What is the idea of specifying family under firewall configuration? For example one could configure "firewall family inet filter":
firewall {
family {
inet {
filter TEST-FILTER {
term TEST-TERM {
from {
source-address {
10.10.10.0/24 except;
0.0.0.0/0;
}
destination-address {
10.10.10.22/32;
10.10.10.77/32;
}
}
then {
count TEST-TERM;
discard;
}
}
term other {
then accept;
}
}
}
}
}
..or just "firewall filter":
firewall {
filter TEST-FILTER {
term TEST-TERM {
from {
source-address {
10.10.10.0/24 except;
0.0.0.0/0;
}
destination-address {
10.10.10.22/32;
10.10.10.77/32;
}
}
then {
count TEST-TERM;
discard;
}
}
term other {
then accept;
}
}
}
I mean once you associate firewall filter with an interface you need to do this under specific family anyway:
root# set interfaces fxp0 unit 0 fi?
No valid completions
[edit]
root# set interfaces fxp0 unit 0 family inet filter ?
Possible completions:
+ apply-groups Groups from which to inherit configuration data
+ apply-groups-except Don't inherit configuration data from these groups
group Group to which interface belongs (0..255)
> input Filter to be applied to received packets
+ input-list List of filter modules applied to received packets
> output Filter to be applied to transmitted packets
+ output-list List of filter modules applied to transmitted packets
[edit]
root# set interfaces fxp0 unit 0 family inet filter
Or are there situations when "firewall family inet filter" becomes necessary?
