On Tue, Sep 13, 2016 at 08:35:26PM +0900, Paul S. wrote: > Hi j-nsp, > > I'm trying to use DCU to filter access to specific prefixes selectively > on Juniper MX. i.e: Customer on interface ge-0/0/0 cannot send traffic > to prefixes tagged by some BGP community, or perhaps it'll be sent to a > policer. [...] > So, is there any other way to apply this only on the concerned customer > interfaces, or are we going to have to maintain a large > forwarding-options filter with entries like 'term 1 from > destination-class dcu-local; interface x; then ...' and 'term 2 from > destination-class dcu-local; interface y' ...'
You can group customer interfaces using interface-set, e.g. set firewall interface-set customer-local ge-0/0/0.0 set firewall interface-set customer-local ge-0/0/1.0 and then use that interface set together with DCU in pfe filter, term cust-local from destination-class dcu-local interface-set customer-local Not as nice as having DCU in ingress filter, but still much better than one term per interface. _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
