Firewalling With Multiple Loopbacks - Revision history

Casey at 14:45, 26 May 2025

2025-05-26T14:45:09Z

2025-05-26T14:44:14Z

2025-05-26T14:43:51Z

2025-05-26T14:33:18Z

2025-05-26T14:31:03Z

2025-05-26T14:13:38Z

2025-05-26T14:13:15Z

2025-05-26T14:12:14Z

2025-05-23T21:34:42Z

2025-05-23T21:33:28Z

@@ Line 44: / Line 44: @@
                              input YOURFIREWALLNAMEHERE;
+                         }
                      family inet6 {
                          filter {
                              input YOURFIREWALLNAMEHERE-V6;
 }}}}}}}</PRE>

@@ Line 43: / Line 43: @@
                          filter {
                              input YOURFIREWALLNAMEHERE;
                      family inet6 {
                          filter {
                              input YOURFIREWALLNAMEHERE-V6;
 }}}}}}}</PRE>

← Older revision		Revision as of 14:43, 26 May 2025
Line 29:		Line 29:
	set interfaces lo0 apply-groups APPLY_FIREWALL_TO_ALL_LOOPBACKS		set interfaces lo0 apply-groups APPLY_FIREWALL_TO_ALL_LOOPBACKS
	</PRE>		</PRE>
		+
		+
		+	If you have IPv6 on your gear, you can include it in the apply group:
		+	<PRE>
		+	groups {
		+	APPLY_FIREWALL_TO_ALL_LOOPBACKS {
		+	/* This will apply the default system firewall to any loopbacks added to a VRF that don't have a filter applied.
		+	If you need to remove the firewall from one unit, use this command: apply-groups-except APPLY_FIREWALL_TO_ALL_LOOPBACKS*/
		+	interfaces {
		+	lo0 {
		+	unit <*> {
		+	family inet {
		+	filter {
		+	input YOURFIREWALLNAMEHERE;
		+	family inet6 {
		+	filter {
		+	input YOURFIREWALLNAMEHERE-V6;
		+	}}}}}}}</PRE>

@@ Line 15: / Line 15: @@
 groups {
      APPLY_FIREWALL_TO_ALL_LOOPBACKS {
-         /* If you create a loopback unit for a VRF and don't apply a filter, it won't use the default system firewall. This will apply the default system firewall.
+         /* This will apply the default system firewall to any loopbacks added to a VRF that don't have a filter applied.
          If you need to remove the firewall from one unit, use this command: apply-groups-except APPLY_FIREWALL_TO_ALL_LOOPBACKS*/
          interfaces {

@@ Line 23: / Line 23: @@
                          filter {
                              input YOURFIREWALLNAMEHERE;
 }}}}}}}</PRE>
 And apply it to your interface lo0

@@ Line 3: / Line 3: @@
 Here are the scenarios and results:
 * Interface lo0.0 is in your global table and has Filter0 applied.  Interface lo0.1 is in a VRF and has Filter1 applied.
 ** The VRF will use Filter1
 * Interface lo0.0 is in your global table and has Filter0 applied.  Interface lo0.1 is in a VRF and has no filter applied.
 ** '''The VRF will not use a filter!'''