Navigation
Related Documentation
- J, M, MX, T Series
- Understanding Junos VPN Site Secure
- M, MX, T Series
- Configuring Junos VPN Site Secure Using Junos OS Extension Provider Package
Service Sets
The Adaptive Services PIC supports two types of service sets when you configure IPsec tunnels. Because they are used for different purposes, it is important to know the differences between these service set types.
- Next-hop service set—Supports multicast and multicast-style dynamic routing protocols (such as OSPF) over IPsec. Next-hop service sets allow you to use inside and outside logical interfaces on the Adaptive Services PIC to connect with multiple routing instances. They also allow the use of Network Address Translation (NAT) and stateful firewall capabilities. However, next-hop service sets do not monitor Routing Engine traffic by default and require configuration of multiple service sets to support traffic from multiple interfaces.
- Interface service set—Applied to a physical interface and similar to a stateless firewall filter. They are easy to configure, can support traffic from multiple interfaces, and can monitor Routing Engine traffic by default. However, they cannot support dynamic routing protocols or multicast traffic over the IPsec tunnel.
In general, we recommend that you use next-hop service sets because they support routing protocols and multicast over the IPsec tunnel, they are easier to understand, and the routing table makes forwarding decisions without administrative intervention.
Related Documentation
- J, M, MX, T Series
- Understanding Junos VPN Site Secure
- M, MX, T Series
- Configuring Junos VPN Site Secure Using Junos OS Extension Provider Package
Published: 2013-08-29
Related Documentation
- J, M, MX, T Series
- Understanding Junos VPN Site Secure
- M, MX, T Series
- Configuring Junos VPN Site Secure Using Junos OS Extension Provider Package
