Routing policy Allows you to control the routing information between the routing protocols and the routing tables and between the routing tables and the forwarding table. All routing protocols use the Junos OS routing tables to store the routes that they learn and to determine which routes they should advertise in their protocol packets. Routing policy allows you to control which routes the routing protocols store in and retrieve from the routing table.
In Junos device, the policy is written first then only a policy is applied. We can define security zones on our junos devices. Considering those security zones, policy is written and applied. Policing uses two different types of values to rate-limit user traffic. The first is the bandwidth - limit value, which is the average number of bits per second permitted in the range of 32Kbps to 32Gbps. The second is burst-size-limit, which is the amount of data allowed to exceed the given bandwidth constraints.
Reasons to Create a Routing Policy
The following are typical circumstances under which you might want to preempt the default routing policies in the routing policy framework by creating your own routing policies:
Policy Components
All policies are composed of the following components that you configure:
The policy framework software evaluates each incoming and outgoing route or packet against the match conditions in a term. If the criteria in the match conditions are met, the defined action is taken.
In general, the policy framework software compares the route or packet against the match conditions in the first term in the policy, then goes on to the next term, and so on. Therefore, the order in which you arrange terms in a policy is relevant.
The order of match conditions within a term is not relevant because a route or packet must match all match conditions in a term for an action to be taken.
Import and export policies: Import and export policies controls the view of the local router and the neighbor router. We configure an import and an export policy under [edit protocols] hierarchy. There is no default import policy for OSPF. But the default export policy for OSPF is to reject all routes.
There are three such possible results that each policy contains. Both accept and reject are considered terminating actions and they have a special meaning-they stop the policy evaluation. The next policy clarifies that the route should be evaluated by the next position in the policy chain.
Policy-Options Hierarchy
policy-options {
policy-statement policy-name {
term term-name {
from {
match-conditions;
}
to {
match-conditions;
}
then actions;
}
}
}
Firewall filter policy: Allows you to control packets transiting the router to a network destination and packets destined for and sent by the router.
In junos devices, a firewall filter in router is implemented using Internet Processor ASIC. The Internet Processor builds on the fundamental performance and reliability by adding enhanced security functions, increased visibility into network operations. Each firewall filter in the JUNOS software contains a hidden term that causes a single final action for all filters. This final action is to discard all packets.
Firewall filters enables to control packets transiting the device to a network destination as well as packets destined for and sent by the device. You can configure a firewall filter to perform specified actions on packets of a particular protocol family, including fragmented packets, that match specified conditions based on Layer3 or Layer4 packet header fields.
Stateless and Stateful Firewall Filters
A stateless firewall filter, also known as an access control list (ACL), does not statefully inspect traffic. Instead, it evaluates packet contents statically and does not keep track of the state of network connections. Stateless firewalls watch network traffic, and restrict or block packets based on source and destination addresses or other static values. They are not 'aware' of traffic patterns or data flows.
In contrast, a stateful firewall filter uses connection state information derived from other applications and past communications in the data flow to make dynamic control decisions. tateful firewalls can watch traffic streams from end to end. They are are aware of communication paths and can implement various IP Security (IPsec) functions such as tunnels and encryption. In technical terms, this means that stateful firewalls can tell what stage a TCP connection is in (open, open sent, synchronized, synchronization acknowledge or established), it can tell if the MTU has changed, whether packets have fragmented etc.
Stateless firewalls are typically faster and perform better under heavier traffic
Stateful firewalls are better at identifying unauthorized and forged communications.
Firewall Filter Components
In a firewall filter, you first define the family address type (ethernet-switching, inet (for IPv4), inet6 (for IPv6), circuit cross-connect (CCC), or MPLS), and then define one or more terms that specify the filtering criteria and the action to take if a match occurs.
Each term consists of the following components:
Firewall Filter Processing: If there are multiple terms in a filter, the order of the terms is important. If a packet matches the first term, the switch executes the action defined by that term, and no other terms are evaluated. If the switch does not find a match between the packet and the first term, it compares the packet to the next term. If no match occurs between the packet and the second term, the system continues to compare the packet to each successive term in the filter until a match is found. If the packet does not match any terms in the filter, the switch discards the packet by default.
The command to configure a firewall filter is made at the [edit firewall family inet] hierarchy level
filter filter-name {
term term-name {
from {
match-conditions;
}
then {
action;
}
}
}
where filter-name is the name of the filter, term-name is the name of the filter term, match-conditions is the condition that the incoming packets must match for the action to be applied, and action is the steps to take for packets that match the filter condition.
The 'show firewall' command displays counter and policer statistics for all firewall filters. We can also specify the name of specific filter using 'show firewall filter <filter-name>' command.
Count, log and sample are the action modifiers used in firewall filters. This modifiers help us in gathering additional information about the contents of packets.
You use the clear firewall counter-name command to reset the counters associated with your firewall filters. You can clear an individual counter, an individual filter, or all filters on the router.
Example: To clear the counter and policier statistics of MY-FILTER firewall filter, we use 'clear firewall filter MY-FILTER' command. Whereas the 'clear firewall filter' command clears all the counter and policier statistics of all the firewall filters applied on our device.
'icmp-code number','dscp number' and 'destination-port number' are the numeric range firewall filter match condition. Destination-port number denotes the TCP or UDP destination port field.
The JUNOS software uses firewalls filters not only to drop or accept data packets but also to rate - limit those packets. Rate policing enables you to limit the amount of traffic that passes into or out of a particular interface.
We use 'show' command to display our configuration that we have configured. In order to modify our configuration we use rename and insert commands. Rename command renames the filter configuration with other configuration.
