Re: [j-nsp] Juniper firewall chain behavior

2007-04-04 Thread Richard A Steenbergen
On Tue, Apr 03, 2007 at 08:20:40PM -0700, Kevin Oberman wrote: If any filter in the chain reaches an explicit 'accept' or 'deny', that is the end of the processing for the entire chain. Of course, there is an implicit accept at the end of the chain. Funny, in normal firewall use there is an

Re: [j-nsp] Juniper firewall chain behavior

2007-04-04 Thread Steven Brenchley
For Firewall filters there it is an implicit discard at the end of the chain for policys it depends on the protocol such as BGP has an implicit accept. I don't recall what it is for the other protocols but it's mentioned in the jncia and/or jncis study guides. On 4/3/07, Richard A Steenbergen

Re: [j-nsp] Juniper firewall chain behavior

2007-04-04 Thread Jonathan Looney
As I mentioned before (and as Juniper's documentation indicates), there is an implicit accept; when you modify other things (which includes applying counters, sampling, etc.). If you want to override that, you can use the next term; action. So, using that action in the terms in your filter chain

Re: [j-nsp] Juniper firewall chain behavior

2007-04-04 Thread Richard A Steenbergen
On Wed, Apr 04, 2007 at 10:42:07AM -0400, Jonathan Looney wrote: As I mentioned before (and as Juniper's documentation indicates), there is an implicit accept; when you modify other things (which includes applying counters, sampling, etc.). If you want to override that, you can use the next