Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 3103 / 3946

•
Example: Using Filter-Based Forwarding to Route Application Traffic to a Security
Device on EX Series Switches on page 3058
Understanding Firewall Filter Processing Points for Bridged and Routed Packets on
EX Series Switches
Juniper Networks EX Series Ethernet Switches are multilayered switches that provide
Layer 2 switching and Layer 3 routing. You apply firewall filters at multiple processing
points in the packet forwarding path on EX Series switches. At each processing point,
the action to be taken on a packet is determined based on the results of the lookup in
the switch's forwarding table. A table lookup determines which exit port on the switch
to use to forward the packet.
For both bridged unicast packets and routed unicast packets, firewall filters are evaluated
and applied hierarchically. First, a packet is checked against the port firewall filter, if
present. If the packet is permitted, it is then checked against the VLAN firewall filter, if
present. If the packet is permitted, it is then checked against the router firewall filter, if
present. The packet must be permitted by the router firewall filter before it is processed.
Figure 76 on page 3007 shows the various firewall filter processing points in the packet
forwarding path in a multilayered switching platform.
Figure 76: Firewall Filter Processing Points in the Packet Forwarding Path
3007 Copyright © 2010, Juniper Networks, Inc.
Chapter 100: Firewall Filters—Overview