Training and Certification

All,

How does one get a license for L2 and L3 filters for the free vJunos Router/Switch/Evolved?  While practicing for my JNCIA exam, I am learning the ins and outs of Filtering (compared to how I configure ACLs in Cisco) and encountered this output/error.  I got the impression that these images from Juniper were free to use in labs in emulators like GNS3, EvE-NG, or CML.

root@ROUTER_1# set interfaces ge-0/0/5 unit 0 filter input FILTER_FROM_ROUTER_2    

[edit]
root@ROUTER_1# commit 
[edit interfaces ge-0/0/5 unit 0 filter]
  'input'
    warning: requires 'L2 and L3 Filters' license
[edit interfaces ge-0/0/5 unit 0 filter]
  'input'
    Referenced input filter 'FILTER_FROM_ROUTER_2' not defined
error: Failed to read config
commit-check failed
  commit-check failed
error: configuration check-out failed

[edit]
root@ROUTER_1# 

Any help or advice would be greatly appreciated, especially if I am overlooking something I need to configure to active filters for labs only.  Like a license command or something along those lines??  Thanks.

Hello Tom,

No need to worry about the license warning. All should work fine as soon as you correctly define filter 'FILTER_FROM_ROUTER_2'

Regards,
Wojciech

Hi Wojciech,

I am not sure what the character length of a "term" is in JunOS "set firewall..." commands, but I shortened the last term "ACCEPT_ALL_ELSE_FROM_ROUTER_2" to just "ACCEPT_ALL_ELSE" and left everything the same.  It is now working as expected as you can see below. 

WAS: set firewall family inet filter FILTER_FROM_ROUTER_2 term ACCEPT_ALL_ELSE_FROM_ROUTER_2 then accept

NOW: set firewall family inet filter FILTER_FROM_ROUTER_2 term ACCEPT_ALL_ELSE then accept

root@ROUTER_1# commit and-quit 
[edit interfaces ge-0/0/5 unit 0 family inet filter]
  'input'
    warning: requires 'L2 and L3 Filters' license
commit complete
Exiting configuration mode

root@ROUTER_1>

root@ROUTER_1> show configuration | display set | match ge-0/0/5 
set interfaces ge-0/0/5 description "Connect to ROUTER_2, port Ge-0/0/5"
set interfaces ge-0/0/5 unit 0 family inet filter input FILTER_FROM_ROUTER_2
set interfaces ge-0/0/5 unit 0 family inet address 10.1.2.1/24
set interfaces ge-0/0/5 unit 0 family inet6 address 2001:db8:1:2::1/64
set protocols ospf area 0.0.0.0 interface ge-0/0/5.0
set protocols ospf3 area 0.0.0.0 interface ge-0/0/5.0
set protocols lldp interface ge-0/0/5

Tested the filter:

Corporate_LAN:~$ ping 172.16.40.1 -c 10
PING 172.16.40.1 (172.16.40.1): 56 data bytes

--- 172.16.40.1 ping statistics ---
10 packets transmitted, 0 packets received, 100% packet loss

root@ROUTER_1> show firewall counter COUNTER filter FILTER_FROM_ROUTER_2    

Filter: FILTER_FROM_ROUTER_2                                 
Counters:
Name                                                                            Bytes              Packets
COUNTER                                                                           840                   10

I still get the warning about the licenses but as you said it will work just fine and it does now after changing that term length.  Thanks for the tip to check on the "correctly define filter 'FILTER_FROM_ROUTER_2'".  Much appreciated sir!