MX-SPC3에서 적응형 서비스와 차세대 서비스 간의 구성 차이

CPU 컴플렉스 수

4

2

CPU 컴플렉스당 PIC 수

1

1

PIC당 인터페이스 수

1

1

카드의 총 인터페이스 수

4

2

[edit interfaces]
ms-5/1/0 {
    <...>
}

[edit interfaces]
# Change interface name to vms.
vms-5/1/0 {
    <...>
}

[edit interfaces]
ms-5/1/0 {
    services-options {
        open-timeout 40;
        close-timeout 40;
        inactivity-tcp-timeout 10;
        inactivity-asymm-tcp-timeout 10;
        tcp-tickles 8;
        ignore-errors tcp;
    }
}

[edit services]
service-set sset1 {
    service-set-options {
        # Set tcp parameters under tcp-session.
        tcp-session {
            open-timeout 40;
            close-timeout 40;
            inactivity-tcp-timeout 10;
            inactivity-asymm-tcp-timeout 10;
            tcp-tickles 8;
            ignore-errors tcp;
        }
    }
}

[edit interfaces]
ms-5/1/0 {
    services-options {
        inactivity-non-tcp-timeout 40;
        session-timeout 10;
    }
}

[edit services]
service-set sset1 {
    # Set non-tcp parameters directly under 
    # service-set-options.
    service-set-options {
        inactivity-non-tcp-timeout 40;
        session-timeout 10;
    }
}

[edit interfaces]
ms-5/1/0 {
    services-options {
        fragment-limit 10;
        reassembly-timeout 5;
    }
}

[edit interfaces]
vms-5/1/0 {
    services-options {
        fragment-limit 10;
        reassembly-timeout 5;
    }
}

[edit interfaces]
ms-5/1/0 {
    services-options {
        session-limit {
            maximum 100;
            cpu-load-threshold 12;
            rate 10;
        }
    }
}

[edit services]
# Maximum number of sessions can be 
# specified per service-set.
service-set sset1 {
    service-set-options {
        session-limit {
            maximum 100;
        }
    }
}

[edit interfaces]
# All session-limit parameters continue to be 
# configurable per interface. If the maximum
# number of sessions is different from the associated 
# service-set, the smaller number takes effect.
vms-5/1/0 {
    services-options {
        session-limit {
            maximum 100;
            cpu-load-threshold 12;
            rate 10;
        }
    }
}

[edit interfaces]
ms-5/1/0 {
    services-options {
        pba-interim-logging-interval 10;
    }
}

[edit interfaces]
# Set interim-logging-interval under the nat branch.
nat {
    source {
        pool src-pool {
            port {
                block-allocation {
                    interim-logging-interval 10;
                }
            }
        }

[edit interfaces]
ms-5/1/0 {
    services-options {
        syslog {
            host {
                <...>
            }
        }
    }
}

을 참조하십시오 service-set syslog stream host.

[edit interfaces]
ms-5/1/0 {
    services-options {
        syslog {
            message-rate-limit 10;
        }
    }
}

[edit services]
service-set sset1 {
    syslog {
        event-rate 10;
    }
}

[edit interfaces]
ms-5/1/0 {
    services-options {
        ignore-errors alg;
        disable-global-timeout-override;
        trio-flow-offload {
            minimum-bytes 1000;
        }
    }
}

지원되지 않음

[edit services]
service-set sset1 {
    tcp-mss 1460;
    service-set-options {
        tcp-non-syn drop-flow-send-rst;
        tcp-fast-open drop;
    }
}

[edit services]
service-set sset1 {
    service-set-options {
        # Set tcp parameters under tcp-session.
        tcp-session {
            tcp-mss 1460;
            tcp-non-syn drop-flow-send-rst;
            tcp-fast-open drop;
        }
    }
}

[edit services]
service-set sset1 {
    replicate-services {
        replication-threshold 180;
    }
}

