nerdexam
Juniper

JN0-102 · Question #308

user@router> show configuration firewall familyinet { filter demo { term example { from { source-address { 100.100.100.0/24; } destination-address { 200.200.200.0/24; } } then { reject; } } term testi

The correct answer is C. The traffic will be forwarded.. Traffic from 10.10.10.25 destined to 200.200.200.1 will be forwarded because it matches term results, which accepts traffic destined for the 200.200.200.0/24 network after failing to match prior terms.

Routing Policy and Firewall Filters

Question

user@router> show configuration firewall familyinet { filter demo { term example { from { source-address { 100.100.100.0/24; } destination-address { 200.200.200.0/24; } } then { reject; } } term testing { from { source-address { 10.10.10.0/28; } destination-address { 200.200.200.0/24; } } then sample; } term results { from { address { 200.200.200.0/24; } } then accept; } term final { thenpolicer LAPD; } } } Given the configuration shown in the exhibit, what will happen to traffic from source 10.10.10.25 destined to 200.200.200.1?

Options

  • AThe traffic will be rejected.
  • BThe traffic will be dropped.
  • CThe traffic will be forwarded.
  • DThe traffic will be policed.

How the community answered

(41 responses)
  • A
    12% (5)
  • B
    7% (3)
  • C
    76% (31)
  • D
    5% (2)

Why each option

Traffic from 10.10.10.25 destined to 200.200.200.1 will be forwarded because it matches `term results`, which accepts traffic destined for the `200.200.200.0/24` network after failing to match prior terms.

AThe traffic will be rejected.

Traffic is not rejected because `term example`, which rejects traffic, does not match the source IP address 10.10.10.25.

BThe traffic will be dropped.

Traffic is not dropped (which is an implicit discard) because a later term, `term results`, explicitly accepts it before the final `then policer LAPD` or implicit discard would apply.

CThe traffic will be forwarded.Correct

The firewall filter processes terms in order. `term example` does not match the source IP. `term testing` does not match the source IP (10.10.10.25 is not in 10.10.10.0/28). `term results` has an `address 200.200.200.0/24` match condition, which the destination IP 200.200.200.1 satisfies, and its `then` action is `accept`, causing the traffic to be forwarded.

DThe traffic will be policed.

`term testing` does not match the source IP, and `term results` accepts the traffic before `term final` (which applies a policer) can be reached.

Concept tested: Firewall filter term evaluation order

Source: https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/topic-map-firewall-filter-overview.html

Topics

#firewall filters#packet processing#sampling

Community Discussion

No community discussion yet for this question.

Full JN0-102 Practice