Once upon a time, Chris Evans <chrisccnpsp...@gmail.com> said:
> I'm trying to implement a firewall filter to implement IPv6 RA guard on an
> EX4200. I have the ACL written to block DHCP and icmp router-advertisements.
> However it appears that the EX4200 only supports IPv4 at this time for
> PACLs? I have applied the filter ingress to my interfaces and RA
> advertisements are still passing.
>
> This is on 11.1 code. Anyone else tried this??
>
> EX4200-1> show configuration firewall
> family ethernet-switching {
> term RA-GUARD-ICMP-RA {
> from {
> protocol icmp;
> icmp-type router-advertisement;
You are filtering the (unused) IPv4 ICMP RAs, not IPv6 ICMPv6 RAs. You
can match protocol icmpv6, but I don't think there is a corresponding
icmpv6-type, so I don't think you can do this right now.
--
Chris Adams <cmad...@hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp
