firewall.j2

<firewall>
  <family>
    <inet>
      <filter operation="replace">
        <name>RE-Protect</name>
        <term>
          <name>SSH</name>
          <from>
            <source-prefix-list>
              <name>DynInc</name>
            </source-prefix-list>
            <protocol>tcp</protocol>
            <port>ssh</port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>NETCONF</name>
          <from>
            <source-prefix-list>
              <name>DynInc</name>
            </source-prefix-list>
            <protocol>tcp</protocol>
            <destination-port>830</destination-port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>BGP</name>
          <from>
            <source-prefix-list>
              <name>BGP-Peers</name>
            </source-prefix-list>
            <protocol>tcp</protocol>
            <port>bgp</port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>DNS</name>
          <from>
            <source-prefix-list>
              <name>DNS-Servers</name>
            </source-prefix-list>
            <protocol>udp</protocol>
            <protocol>tcp</protocol>
            <port>domain</port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>ICMP</name>
          <from>
            <protocol>icmp</protocol>
            <icmp-type>echo-request</icmp-type>
            <icmp-type>echo-reply</icmp-type>
            <icmp-type>unreachable</icmp-type>
            <icmp-type>time-exceeded</icmp-type>
            <icmp-type>source-quench</icmp-type>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>Traceroute</name>
          <from>
            <protocol>udp</protocol>
            <destination-port>33434-33523</destination-port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>SNMP</name>
          <from>
            <source-prefix-list>
              <name>SNMP-Global-Mgrs</name>
            </source-prefix-list>
            <source-prefix-list>
              <name>SNMP-Local-Mgrs</name>
            </source-prefix-list>
            <protocol>udp</protocol>
            <port>snmp</port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>GRE</name>
          <from>
            <source-prefix-list>
              <name>GRE-Tunnel-Peers</name>
            </source-prefix-list>
            <protocol>gre</protocol>
          </from>
          <then>
            <accept/>
          </then> 
        </term>
        <term>
          <name>BFD</name>
          <from>
            <source-prefix-list>
              <name>BFD-Static-Neighbors</name>
            </source-prefix-list>
            <protocol>udp</protocol>
            <destination-port>3784</destination-port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>NTP</name>
          <from>
            <source-prefix-list>
              <name>Loopback-IPs</name>
            </source-prefix-list>
            <source-prefix-list>
              <name>NTP-Servers</name>
            </source-prefix-list>
            <protocol>udp</protocol>
            <port>ntp</port>
          </from>
          <then>
            <accept/>
          </then>
        </term>
        <term>
          <name>VRRP</name>
          <from>
            <destination-address>
              <name>224.0.0.18/32</name>
            </destination-address>
          </from>
          <then>
            <accept/>
          </then>
        </term>
{% if allow_ospf_to_re is defined and allow_ospf_to_re %}
        <term>
          <name>OSPF</name>
          <from>
            <protocol>ospf</protocol>
          </from>
          <then>
            <accept/>
          </then>
	</term>
{% endif %}
        <term>
          <name>Discard</name>
          <then>
            <count>RE-Protect-DISCARD</count>
            <discard>
            </discard>
          </then>
        </term>
      </filter>
    </inet>
    <inet6>
      <filter operation="replace">
        <name>v6-RE-Protect</name>
        <term>
          <name>BGP</name>
          <from>
            <source-prefix-list>
              <name>v6-BGP-Peers</name>
            </source-prefix-list>
            <next-header>tcp</next-header>
            <port>bgp</port>
          </from>
          <then>
            <count>v6-RE-Protect-BGP</count>
            <accept/>
          </then>
	</term>
        <term>
          <name>ICMPv6</name>
          <from>
            <next-header>icmpv6</next-header>
          </from>
          <then>
            <count>v6-RE-Protect-ICMPv6</count>
            <accept/>
          </then>
	</term>
        <term>
          <name>TRACEROUTE</name>
          <from>
            <next-header>udp</next-header>
            <destination-port>33434-33523</destination-port>
          </from> 
          <then>
            <accept/>
          </then>
	</term>
        <term>
          <name>BFD</name>
          <from>
            <source-prefix-list>
              <name>v6-BFD-Static-Neighbors</name>
            </source-prefix-list>
            <next-header>udp</next-header>
            <destination-port>3784</destination-port>
          </from>
          <then>
            <accept/>
          </then>
	</term>
        <term>
          <name>VRRP</name>
          <from>
            <destination-address>
              <name>ff02::12/128</name>
	    </destination-address>
	  </from>
          <then>
            <accept/>
          </then>
	</term>
{% if allow_ospf_to_re is defined and allow_ospf_to_re %}
        <term>
          <name>OSPF</name>
          <from>
            <source-address>
              <name>FE80::/10</name>
	    </source-address>
            <next-header>ospf</next-header>
          </from>
          <then>
            <accept/>
          </then>
	</term>
{% endif %}
        <term>
          <name>Discard</name>
          <then>
            <count>v6-RE-Protect-DISCARD</count>
            <discard>
            </discard>
          </then>
        </term>
      </filter>
      </inet6>
  </family>
</firewall>