[edit interfaces]
# Set replication-threshold on the interface.
vms-5/1/0 {
    redundancy-options {
        replication-threshold 180;
    }
}

[edit services]
service-set sset1 {
    syslog {
        host 10.1.1.1 {
            port 514;
        }
    }
}

[edit services]
service-set sset1 {
    syslog
        # Process security logs in the dataplane.
        mode stream;
        stream s1 {
            # Specify host to send security logs to.
            host {
                10.1.1.1;
                port 514;
            }
        }
    }
}

[edit services]
service-set sset1 {
    syslog {
        host local;
    }
}

[edit services]
service-set sset1 {
    syslog
        # Process security logs in the control plane,
        # saving logs to local file specified by rtlog.
        mode event;
    }
}
rtlog {
    traceoptions {
        # Specify filename for logs.
        file rtlog size 1g;
        flag all;
    }
}

[edit services]
service-set sset1 {
    service-order  <...>
}

서비스 순서는 고정되어 있습니다.

[edit services]
service-set sset1 {
    sampling-service  <...>
}

J-Flow 로깅은 인라인으로 지원됩니다.

[edit services]
service-set sset1 {
    tag-rule-sets <...>
    tag-rules  <...>
    hcm-profile  <...>
    hcm-url-rule-sets  <...>
    hcm-url-rules  <...>
    service-set-options {
        bypass-traffic-on-pic-failure;
    }
}

현재 지원되지 않음

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-basic-nat44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-basic-nat44;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.10.10.0/24;
    }

    
        pool src-pool {
            address {
                10.10.10.0/24;
            }
            # host-address-base indicates a type of static mapping 
            # where the base address 10.45.1.0/0 maps to the 
            # lowest address in the pool, namely 10.10.10.0/0,
            # and the other addresses map sequentially from there
            # e.g. 10.45.1.1 maps to 10.10.10.1, and so on.
            # Since this is a static mapping, there is no port translation
            # by default.
            # Note that host-address-base does not have to be the 
            # lowest address allowed by the subsequent source rule. 
            # Any packet with a source address allowed by the source rule
            # but is lower than the host-address-base is discarded. 
            host-address-base 10.45.1.0/0;
        }

    rule rule-basic-nat44 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    10.45.1.0/24
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    translation-type {
                        basic-nat44;
                    }
                }
            }
        }
    }

        rule-set rule-basic-nat44 {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.45.1.0/24;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-basic-nat66;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-basic-nat66;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 2001:DB8:2222::0/96;
    }

    
        pool src-pool {
            address {
                2001:DB8:2222::0/96;
            }
        }

    rule rule-basic-nat66 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    2001:DB8:1111::0/96;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    translation-type {
                        basic-nat66;
                    }
                }
            }
        }
    }

        rule-set rule-basic-nat66 {
            match-direction input;
            rule r1 {
                match {
                    source-address 2001:DB8:1111:::0/96;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-dynamic-nat44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-dynamic-nat44;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address-range low 10.10.10.2 high 10.10.10.10;
    }

    
        pool src-pool {
            address {
                10.10.10.2/32 to 10.10.10.10/32;
            }
            # Since this is implicitly a dynamic mapping, 
            # there is port translation by default , so we need to
            # explictly specify that we don’t want port translation.
            port {
                no-translation;
            }
        }

    rule rule-dynamic-nat44 {
        match-direction input;
        term t0 {
            from {
                applications junos-icmp-all;
            }
            then {
                no-translation;
            }
        }
        term t1 {
            from {
                destination-address {
                    10.99.0.2/32;
                }
                source-address-range {
                    low 10.45.0.2 high 10.45.0.10;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    translation-type {
                        dynamic-nat44;
                    }
                }
            }
        }
    }

        rule-set rule-dynamic-nat44 {
            match-direction input;
            rule r0 {
                match {
                    source-address 0.0.0.0/0;
                    application junos-icmp-all;
                }
                then {
                    source-nat {
                        off;
                    }
                }
            }
            rule r1 {
                match {
                    source-address-name addr1;
                    destination-address 10.99.0.2/32;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source
} # end nat

address-book {
    global {
        address addr1 {
            address-range 10.45.0.2/32 {
                to {
                    10.45.0.10/32;
                }
            }
        }
    }
}

