> Date: Tue, 3 Apr 2007 20:21:54 -0400
> From: Richard A Steenbergen <[EMAIL PROTECTED]>
> Sender: [EMAIL PROTECTED]
>
> Ok, if this is actually documented somewhere I'll be damned if I can find
> it. When you do:
>
> interface ge-#/#/# {
> unit 0 {
> family inet {
> filter {
> input-list [ filter1 filter2 filter3 ];
> }
> }
> }
> }
>
> What is the behavior for evaluating a packet across chains? If you have an
> explicit "then accept" or "then discard" in filter1 does it end
> processing, or does it then move to the next filter? I would normally
> expect that it would behave similarly to policy chains, but since there is
> no "next filter" command I'm suspicious that it actually does something
> like fully evaluate filter1, then fully evaluate filter2, rather than
> compile it into one ruleset.
>
> The documentation says absolutely nothing about the behavior, as best as I
> can tell.If any filter in the chain reaches an explicit 'accept' or 'deny', that is the end of the processing for the entire chain. Of course, there is an implicit accept at the end of the chain. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: [EMAIL PROTECTED] Phone: +1 510 486-8634 Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751
pgpYm8hMsuTM6.pgp
Description: PGP signature
_______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
