Network Ninja

In the networking world a multitude of vendors are present. And each of them have their magnificent features  but also their quirks. And one of the quirks, for the network vendors in general, is that terminology is not uniform.

Where Cisco likes to talk about Access-Control List or ACL for short Juniper likes to talk about filters. Juniper filters are awesome. Juniper likes to arrange information a tree-like structure. This enables Juniper for future changes in software approach.

Cisco has standard access-list, the down-side; modification can not be done. Deletion of one ACE is not possible.  The entire ACL has to be removed.

A slight improvement are extended access-lists. Every ACE has a number associated with it. And using some ip access-list resequence magic you can make some room to insert ACE’s.

This hassle is not known to Juniper engineers.

Simply create a access-list ehm …. filter

set firewall family inet filter generic-filter term discard then discard

This filter simply, forwards every packet to the great bit-bucket in the sky.

If you want to allow traffic from you lan towards webservers you add the following;

set firewall family inet filter generic-filter term web_lan from source-address 10.0.0.0/8
set firewall family inet filter generic-filter term web_lan from protocol tcp
set firewall family inet filter generic-filter term web_lan from destination-port 80
set firewall family inet filter generic-filter term web_lan then accept

Now you have two terms within the “generic-filter”

show configuration firewall
family inet {
    filter generic-filter {    
        term discard {
            then {
                discard;
            }
        }
        term web_lan {
            from {
                source-address {
                    10.0.0.0/8;   
                }
                protocol tcp;
                destination-port 80;
            }
            then accept;
        }
    }

If you leave it this way traffic to the webservers are discarded instead of allowed. This is where Juniper added some pretty awesome magic;just shuffle the term to a place where is fits best.

insert firewall family inet filter generic-filter term web_lan before term discard

Of course you need to address some more issues like established traffic etc.

But this is how Juniper addresses filters. And there are a whole lot more things you can manage with filters. You can create a variables , and when a condition is met the counter is raised by the value you like.  Variable is readable in the context of show firewall.

Today my first steps in Juniper filtering. An awesome experience.