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-napt44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-napt44;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.10.10.0/24;
        port {
            automatic;
        }
    }

    
        pool src-pool {
            address {
                10.10.10.0/24;
            }
            # Since this is implicitly a dynamic mapping,
            # and there is no explicit port statement
            # to indicate otherwise, the default port 
            # mapping behavior takes effect.
        }
    

    rule rule-napt44 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    10.45.1.0/24
                }
                application-sets accept-algs;
            }
            then {
                translated {
                    source-pool src-pool;
                    translation-type {
                        napt44;
                    }
                }
            }
        }
    }

    
        rule-set rule-napt44 {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.45.1.0/24;
                    application accept-algs;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-napt66;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-napt66;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 2001:DB8:2222::0/112;
        port {
            range low 20000 high 30000;
        }
    }

    
        pool src-pool {
            address {
                2001:DB8:2222::0/112;
            }
            port {
                range {
                    20000;
                    to {
                        30000;
                    }
                }
            }
        }
    

    rule rule-napt66 {
        match-direction input;
        term t1 {
            from {
                source-address {
                     2001:DB8:1111::0/96;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    translation-type {
                        napt66;
                    }
                }
            }
        }
    }

    
        rule-set rule-napt66 {
            match-direction input;
            rule r1 {
                match {
                    source-address 2001:DB8:1111::0/96;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-dnat-44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-dnat-44;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    destination {

    pool dest-pool {
        address 10.10.10.2/32;
    }

    
        pool dest-pool {
            address {
                10.10.10.2/32;
            }
        }

    rule rule-dnat-44 {
        match-direction input;
        term t1 {
            from {
                destination-address {
                    10.45.0.2/32
                }
            }
            then {
                translated {
                    destination-pool dest-pool;
                    translation-type {
                        dnat-44;
                    }
                }
            }
        }
    }

        rule-set rule-dnat-44 {
            match-direction input;
            rule r1 {
                match {
                    destination-address 10.45.0.2/32;
                }
                then {
                    destination-nat {
                        pool {
                            dest-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-stateful-nat464;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-stateful-nat464-src;
    nat-rule-sets rule-stateful-nat464-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.10.10.0/24;
        port {
            automatic;
        }
    }

    
        pool src-pool {
            address {
                10.10.10.0/24;
            }
            port {
                automatic {
                    round-robin;
                }
            }
        }

    rule rule-stateful-nat464 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    2001:DB8:1111::0/96;
                }
                destination-address {
                    2001:DB8:2222::0/96;
                }
                applications [junos-icmp-all junos-icmp-ping junos-traceroute junos-traceroute-ttl 1];
            }
            then {
                translated {
                    source-pool src-pool;
                    clat-prefix 2001:DB8:1111::0/96;
                    destination-prefix 2001:DB8:2222::0/96;
                    translation-type {
                        stateful-nat464;
                    }
                }
            }
        }
    }

    # This source rule applies after the destination rule.
        rule-set rule-stateful-nat464-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 2001:DB8:1111::0/96;
                    # Since destination NAT happens first, the 
                    # destination IPv6 prefix has  been stripped off, 
                    # resulting in an IPv4 destination address.
                    destination-address 0.0.0.0/0;
                    application [junos-icmp-all junos-icmp-ping junos-traceroute junos-traceroute-ttl 1];
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                            }
                        clat-prefix 2001:DB8:1111::0/96;
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    # This destination rule applies before the source rule.
        rule-set rule-stateful-nat464-dest {
            match-direction input;
            rule r1 {
                match {
                    destination-address 2001:DB8:2222::0/96;
                }
                then {
                    destination-nat {
                        destination-prefix 2001:DB8:2222::0/96;
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-stateful-nat64;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-stateful-nat64-src;
    nat-rule-sets rule-stateful-nat64-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.10.10.0/24;
        port {
            automatic;
                random-allocation;
            }
        }
        mapping-timeout 500;
    }

