Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 3136 / 3946

•
One Juniper Networks EX-UM-4SFP uplink module
• One Juniper Networks J-series router
Before you configure and apply the firewall filters in this example, be sure you have:
• An understanding of firewall filter concepts, policers, and CoS
• Installed the uplink module in the distribution switch. See Installing an Uplink Module
in an EX3200 or EX4200 Switch.
Overview
This configuration example show how to configure and apply firewall filters to provide
rules to evaluate the contents of packets and determine when to discard, forward, classify,
count, and analyze packets that are destined for or originating from the EX Series switches
that handle all
voice-vlan
,
employee-vlan
, and
guest-vlan
traffic. Table 384 on page 3040
shows the firewall filters that are configured for the EX Series switches in this example.
Table 384: Configuration Components: Firewall Filters
Purpose/Description Component
This firewall filter performs two functions:
• Assigns priority queueing to packets with a source MAC address that matches the
phone MAC addresses. The forwarding class
expedited-forwarding
provides low
loss, low delay, low jitter, assured bandwidth, and end-to-end service for all
voice-vlan traffic.
• Performs rate limiting on packets that enter the ports for
employee-vlan
. The traffic
rate for TCP and ICMP packets is limited to 1 Mbps with a burst size up to 30,000
bytes.
This firewall filter is applied to port interfaces on the access switch.
Port firewall filter,
ingress-port-voip-class-limit-tcp-icmp
Prevents rogue devices from using HTTP sessions to mimic the gatekeeper device
that manages call registration, admission, and call status for VoIP calls. Only TCP or
UDP ports should be used; and only the gatekeeper uses HTTP. That is, all
voice-vlan
traffic on TCP ports should be destined for the gatekeeper device. This firewall filter
applies to all phones on
voice-vlan
, including communication between any two phones
on the VLAN and all communication between the gatekeeper device and VLAN
phones.
This firewall filter is applied to VLAN interfaces on the access switch.
VLAN firewall filter,
ingress-vlan-rogue-block
Accepts
employee-vlan
traffic destined for the corporate subnet, but does not monitor
this traffic. Employee traffic destined for the Web is counted and analyzed.
This firewall filter is applied to vlan interfaces on the access switch.
VLAN firewall filter,
egress-vlan-watch-employee
Prevents guests (non-employees) from talking with employees or employee hosts
on
employee-vlan
. Also prevents guests from using peer-to-peer applications on
guest-vlan
, but allows guests to access the Web.
This firewall filter is applied to VLAN interfaces on the access switch.
VLAN firewall filter,
ingress-vlan-limit-guest
Copyright © 2010, Juniper Networks, Inc. 3040
Complete Software Guide for Junos
®
OS for EX Series Ethernet Switches, Release 10.3