JN0-102 · Question #308
user@router> show configuration firewall familyinet { filter demo { term example { from { source-address { 100.100.100.0/24; } destination-address { 200.200.200.0/24; } } then { reject; } } term testi
The correct answer is C. The traffic will be forwarded.. Traffic from 10.10.10.25 destined to 200.200.200.1 will be forwarded because it matches term results, which accepts traffic destined for the 200.200.200.0/24 network after failing to match prior terms.
Question
user@router> show configuration firewall familyinet { filter demo { term example { from { source-address { 100.100.100.0/24; } destination-address { 200.200.200.0/24; } } then { reject; } } term testing { from { source-address { 10.10.10.0/28; } destination-address { 200.200.200.0/24; } } then sample; } term results { from { address { 200.200.200.0/24; } } then accept; } term final { thenpolicer LAPD; } } } Given the configuration shown in the exhibit, what will happen to traffic from source 10.10.10.25 destined to 200.200.200.1?
Options
- AThe traffic will be rejected.
- BThe traffic will be dropped.
- CThe traffic will be forwarded.
- DThe traffic will be policed.
How the community answered
(41 responses)- A12% (5)
- B7% (3)
- C76% (31)
- D5% (2)
Why each option
Traffic from 10.10.10.25 destined to 200.200.200.1 will be forwarded because it matches `term results`, which accepts traffic destined for the `200.200.200.0/24` network after failing to match prior terms.
Traffic is not rejected because `term example`, which rejects traffic, does not match the source IP address 10.10.10.25.
Traffic is not dropped (which is an implicit discard) because a later term, `term results`, explicitly accepts it before the final `then policer LAPD` or implicit discard would apply.
The firewall filter processes terms in order. `term example` does not match the source IP. `term testing` does not match the source IP (10.10.10.25 is not in 10.10.10.0/28). `term results` has an `address 200.200.200.0/24` match condition, which the destination IP 200.200.200.1 satisfies, and its `then` action is `accept`, causing the traffic to be forwarded.
`term testing` does not match the source IP, and `term results` accepts the traffic before `term final` (which applies a policer) can be reached.
Concept tested: Firewall filter term evaluation order
Source: https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/topic-map-firewall-filter-overview.html
Topics
Community Discussion
No community discussion yet for this question.