Firewall Filters Flashcards

What is the primary function of a stateless firewall filter in Junos OS?

Answer: To examine individual packets based on match conditions and apply defined actions

Junos stateless firewall filters examine each packet individually against defined match conditions and apply actions without maintaining session state.

Which Junos CLI command correctly applies a firewall filter in the inbound direction on a logical interface?

Answer: set interfaces ge-0/0/0 unit 0 family inet filter input

Firewall filters are applied under the interface's logical unit and address family using the 'filter input' or 'filter output' knob.

What are the two fundamental building blocks of a Junos OS firewall filter?

Answer: Terms and actions

A Junos firewall filter is composed of ordered terms, where each term contains match conditions (from) and actions (then).

What happens to a packet that does not match any term in a Junos firewall filter?

Answer: It is silently discarded by an implicit default action

Junos firewall filters have an implicit discard at the end, so any packet not matched by an explicit term is silently dropped.

Which of the following is a valid match condition that can be used in a Junos firewall filter term?

Answer: source-address

The 'source-address' match condition is a standard IPv4 match condition in a Junos inet firewall filter term.

What is the key difference between the 'reject' and 'discard' actions in a Junos firewall filter?

Answer: 'Reject' sends an ICMP unreachable to the sender; 'discard' drops the packet silently

'Reject' drops the packet and sends an ICMP unreachable message to the source, while 'discard' silently drops the packet with no notification.

On which Junos component are stateless firewall filters primarily processed for transit traffic?

Answer: Packet Forwarding Engine (PFE)

Stateless firewall filters for transit traffic are enforced on the Packet Forwarding Engine (PFE) in hardware, enabling line-rate filtering.