what's the differences of two `filter` under `edit firewall` in junos?

Question

I found there are two places of filter under firewall, [edit firewall filter filter-name] and [edit firewall family inet filter filter-name].

what's the differences of them?

Answer 1

I'll replace the variables with some example variables for this just to make it clearer.

The short version is that set firewall filter EXAMPLE-FILTER is an artifact in Junos, it still works but generally speaking using the syntax that specifies family is more uniform. In some cases different families have different options for match conditions and terminating actions, though there can be overlap. That said, if you use the set firewall filter option, the functionality of the choices you see won't change.

NOTE: Much of the output of cut out to keep the post clean.

For example, using inet you won't see certain L2 conditions that would apply to VPLS:

jhead@R1# set firewall family inet filter EXAMPLE-FILTER term EXAMPLE-TERM from ?
Possible completions:
> address              Match IP source or destination address
+ apply-groups         Groups from which to inherit configuration data
+ apply-groups-except  Don't inherit configuration data from these groups
> destination-address  Match IP destination address
+ destination-class    Match destination class
+ destination-class-except  Do not match destination class
+ destination-port     Match TCP/UDP destination port
+ destination-port-except  Do not match TCP/UDP destination port
> destination-prefix-list  Match IP destination prefixes in named list
+ dscp                 Match Differentiated Services (DiffServ) code point
+ dscp-except          Do not match Differentiated Services (DiffServ) code point
+ esp-spi              Match IPSec ESP SPI value
+ esp-spi-except       Do not match IPSec ESP SPI value
  first-fragment       Match if packet is the first fragment
> flexible-match-mask  Match flexible mask
> flexible-match-range  Match flexible range
+ forwarding-class     Match forwarding class
+ forwarding-class-except  Do not match forwarding class
<...snip...>

For example, using vpls you see those conditions, but not necessarily everything that applies to IPv4:

jhead@R1# set firewall family inet filter EXAMPLE-FILTER term EXAMPLE-TERM from ?
Possible completions:
<...snip...>
+ learn-vlan-1p-priority  Match Learned 802.1p VLAN Priority
+ learn-vlan-1p-priority-except  Do not match Learned 802.1p VLAN Priority
+ learn-vlan-dei       Match Learnt VLAN ID DEI bit
+ learn-vlan-dei-except  Do not match Learnt VLAN ID DEI bit
+ learn-vlan-id        Match Learnt VLAN ID
+ learn-vlan-id-except  Do not match Learnt VLAN ID
<...snip...>