Juniper Networks J-Series manual Configuring a Firewall Filter for Packet Capture, Edit firewall

J-series™ Services Router Administration Guide

1.Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.

2.Perform the configuration tasks described in Table 136 on page 260.

3.If you are finished configuring the router, commit the configuration.

4.To check the configuration, see “Verifying Packet Capture” on page 263.

Table 136: Configuring a Firewall Filter for Packet Capture

Task	J-Web Configuration Editor		CLI Configuration Editor
Navigate to the Firewall level in the	1.	In the J-Web interface, select	From the [edit] hierarchy level, enter
configuration hierarchy.		Configuration>View and Edit>Edit
		Configuration.	edit firewall
	2.	Next to Firewall, click Configure or
		Edit.

Define a firewall filter dest-alland a filter term—for example, dest-term—to capture packets with a particular destination address—for example, 192.168.1.1/32.

1.Next to Filter, click Add new entry.

2.In the filter name box, type dest-all.

3.Next to Term, click Add new entry.

4.In the Rule name box, type dest-term.

5.Next to From, click Configure.

6.Next to Destination address, click Add new entry.

7.In the Address box, type

192.168.1.1/32.

8.Click OK until you return to the Configuration page.

Set the filter and term name, and define the match condition and its action.

set firewall filter dest-all term dest-term from destination-address 192.168.1.1/32

set firewall filter dest-all term dest-term then sample accept

Navigate to the Interfaces level in the configuration hierarchy.

Apply the dest-allfilter to all the outgoing packets on the interface—for example, fe-0/0/1.0.

(See the interface naming conventions in the J-series Services Router Basic LAN and WAN Access Configuration Guide.)

In the configuration editor hierarchy, select Interfaces.

1.In the Interface name box, click fe-0/0/1.

2.In the Interface unit number box, click 0.

3.Next to Inet, select Yes, and click Edit.

4.Next to Filter, click Configure.

5.In the Output box, type dest-all.

6.Click OK until you return to the Interfaces page.

Enter

set interfaces fe-0/0/1 unit 0 family inet filter output dest-all

260■ Configuring Packet Capture with a Configuration Editor