Firewall filters: Micro segmentation on VLANs and VXLANs

You can configure egress filters with Layer 2 and Layer 3 match conditions in both VLAN and VXLAN deployments. Junos OS already supports filtering in Layer 2 match conditions in the ingress direction. To use egress filters for micro segmentation in a VXLAN, enable the epacl-firewall-optimization statement at the [edit chassis] level of the hierarchy and create the firewall rules with the match conditions that you want to filter on. For egress filtering on VLANs, you do not need to enable epaclfirewall-optimization. Both the devices support egress filtering, for VLANs and VXLANs, with the following match conditions: 

• ip-source-address 
• ip-destination-address 
• destination-port 
• destination-mac-address 
• user-vlan-id 
• ip-protocol 
• source-mac-address 

Valid actions for these rules are accept, count, and discard.