Juniper VLAN Range in Filter: Expansion and Matching Order

When configuring firewall filters on Juniper devices, VLAN matching is a fundamental security control. Understanding how Juniper expands VLAN ranges and processes matching order is critical for both lab success and production reliability. This explainer covers the mechanics of VLAN range syntax, expansion behavior, and the order in which Juniper evaluates filter terms.

VLAN Range Syntax and Expansion

Juniper firewall filters use the vlan-range keyword to match traffic within a contiguous VLAN ID range. The syntax accepts a start and end VLAN ID, separated by a hyphen. When you specify a range, Juniper internally expands it to include every VLAN ID between the start and end values, inclusive.

set firewall filter INGRESS term ALLOW-VLANS from vlan-range 100-110

The example above expands to match VLANs 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, and 110. This is more efficient than writing eleven separate from vlan statements. You can also combine vlan-range with individual vlan statements in the same term.

set firewall filter INGRESS term MIXED-VLANS from vlan 50
set firewall filter INGRESS term MIXED-VLANS from vlan-range 100-110
set firewall filter INGRESS term MIXED-VLANS from vlan 200

In this configuration, the term matches VLAN 50, VLANs 100 through 110, and VLAN 200. Multiple from statements within a single term are evaluated as logical OR; if traffic arrives in any of these VLANs, the term condition is satisfied.

Matching Order and Filter Evaluation

Juniper processes firewall filters in top-to-bottom order. The first term that matches all of its conditions (from statements) is applied, and no further terms are evaluated. This sequential matching order is essential to understand when designing multi-term filters.

set firewall filter INGRESS term DENY-GUEST from vlan-range 1000-1010
set firewall filter INGRESS term DENY-GUEST then discard

set firewall filter INGRESS term ALLOW-PROD from vlan-range 100-110
set firewall filter INGRESS term ALLOW-PROD then accept

set firewall filter INGRESS term DEFAULT-DENY then discard

Traffic arriving in VLAN 1005 matches the first term and is discarded immediately. Traffic in VLAN 105 skips the first term, matches the second term, and is accepted. Any traffic that reaches the DEFAULT-DENY term is discarded. Term order directly affects filter behavior; reordering terms can change which packets are accepted or rejected.

Common Pitfalls and Best Practices

• →Overlapping ranges: If two terms contain overlapping VLAN ranges, the first matching term wins. Verify your range boundaries to avoid unintended matches.
• →Range boundaries: vlan-range is inclusive on both ends. A range of 100-100 matches only VLAN 100; it does not match 99 or 101.
• →Performance: Large ranges (e.g., 1-4094) are expanded at configuration time, not runtime. Juniper compiles the filter efficiently, but clarity and maintainability matter in production.
• →Documentation: Always comment your filter terms to explain why specific VLAN ranges are allowed or denied. This aids troubleshooting and future maintenance.
• →Testing: Use operational commands like 'show firewall log' and packet capture to verify filter behavior matches intent.

Practical Configuration Example

set firewall filter EDGE-INGRESS term BLOCK-RESERVED from vlan-range 1-99
set firewall filter EDGE-INGRESS term BLOCK-RESERVED then discard

set firewall filter EDGE-INGRESS term ALLOW-PROD from vlan-range 100-299
set firewall filter EDGE-INGRESS term ALLOW-PROD then accept

set firewall filter EDGE-INGRESS term ALLOW-GUEST from vlan-range 1000-1100
set firewall filter EDGE-INGRESS term ALLOW-GUEST then accept

set firewall filter EDGE-INGRESS term DEFAULT-ACTION then discard

This filter blocks reserved VLANs 1-99, accepts production traffic in VLANs 100-299, accepts guest traffic in VLANs 1000-1100, and denies everything else. The order ensures reserved VLANs are blocked before production is evaluated, preventing accidental matches.