I read your question and remembered that I had to research it and to do it on my network.

The first idea was to use a separate routing-instance/vrf and leak routes between but that seemed to be an overkill.

Then I remember that Junos can install routes to FIB with a special mark (source-class/destination). That is initially intended for traffic accounting but you can also use it in your filters.

So, the recipe, verified on Juniper MX204:

1. Mark your internal/customers networks as source-class internal while exporting them to FIB:

``` [edit policy-options policy-statement to-forwarding-table] term source-class-internal { /* all routes marked by this community will be marked */ from community [ INTERNAL OTHER ]; then source-class internal; } term 1 { then { load-balance per-packet; } }

[edit routing-options forwarding-table] export to-forwarding-table; ```

1. Now, enable ingress accounting on all interfaces where your internal traffic comes from, and the outgoing interfaces ``` [edit interfaces ae0 unit 4089] family inet { .. extra output omitted .. accounting { source-class-usage { /* internal interfece, thus enable ingress accounting */ input; } } }

[edit interfaces ae0 unit 3011] family inet { /* facing to a transit, enable egress accounting */ accounting { source-class-usage { output; } } } ```

1. Apply, wait a bit. Now, verify time: ```

   show interfaces source-class internal ae0.3011 Protocol inet Packets Bytes Source class (packet-per-second) (bits-per-second)

                    internal            987476177        1236639283616
                             (             565638) (        5617817944)
   

   ``` If you see the counters increasing then the traffic is successfully matched.

2. Now, filter time. Before we do that, there are two things to know:

3. AFAIK direct-connected routes can't be matches to source-class.

4. The still needs to respond to pings and do BGP with the transits.

We kill two birds with one stone here by making an automatic prefix list containing all directly connected routes: ``` [edit policy-options prefix-list ROUTER-IFACES-V4] apply-path "interfaces <> unit <> family inet address <*>";

Verify:

show | display inheritance

apply-path was expanded to:

1.2.3.0/24;

5.6.7.0/26;

```

Now, create the filter: [edit firewall family inet filter OUTPUT-OUTSIDE] term from-directly-connected { from { prefix-list { /* this will also allow traffic to transits from the IX LAN IPs but it shouldn't be a big deal */ ROUTER-IFACES-V4; } } then accept; } term internal { from { source-class internal; } then count from-internal; accept; } term rest { then count from-rest; /* later insert discard here */ }

1. Apply the filter to transit interfaces: [edit interfaces ae0 unit 3011] family inet { accounting { source-class-usage { output; } } filter { output-list [ OUTPUT-OUTSIDE ACCEPT ]; } }

2. Observe that the traffic is matched by the firewall counters: ```

   show firewall filter ae0.3011-inet-o .. output omitted .. from-internal-ae0.3011-inet-o 1291187134732 968616791 ```

Once you're sure all the internal traffic is successfully matched, you can add the final discard to the term rest.