[j-nsp] RE: firewall filter to allow ospf to RE [9:2144]

Hasanga Hendehewa (EPA) Hasanga.Hendehewa@ericsson.com.au
Wed, 2 Oct 2002 22:17:08 +1000


This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C26A0D.A10DF200
Content-Type: text/plain

Hi,

Thanks. Works like a charm.
//Hasanga

>-----Original Message-----
>From: Scott F. Robohn [mailto:scott@robohn.com]
>Sent: Wednesday, 2 October 2002 9:51 PM
>To: Hasanga Hendehewa (EPA)
>Cc: juniper@groupstudy.com
>Subject: Re: firewall filter to allow ospf to RE [9:2144]
>
>
>"from protocol ospf" should be sufficient:
>
>term ospf {
>    from protocol ospf;
>    then accept;
>}
>
>The "from source-address 0/0" match condition may actually be trying to
>match on that as an actual source address.
>
>HTH,
>Scott
>
>"Hasanga Hendehewa (EPA)" wrote:
>> 
>> Hi,
>> I am trying to allow ospf in a firewall filter to be applied 
>to protect the
>> RE. I am having trouble with the setup. I have tried all 
>options stated
>> below, but as soon as I apply any of these to lo0 and clear the OSPF
>> neighbor sessions, the node fails to re-establish the OSPF 
>relationships.
>> What am I doing wrong here?
>> 
>> Option#1
>>         term ospf {
>>             from {
>>                 source-address {
>>                     0.0.0.0/0;
>>                 }
>>                 destination-address {
>>                     224.0.0.5/32;
>>                 }
>>                 protocol ospf;
>>             }
>>             then accept;
>> 
>> Option#2
>>         term ospf {
>>             from {
>>                 source-address {
>>                     0.0.0.0/0;
>>                 }
>> /* interface address towards the neighbor */
>>                 destination-address {
>>                     xxx.xxx.xxx.xxx/xx;
>>                 }
>>                 protocol ospf;
>>             }
>>             then {
>>                 accept;
>>             }
>> 
>> Option#3
>>         term ospf {
>>             from {
>>                 source-address {
>>                     0.0.0.0/0;
>>                 }
>>                 protocol ospf;
>>             }
>>             then {
>>                 accept;
>>             }
>> 
>> Message Posted at:
>> http://www.groupstudy.com/form/read.php?f=9&i=2144&t=2144
>> --------------------------------------------------
>> FAQ, list archives, and subscription info: 
http://www.groupstudy.com/list/juniper.html

------_=_NextPart_001_01C26A0D.A10DF200
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3DUS-ASCII">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2654.19">
<TITLE>RE: firewall filter to allow ospf to RE [9:2144]</TITLE>
</HEAD>
<BODY>

<P><FONT SIZE=3D2>Hi,</FONT>
</P>

<P><FONT SIZE=3D2>Thanks. Works like a charm.</FONT>
<BR><FONT SIZE=3D2>//Hasanga</FONT>
</P>

<P><FONT SIZE=3D2>&gt;-----Original Message-----</FONT>
<BR><FONT SIZE=3D2>&gt;From: Scott F. Robohn [<A =
HREF=3D"mailto:scott@robohn.com">mailto:scott@robohn.com</A>]</FONT>
<BR><FONT SIZE=3D2>&gt;Sent: Wednesday, 2 October 2002 9:51 PM</FONT>
<BR><FONT SIZE=3D2>&gt;To: Hasanga Hendehewa (EPA)</FONT>
<BR><FONT SIZE=3D2>&gt;Cc: juniper@groupstudy.com</FONT>
<BR><FONT SIZE=3D2>&gt;Subject: Re: firewall filter to allow ospf to RE =
[9:2144]</FONT>
<BR><FONT SIZE=3D2>&gt;</FONT>
<BR><FONT SIZE=3D2>&gt;</FONT>
<BR><FONT SIZE=3D2>&gt;&quot;from protocol ospf&quot; should be =
sufficient:</FONT>
<BR><FONT SIZE=3D2>&gt;</FONT>
<BR><FONT SIZE=3D2>&gt;term ospf {</FONT>
<BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp; from protocol ospf;</FONT>
<BR><FONT SIZE=3D2>&gt;&nbsp;&nbsp;&nbsp; then accept;</FONT>
<BR><FONT SIZE=3D2>&gt;}</FONT>
<BR><FONT SIZE=3D2>&gt;</FONT>
<BR><FONT SIZE=3D2>&gt;The &quot;from source-address 0/0&quot; match =
condition may actually be trying to</FONT>
<BR><FONT SIZE=3D2>&gt;match on that as an actual source =
address.</FONT>
<BR><FONT SIZE=3D2>&gt;</FONT>
<BR><FONT SIZE=3D2>&gt;HTH,</FONT>
<BR><FONT SIZE=3D2>&gt;Scott</FONT>
<BR><FONT SIZE=3D2>&gt;</FONT>
<BR><FONT SIZE=3D2>&gt;&quot;Hasanga Hendehewa (EPA)&quot; =
wrote:</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; </FONT>
<BR><FONT SIZE=3D2>&gt;&gt; Hi,</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; I am trying to allow ospf in a firewall =
filter to be applied </FONT>
<BR><FONT SIZE=3D2>&gt;to protect the</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; RE. I am having trouble with the setup. I =
have tried all </FONT>
<BR><FONT SIZE=3D2>&gt;options stated</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; below, but as soon as I apply any of these =
to lo0 and clear the OSPF</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; neighbor sessions, the node fails to =
re-establish the OSPF </FONT>
<BR><FONT SIZE=3D2>&gt;relationships.</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; What am I doing wrong here?</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; </FONT>
<BR><FONT SIZE=3D2>&gt;&gt; Option#1</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; term =
ospf {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; from {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source-address {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0.0.0.0/0;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; destination-address {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
224.0.0.5/32;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; protocol ospf;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; then accept;</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; </FONT>
<BR><FONT SIZE=3D2>&gt;&gt; Option#2</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; term =
ospf {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; from {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source-address {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0.0.0.0/0;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; /* interface address towards the neighbor =
*/</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; destination-address {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
xxx.xxx.xxx.xxx/xx;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; protocol ospf;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; then {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; accept;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; </FONT>
<BR><FONT SIZE=3D2>&gt;&gt; Option#3</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; term =
ospf {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; from {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; source-address {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
0.0.0.0/0;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; protocol ospf;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; then {</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; accept;</FONT>
<BR><FONT =
SIZE=3D2>&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; </FONT>
<BR><FONT SIZE=3D2>&gt;&gt; Message Posted at:</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; <A =
HREF=3D"http://www.groupstudy.com/form/read.php?f=3D9&i=3D2144&t=3D2144"=
 =
TARGET=3D"_blank">http://www.groupstudy.com/form/read.php?f=3D9&i=3D2144=
&t=3D2144</A></FONT>
<BR><FONT SIZE=3D2>&gt;&gt; =
--------------------------------------------------</FONT>
<BR><FONT SIZE=3D2>&gt;&gt; FAQ, list archives, and subscription info: =
</FONT>
<BR><FONT SIZE=3D2><A =
HREF=3D"http://www.groupstudy.com/list/juniper.html" =
TARGET=3D"_blank">http://www.groupstudy.com/list/juniper.html</A></FONT>=

</P>

</BODY>
</HTML>
------_=_NextPart_001_01C26A0D.A10DF200--