filter can ever be applied per direction.
Firewall Filters | 483