Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring Filter-Based Forwarding to a Specific Outgoing Interface or Destination IP Address

Understanding Filter-Based Forwarding to a Specific Outgoing Interface or Destination IP Address

Starting in Junos OS Release 12.2, you can use then next-interface, then next-ip, or then next-ip6 as an action in a firewall filter.

For example:

• Layer-3 properties (for example, the source or destination IP address or the TOS byte)
• Layer-4 properties (for example, the source or destination port)

The route for the given IPv4 or IPv6 address has to be present in the routing table for policy-based routing to take effect. Similarly, the route through the given interface has to be present in the forwarding table for next-interface action to take effect. This can be achieved by configuring an interior gateway protocol (IGP), such as OSPF or IS-IS, to advertise Layer 3 routes.

• An IPv4 address (using the next-ip firewall filter action)
• An IPv6 address (using the next-ip6 firewall filter action)
• An interface (using the next-interface firewall filter action)

Suppose, for example, that you want to offer services to your customers, and the services reside on different servers. An example of a service might be hosted DNS or hosted FTP. As customer traffic arrives at the Juniper Networks routing device, you can use filter-based forwarding to send traffic to the servers by applying a match condition on a MAC address or an IP address or simply an incoming interface and send the packets to a certain outgoing interface that is associated with the appropriate server. Some of your destinations might be IPv4 or IPv6 addresses, in which case the next-ip or next-ip6 action is useful.

Optionally, you can associate the outgoing interfaces or IP addresses with routing instances.

Example: Configuring Filter-Based Forwarding to a Specific Outgoing Interface

This example shows how to use then next-interface as an action in a firewall filter.

• Requirements
• Overview
• Configuration
• Verification

Requirements

• MX Series 3D Universal Edge Router or an EX Series switch as the routing device with the firewall filter configured.
• Junos OS Release 12.3R2 running on the routing device with the firewall filter configured.
• The filter with the next-interface (or next-ip) action can only be applied to an interface that is hosted on a Trio MPC. If you apply the filter to an I-chip based DPC, the commit operation fails.
• The outgoing interface referred to in the next-interface interface-name action can be hosted on a Trio MPC or an I-chip based DPC.

Overview

In this example, Device R1 has two loopback interface addresses configured: 172.16.1.1 and 172.16.2.2.

On Device R2, a firewall filter has multiple terms configured. Each term matches one of the source addresses in incoming traffic, and routes the traffic to specified outgoing interfaces. The outgoing interfaces are configured as VLAN-tagged interfaces between Device R2 and Device R3.

IS-IS is used for connectivity among the devices.

Figure 1 shows the topology used in this example.

Figure 1: Filter-Based Forwarding to Specified Outgoing Interfaces

This example shows the configuration on Device R2.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure the interfaces.
   [edit interfaces]user@R2# set ge-2/1/0 unit 0 family inet filter input filter1user@R2# set ge-2/1/0 unit 0 family inet address 10.0.0.10/30user@R2# set ge-2/1/0 unit 0 description to-R1user@R2# set ge-2/1/0 unit 0 family iso
   user@R2# set ge-2/1/1 vlan-tagginguser@R2# set ge-2/1/1 description to-R3
   user@R2# set ge-2/1/1 unit 0 vlan-id 1001user@R2# set ge-2/1/1 unit 0 family inet address 10.0.0.13/30user@R2# set ge-2/1/1 unit 0 family iso
   user@R2# set ge-2/1/1 unit 1 vlan-id 1002user@R2# set ge-2/1/1 unit 1 family inet address 10.0.0.25/30user@R2# set ge-2/1/1 unit 1 family iso
   user@R2# set lo0 unit 0 family inet address 10.255.4.4/32user@R2# set lo0 unit 0 family iso address 49.0001.0010.0000.0404.00
2. Configure the firewall filter.
   [edit firewall family inet filter filter1]user@R2# set term t1 from source-address 172.16.1.1/32user@R2# set term t1 then next-interface ge-2/1/1.0
   user@R2# set term t2 from source-address 172.16.2.2/32user@R2# set term t2 then next-interface ge-2/1/1.1
3. Enable IS-IS on the interfaces.
   [edit protocols is-is]user@R2# set interface all level 1 disableuser@R2# set interface fxp0.0 disableuser@R2# set interface lo0.0

Results

From configuration mode, confirm your configuration by entering the show interfaces, show firewall, and show protocols commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Checking the Paths Used

Purpose

Make sure that the expected paths are used when sending traffic from Device R1 to Device R4.

Action

On Device R1, enter the traceroute command.

traceroute to 10.255.6.6 (10.255.6.6) from 172.16.1.1, 30 hops max, 40 byte packets
 1  10.0.0.10 (10.0.0.10)  0.976 ms  0.895 ms  0.815 ms
 2  10.0.0.14 (10.0.0.14)  0.868 ms  0.888 ms  0.813 ms
 3  10.255.6.6 (10.255.6.6)  1.715 ms  1.442 ms  1.382 ms

traceroute to 10.255.6.6 (10.255.6.6) from 172.16.2.2, 30 hops max, 40 byte packets
 1  10.0.0.10 (10.0.0.10)  0.973 ms  0.907 ms  0.782 ms
 2  10.0.0.26 (10.0.0.26)  0.844 ms  0.890 ms  0.852 ms
 3  10.255.6.6 (10.255.6.6)  1.384 ms  1.516 ms  1.462 ms

Meaning

The output shows that the second hop changes, depending on the source address used in the traceroute command.

To verify this feature, a traceroute operation is performed on Device R1 to Device R4. When the source IP address is 172.16.1.1, packets are forwarded out the ge-2/1/1.0 interface on Device R2. When the source IP address is 172.16.2.2, packets are forwarded out the ge-2/1/1.1 interface on Device R2.