    
        pool src-pool {
            address {
                10.10.10.0/24;
            }
            port {
                automatic {
                    random-allocation;
                }
            }
            mapping-timeout 500;
        }

    rule rule-stateful-nat64 {
        match-direction input;
        term t1 {
            from {
                destination-address {
                    2001:DB8:2222::0/64;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    destination-prefix 2001:DB8:2222::0/64;
                    translation-type {
                        stateful-nat64;
                    }
                }
            }
        }
        term t2 {
            from {
                destination-address {
                    2001:DB8:3333::0/64;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    destination-prefix 2001:DB8:3333::0/64;
                    translation-type {
                        stateful-nat64;
                    }
                }
            }
        }
    }

    # This source rule applies after the destination rule.
        rule-set rule-stateful-nat64-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 0::/0;
                    # Since destination NAT applies first, the 
                    # destination address is now IPv4.
                    destination-address 0.0.0.0/0;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    # This destination rule applies before the source rule.
        rule-set rule-stateful-nat64-dest {
            match-direction input;
            rule r1 {
                match {
                    destination-address 2001:DB8:2222::0/64;
                }
                then {
                    destination-nat {
                        destination-prefix 2001:DB8:2222::0/64;
                    }
                }
            }
            rule r2 {
                match {
                    destination-address 2001:DB8:3333::0/64;
                }
                then {
                    destination-nat {
                        destination-prefix 2001:DB8:3333::0/64;
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-twice-basic-nat-44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-twice-basic-nat-44-src;
    nat-rule-sets rule-twice-basic-nat-44-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.98.10.0/24;
    }
    pool dest-pool {
        address 10.99.10.0/24;
    }

    
        pool src-pool {
            address {
                10.98.10.0/24;
            }
            # host-address-base indicates a type of static mapping where
            # the base address 10.10.10.0/0 maps to the lowest 
            # address in the pool, namely 10.98.10.0/0,
            # and the other addresses map sequentially from there
            # e.g. 10.10.10.1 maps to 10.98.10.1, and so on.
            # Since this is a static mapping, there is no port translation 
            # by default.
            # Note that host-address-base does not have to be the 
            # lowest address allowed by the subsequent source rule. 
            # Any packet with a source address allowed by the source rule
            # but is lower than the host-address-base is discarded. 
            host-address-base 10.10.10.0/0;
        }

    rule rule-twice-basic-nat-44 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    10.10.10.0/24;
                }
                destination-address {
                    10.20.10.0/24;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    destination-pool dest-pool;
                    translation-type {
                        twice-basic-nat-44;
                    }
                }
            }
        }
    }

    # This source rule applies after the destination rule.
        rule-set rule-twice-basic-nat-44-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.10.10.0/24;
                    # Since destination NAT happens first, the destination
                    # address refers to the NAT’d address.
                    destination-address 10.99.10.0/24;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    
        pool dest-pool {
            address {
                10.99.10.0/24;
            }
        }

    # This destination rule applies before the source rule.
        rule-set rule-twice-basic-nat-44-dest {
            match-direction input;
            rule r1 {
                match {
                    destination-address 10.20.10.0/24;
                }
                then {
                    destination-nat {
                        pool {
                            dest-pool;
                        }
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-twice-dynamic-nat-44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-twice-dynamic-nat-44-src;
    nat-rule-sets rule-twice-dynamic-nat-44-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.98.10.0/24;
    }
    pool dest-pool {
        address 10.99.10.0/24;
    }

    
        pool src-pool {
            address {
                10.98.10.0/24;
            }
            port {
                no-translation;
            }
        }

    rule rule-twice-dynamic-nat-44 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    10.10.10.0/24;
                }
                destination-address {
                    10.20.10.0/24;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    destination-pool dest-pool;
                    translation-type {
                        twice-dynamic-nat-44;
                    }
                }
            }
        }
    }

