nerdexam
Juniper

JN0-102 · Question #391

Click the Exhibit button. You asked to create a firewall filter to count IPv6 packets that arrive with a no next header value. As shown in the exhibit, you have created and applied the count-no-header

The correct answer is D. The firewall family is not correct.. The commit operation failed when trying to apply a firewall filter for IPv6 packets with no next header, because the firewall filter was configured with the incorrect family type for IPv6 traffic.

Routing Policy and Firewall Filters

Question

Click the Exhibit button. You asked to create a firewall filter to count IPv6 packets that arrive with a no next header value. As shown in the exhibit, you have created and applied the count-no-header firewall filter to the ge-0/0/0 interface. The commit operation fails. What is causing this problem?

Options

  • AIPv6 interfaces do not support firewall filters.
  • BThe filter name must be different than the counter name.
  • CThe firewall term does not include inet6 in the from statement.
  • DThe firewall family is not correct.

How the community answered

(55 responses)
  • A
    4% (2)
  • B
    11% (6)
  • C
    4% (2)
  • D
    82% (45)

Why each option

The commit operation failed when trying to apply a firewall filter for IPv6 packets with no next header, because the firewall filter was configured with the incorrect family type for IPv6 traffic.

AIPv6 interfaces do not support firewall filters.

IPv6 interfaces fully support firewall filters; the issue is not a lack of support but a configuration error within the filter itself.

BThe filter name must be different than the counter name.

The relationship between filter name and counter name is not the cause of a commit failure related to an incorrect family for IPv6 filtering.

CThe firewall term does not include inet6 in the from statement.

While `inet6` within a `from` statement is valid, the primary issue causing a commit failure for IPv6-specific match conditions is typically the overarching `family` configuration for the entire filter, rather than a single term's `from` statement.

DThe firewall family is not correct.Correct

For firewall filters designed to process IPv6 traffic, the filter must be explicitly configured under the `family inet6` stanza. If the filter is created under `family inet` (for IPv4) but attempts to use IPv6-specific match conditions like `next-header none`, the commit operation will fail due to a fundamental mismatch in the protocol family.

Concept tested: Junos firewall filter family for IPv6

Source: https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/topic-map-firewall-filters-config.html

Topics

#firewall filters#IPv6#configuration errors#family inet6

Community Discussion

No community discussion yet for this question.

Full JN0-102 Practice