Hi Rushi
Thank you for replying
I tried create the term allow_srv01_source above term Deny_Access as you suggest with:
source-port [ 22 80 ] and destination-address 172.16.100.10/32
but it doesn't match, after I tried like below but it also doesn't match
source-port [ 22 80 ] and source-address 172.16.100.10/32
Counters:
Name Bytes Packets
Deny_Access 29052 286
allow_srv01 12495 100
allow_srv01_source 0 0
I also tried put the same filter on the interfaces like:
ge-0/0/0/23 - input - outside interface
L3 VLAN - output
So this way the traffic forward should match from both direction: destination and source packets, but no way
I'm also allowing the tcp-established connections above the term Deny_Access
Follow the firewall filter config
set firewall family inet filter eveo_in term allow_srv01 from source-address 0.0.0.0/0
set firewall family inet filter eveo_in term allow_srv01 from destination-address 172.16.100.10/32
set firewall family inet filter eveo_in term allow_srv01 from protocol icmp
set firewall family inet filter eveo_in term allow_srv01 from protocol tcp
set firewall family inet filter eveo_in term allow_srv01 from destination-port 22
set firewall family inet filter eveo_in term allow_srv01 from destination-port 80
set firewall family inet filter eveo_in term allow_srv01 then count allow_srv01
set firewall family inet filter eveo_in term allow_srv01 then accept
set firewall family inet filter eveo_in term allow_tcp_established from protocol tcp
set firewall family inet filter eveo_in term allow_tcp_established from tcp-established
set firewall family inet filter eveo_in term allow_tcp_established then count allow_tcp_established
set firewall family inet filter eveo_in term allow_tcp_established then accept
set firewall family inet filter eveo_in term Deny_Access from source-address 0.0.0.0/0
set firewall family inet filter eveo_in term Deny_Access from destination-address 172.16.100.10/32
set firewall family inet filter eveo_in term Deny_Access then count Deny_Access
set firewall family inet filter eveo_in term Deny_Access then discard
set firewall family inet filter eveo_in term Default then accept
Thank you