Re: Firewall filter to restrict traffic for one interface

Hi,

The default action if no action is explicitly stated in a term of the filter is accept.

"If the packet matches all the conditions, and no action is specified in the then statement, the default action accept is taken."

http://www.juniper.net/documentation/en_US/junos15.1/topics/concept/firewall-filter-ex-series-evaluation-understanding.html

Can you share what is connected to ge-0/0/5. Is it the NAS?

If yes, it might be that the firewall filter is configured in the opposite direction of the traffic. You could have 2 options if that is the case:

1.  Apply the firewall filter in output direction

filter {
output filter-name;
}

I believe with EX switches, filters can be applied in only 1 direction at a time.

2. Change the matching condition to destination-address instead of source-address:

from {
destination-address {
192.168.1.66/32;
      }
    }

To be explicit with the firewall filter config, I would suggest adding the accept terminating action and 'count'. The count will enable you to see whether packets have matched this term.

Cheers,
Ashvin