Table 20: Firewall Filter Match Conditions for Layer 2 CCC Traffic (continued)

Description Match Condition

(MX Series routers and EX Series switches only) Match the destination media access control (MAC) address of a virtual private LAN service (VPLS) packet.

To have packets correctly evaluated by this match condition when applied to egress traffic flowing over a CCC circuit from a logical interface on an I-chip DPC in a Layer 2 virtual private network (VPN) routing instance, you must make a configuration change to the Layer 2 VPN routing instance.

You must explicitly disable the use of a control word for traffic flowing out over a Layer 2 circuit.

The use of a control word is enabled by default for Layer 2 VPN routing instances to support the emulated virtual circuit (VC) encapsulation for Layer 2 circuits.

To explicitly disable the use of a control word for Layer 2 VPNs, include theno-control-word statement at either of the following hierarchy levels:

• [edit routing-instances routing-instance-name protocols l2vpn]

• [edit logical-systems logical-system-name routing-instances routing-instance-name protocols l2vpn]

NOTE: This match condition is not supported on PTX series packet transport routers.

For more information, see Disabling the Control Word for Layer 2 VPNs.

destination-mac-address address

Length of the data to be matched in bits, not needed for string input (0..128)

bit-length flexible-match-maskvalue

Bit offset after the (match-start + byte) offset (0..7)

bit-offset

Byte offset after the match start point byte-offset

Select a flexible match from predefined template field

flexible-mask-name

Mask out bits in the packet data to be matched mask-in-hex

Start point to match in packet match-start

Value data/string to be matched prefix

See <concept topic> for details

Table 20: Firewall Filter Match Conditions for Layer 2 CCC Traffic (continued)

Description Match Condition

Length of the data to be matched in bits (0..32) bit-length

flexible-match-rangevalue

Bit offset after the (match-start + byte) offset (0..7)

bit-offset

Byte offset after the match start point byte-offset

Select a flexible match from predefined template field

flexible-range-name

Start point to match in packet match-start

Range of values to be matched range

Do not match this range of values range-except

See <concept topic> for details

Forwarding class. Specifyassured-forwarding,best-effort,expedited-forwarding, ornetwork-control. forwarding-class class

Do not match on the forwarding class. Specifyassured-forwarding,best-effort, expedited-forwarding, ornetwork-control.

forwarding-class-except class

Match the logical interface on which the packet was received to the specified interface group or set of interface groups. Forgroup-number, specify a single value or a range of values from0through 255.

To assign a logical interface to an interface groupgroup-number, specify thegroup-numberat the [interfaces interface-name unit number family family filter group]hierarchy level.

NOTE: This match condition is not supported on PTX series packet transport routers.

For more information, see“Filtering Packets Received on a Set of Interface Groups Overview” on page 262.

interface-group group-number

Do not match the logical interface on which the packet was received to the specified interface group or set of interface groups. For details, see theinterface-groupmatch condition.

NOTE: This match condition is not supported on PTX series packet transport routers.

interface-group-except number

(MX Series routers, M320 router, and EX Series switches only) Match on the IEEE 802.1p learned VLAN priority bits in the provider VLAN tag (the only tag in a single-tag frame with 802.1Q VLAN tags or the outer tag in a dual-tag frame with 802.1Q VLAN tags). Specify a single value or multiple values from0through7.

Compare with theuser-vlan-1p-prioritymatch condition.

NOTE: This match condition is not supported on PTX series packet transport routers.

NOTE: This match condition supports the presence of a control word for MX Series and M320 routers.

learn-vlan-1p-priority number

Chapter 2: Firewall Filter Match Conditions and Actions

Table 20: Firewall Filter Match Conditions for Layer 2 CCC Traffic (continued)

Description Match Condition

(MX Series routers, M320 router, and EX Series switches only) Do not match on the IEEE 802.1p learned VLAN priority bits. For details, see thelearn-vlan-1p-prioritymatch condition.

NOTE: This match condition is not supported on PTX series packet transport routers.

NOTE: This match condition supports the presence of a control word for MX Series and M320 routers.

learn-vlan-1p-priority-except number

Packet loss priority (PLP) level. Specify a single level or multiple levels:low,medium-low, medium-high, orhigh.

Supported on M120 and M320 routers; M7i and M10i routers with the Enhanced CFEB (CFEB-E);

and MX Series routers and EX Series switches.

For IP traffic on M320, MX Series, and T Series routers with Enhanced II Flexible PIC Concentrators (FPCs), and EX Series switches, you must include thetri-colorstatement at the[edit

class-of-service]hierarchy level to commit a PLP configuration with any of the four levels specified.

If thetri-colorstatement is not enabled, you can only configure thehighandlowlevels. This applies to all protocol families.

For information about thetri-colorstatement, see Configuring Tricolor Marking. For information about using behavior aggregate (BA) classifiers to set the PLP level of incoming packets, see Forwarding Classes Overview.

loss-priority level

Do not match on the packet loss priority level. Specify a single level or multiple levels:low, medium-low,medium-high, orhigh.

NOTE: This match condition is not supported on PTX series packet transport routers.

For information about using behavior aggregate (BA) classifiers to set the PLP level of incoming packets, see Understanding How Behavior Aggregate Classifiers Prioritize Trusted Traffic.

loss-priority-except level

(MX Series routers, M320 router, and EX Series switches only) Match on the IEEE 802.1p user priority bits in the customer VLAN tag (the inner tag in a dual-tag frame with 802.1Q VLAN tags).

Specify a single value or multiple values from0through7. Compare with thelearn-vlan-1p-prioritymatch condition.

NOTE: This match condition is not supported on PTX series packet transport routers.

NOTE: This match condition supports the presence of a control word for MX Series and M320 routers.

user-vlan-1p-priority number

(MX Series routers, M320 router, and EX Series switches only) Do not match on the IEEE 802.1p user priority bits. For details, see theuser-vlan-1p-prioritymatch condition.

NOTE: This match condition is not supported on PTX series packet transport routers.

NOTE: This match condition supports the presence of a control word for MX Series and M320 routers.

user-vlan-1p-priority-except number