Routing, Policy, and Firewall Filters
This domain tests routing and security controls on Junos data center devices: route preference, BGP/OSPF behavior, routing policy, and stateless firewall filters that protect the Routing Engine and filter traffic.
Routing and policy
Junos prefers lower route preference values: direct/local 0, static 5, OSPF internal 10, OSPF external 150, BGP 170. BGP path selection uses local preference, AS path length, origin, MED, and other tie-breakers. A policy statement contains terms evaluated top to bottom; each term has from/match conditions and then actions such as accept, reject, or next term. Routing policy can set attributes, filter routes, or manipulate local preference.
Firewall filters
Firewall filters are stateless and have an implicit discard if no term matches. Terms are evaluated in order; the first match wins. Use family inet for IPv4, match on protocol, source/destination address, port, or TCP flags, and apply the filter with an input/output keyword on an interface.
Worked example
Protect the loopback while allowing management and BGP: set firewall family inet filter PROTECT term SSH from protocol tcp destination-port ssh set firewall family inet filter PROTECT term SSH then accept set firewall family inet filter PROTECT term BGP from protocol tcp destination-port bgp set firewall family inet filter PROTECT term BGP then accept set firewall family inet filter PROTECT term DENY then discard set interfaces lo0 unit 0 family inet filter input PROTECT
The SSH and BGP terms are checked first; all other loopback traffic hits DENY and is discarded. Because filters are stateless, return traffic needs its own evaluation on the other direction or interface.
Traps
A filter with no explicit accept/discard term ends in implicit discard. Placing a broad discard term before specific permits blocks the permits. Applying the filter in the wrong direction has no effect. Policy term order also matters: a catch-all reject placed first prevents later terms from matching.