Hi all,
I am trying to configure an input filter on a LACP bundle interface but
it does not behave as expected.
Take the following examples:
firewall {
family ethernet-switching {
filter acl1 {
term a {
from {
ip-protocol icmp;
}
then accept;
}
term b {
from {
ip-source-address {
1.2.3.4/32;
}
}
then accept;
}
term c {
from {
ip-protocol [ tcp udp ];
}
then discard;
}
}
filter acl2 {
term a {
from {
ip-source-address {
1.2.3.4/32;
}
}
then discard;
}
term b {
then accept;
}
}
}
}
When I apply acl1, it seems to kill all traffic on the interface and
does not allow anything through.
When I apply acl2, it does do what you would expect.
The switch is acting simply as a layer 2 device and the input filter is
being applied on the LAG bundle connected to the upstream.
Also, if I don't specify [tcp udp] on acl1 it actually kills the LAG
towards the upstream completely, weird!
Can anyone please shed any light on what I may be doing wrong?
Thanks in advance,
Panny Malialis
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp
