close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Understanding and Configuring Junos Routing Policies
- play_arrow Overview
- play_arrow Evaluating Routing Policies Using Match Conditions, Actions, Terms, and Expressions
- play_arrow Evaluating Complex Cases Using Policy Chains and Subroutines
- play_arrow Configuring Route Filters and Prefix Lists as Match Conditions
- play_arrow Configuring AS Paths as Match Conditions
- play_arrow Configuring Communities as Match Conditions
- play_arrow Increasing Network Stability with BGP Route Flapping Actions
- play_arrow Tracking Traffic Usage with Source Class Usage and Destination Class Usage Actions
- play_arrow Avoiding Traffic Routing Threats with Conditional Routing Policies
- play_arrow Protecting Against DoS Attacks by Forwarding Traffic to the Discard Interface
- play_arrow Improving Commit Times with Dynamic Routing Policies
  - Understanding Dynamic Routing Policies
  - Example: Configuring Dynamic Routing Policies
- play_arrow Testing Before Applying Routing Policies
  - Understanding Routing Policy Tests
  - Example: Testing a Routing Policy with Complex Regular Expressions
play_arrow Configuring Firewall Filters
play_arrow Configuring Traffic Policers
play_arrow Configuration Statements and Operational Commands
play_arrow Troubleshooting
- play_arrow Knowledge Base
  - https://kb.juniper.net/

list Table of Contents

English

Configuring a Firewall Filter to De-Encapsulate GRE or IPIP Traffic

date_range 24-Nov-23

arrow_backward

arrow_forward

Generic routing encapsulation (GRE) and IP over IP (IPIP) both provide a private, secure path for transporting packets through a network by encapsulating (or tunneling) the packets. The tunneling is performed by tunnel endpoints that encapsulate or de-encapsulate traffic.

You can use a firewall filter to de-encapsulate tunnel traffic on the switch. This feature provides significant benefits in terms of scalability, performance, and flexibility because you don't need to create a tunnel interface to perform the de-encapsulation. For example, you can terminate many tunnels from multiple source IP addresses with one firewall term.

Note:

The EX4600, QFX5100 and OCX switches support as many as 512 GRE tunnels, including tunnels created with a firewall filter. That is, you can create a total of 512 GRE tunnels, regardless of which method you use.

Configuring a Filter to De-Encapsulate GRE Traffic

To configure a firewall filter to de-encapsulate GRE traffic:

Create an IPv4 firewall filter and (optionally) specify a source address for the tunnel:
```
[edit ]
user@switch# set firewall family (QFX) inet filter filter-name term (Application Aware Access List) term-name from source-address address
```
You must create an IPv4 filter by using family inet because the outer header of a GRE packet must be IPv4. If you specify a source address, it should be an address on a device that will encapsulate traffic into GRE packets.

Note:
To terminate many tunnels from multiple source IP addresses with one firewall term, do not configure a source address. In this case, the filter will de-encapsulate any GRE packets received by the interface that you apply the filter to.
Specify a destination address for the tunnel:
```
[edit ]
user@switch# set firewall family inet filter filter-name term term-name from destination-address address
```
This should be an address on an interface of the switch on which you want the tunnel or tunnels to terminate and the GRE packets to be de-encapsulated. You should also configure this address as a tunnel endpoint on all the tunnel source routers that you want to form tunnels with on the switch.

Specify that the filter should match and accept GRE traffic:

content_copy zoom_out_map
[edit ]
user@switch# set firewall family inet filter filter-name term term-name from protocol gre

Specify that the filter should de-encapsulate GRE traffic:
```
[edit ]
user@switch# set firewall family inet filter filter-name term term-name then decapsulate gre
```
Based on the configuration you have performed so far, the switch forwards the de-encapsulated packets by comparing the inner header to the default routing table (inet0). If you want the switch to use a virtual routing instance to forward the de-encapsulated packets, perform the following steps:

Specify the name of the virtual routing instance:

content_copy zoom_out_map
[edit ]
user@switch# set firewall family inet filter filter-name term term-name then decapsulate routing-instance instance-name

Specify that the virtual routing instance is a virtual router:

[edit ]
user@switch# set routing-instances instance-name instance-type virtual-router

Specify the interfaces that belong to the virtual router:

[edit ]
user@switch# set routing-instances instance-name interface interface-name

Configuring a Filter to De-Encapsulate IPIP Traffic

To configure a firewall filter to de-encapsulate IPIP traffic::

Create an IPv4 firewall filter and (optionally) specify a source address for the tunnel:
```
[edit ]
user@switch# set firewall family (QFX) inet filter filter-name term (Application Aware Access List) term-name from source-address address
```
You must create an IPv4 filter by using family inet because the outer header of an IPIP packet must be IPv4. If you specify a source address, it should be an address on a device that will encapsulate traffic into IPIP packets.

Note:
To terminate many tunnels from multiple source IP addresses with one firewall term, do not configure a source address. In this case, the filter will de-encapsulate any IPIP packets received by the interface that you apply the filter to.
Specify a destination address for the tunnel:
```
[edit ]
user@switch# set firewall family inet filter filter-name term term-name from destination-address address
```
This should be an address on an interface of the switch on which you want the tunnel or tunnels to terminate and the IPIP packets to be de-encapsulated. You should also configure this address as a tunnel endpoint on all the tunnel source routers that you want to form tunnels with on the switch.

Specify that the filter should match and accept IPIP traffic:

content_copy zoom_out_map
[edit ]
user@switch# set firewall family inet filter filter-name term term-name from protocol ipip

Specify that the filter should de-encapsulate IPIP traffic:
```
[edit ]
user@switch# set firewall family inet filter filter-name term term-name then decapsulate ipip
```
Based on the configuration you have performed so far, the switch forwards the de-encapsulated packets by comparing the inner header to the default routing table (inet0). If you want the switch to use a virtual routing instance to forward the de-encapsulated packets, perform the following steps:

Specify the name of the virtual routing instance:

content_copy zoom_out_map
[edit ]
user@switch# set firewall family inet filter filter-name term term-name then decapsulate routing-instance instance-name

Specify that the virtual routing instance is a virtual router:

[edit ]
user@switch# set routing-instances instance-name instance-type virtual-router

Specify the interfaces that belong to the virtual router:

[edit ]
user@switch# set routing-instances instance-name interface interface-name

Applying the Filter to an Interface

After you create the firewall filter, you must also apply it to an interface that will receive GRE or IPIP traffic. Be sure to apply it in the input direction. For example, enter

[edit ]
user@switch# set interfaces interface-name unit logical-unit-number family inet filter input filter-name

Because the outer header of a GRE or IPIP packet must be IPv4, you must apply the filter to an IPv4 interface and specify family inet.

arrow_backward PREVIOUS Example: Using Filter-Based Forwarding to Route Application Traffic to a Security Device

NEXT arrow_forward Verifying That Firewall Filters Are Operational

Routing Policies, Firewall Filters, and Traffic Policers User Guide

ON THIS PAGE

Configuring a Firewall Filter to De-Encapsulate GRE or IPIP Traffic

Configuring a Filter to De-Encapsulate GRE Traffic

Configuring a Filter to De-Encapsulate IPIP Traffic

Applying the Filter to an Interface

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Routing Policies, Firewall Filters, and Traffic Policers User Guide

ON THIS PAGE

Configuring a Firewall Filter to De-Encapsulate GRE or IPIP Traffic

Configuring a Filter to De-Encapsulate GRE Traffic

Configuring a Filter to De-Encapsulate IPIP Traffic

Applying the Filter to an Interface

Related Documentation

Stay in touch