Firewall filters: Flexible match conditions

Junos OS supports flexible match conditions under family ethernet-switching for firewall filters. Standard firewall filter match conditions vary based on the protocol family of the traffic being matched. The fields available for matching within each protocol family are fixed or predefined. This means that filters can match on patterns within those predefined fields only. Using flexible match conditions, you can construct flexible match filter terms that start the match at Layer 2, Layer 3, Layer 4, or payload locations. You can enable further pattern matches at user-defined custom locations within a packet by specifying additional offset criteria. Flexible match filter terms are applied to interfaces as either input or output filters just as any other firewall filter terms. Flexible match filter terms can also be created as templates at the [edit firewall] hierarchy level. These templates can then be referenced within a flexible match term.