    # This source rule applies after the destination rule.
        rule-set rule-twice-dynamic-nat-44-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.10.10.0/24;
                    # Since destination NAT happens first, the destination
                    # address refers to the NAT’d address.
                    destination-address 10.99.10.0/24;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    
        pool dest-pool {
            # By default, address mapping in destination pools is static.
            address {
                10.99.10.0/24;
            }
        }

    # This destination rule applies before the source rule.
        rule-set rule-twice-dynamic-nat-44-dest {
            match-direction input;
            rule r1 {
                match {
                    destination-address 10.20.10.0/24;
                }
                then {
                    destination-nat {
                        pool {
                            dest-pool;
                        }
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-twice-napt-44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-twice-napt-44-src;
    nat-rule-sets rule-twice-napt-44-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.98.10.0/24;
        port {
            automatic;
            secured-port-block-allocation block-size 256 max-blocks-per-address 1 active-block-timeout 300;
        }
    }
    pool dest-pool {
        address 10.99.10.2/32;
    }

    
        pool src-pool {
            address {
                10.98.10.0/24;
            }
            port {
                automatic {
                    round-robin;
                }
                block-allocation {
                    block-size 256;
                    maximum-blocks-per-host 1;
                    active-block-timeout 300;
                }
            }
        }

    rule rule-twice-napt-44 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    10.10.10.0/24;
                }
                destination-address {
                    10.20.10.2/32;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    destination-pool dest-pool;
                    translation-type {
                        twice-napt-44;
                    }
                }
            }
        }
    }

    # This source rule applies after the destination rule.
        rule-set rule-twice-napt-44-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.10.10.0/24;
                    # Since destination NAT happens first, the
                    # destination address refers to the NAT’d address.
                    destination-address 10.99.10.2/32;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    
        pool dest-pool {
            address {
                10.99.10.2/32;
            }
        }

    # This destination rule applies before the source rule.
        rule-set rule-twice-napt-44-dest {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.10.10.0/24;
                    destination-address 10.20.10.2/32;
                }
                then {
                    destination-nat {
                        pool {
                            dest-pool;
                        }
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-deterministic-napt44;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-deterministic-napt44;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.10.10.0/24;
        port {
            range low 1024 high 19999;
            deterministic-port-block-allocation block-size 256;
        }
        mapping-timeout 120;
    }

    
        pool src-pool {
            address {
                10.10.10.0/24;
            }
            port {
                range {
                    1024;
                    to {
                        19999;
                    }
                }
                deterministic {
                    block-size 256;
                    # host address specifies the subnet that you
                    # want to apply to this pool.
                    host address 10.2.0.0/20;
                }
            }
            mapping-timeout 120;
        }

    rule rule-deterministic-napt44 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    10.2.0.0/18;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    translation-type {
                        deterministic-napt44;
                    }
                    mapping-type endpoint-independent;
                }
            }
        }
    }

        rule-set rule-deterministic-napt44 {
            match-direction input;
            rule r1 {
                match {
                    source-address 10.2.0.0/18;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                        mapping-type endpoint-independent;
                    }
                }
            }
        }

} # end nat

    
    } # end source
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-deterministic-napt64;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-deterministic-napt64-src;
    nat-rule-sets rule-deterministic-napt64-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.98.10.0/24;
        port {
            automatic;
            random-allocation;
            }
            deterministic-port-block-allocation block-size 256;
        }
    }

    
        pool src-pool {
            address {
                10.98.10.0/24;
            }
            port {
                automatic {
                    random-allocation;
                }
                deterministic {
                    block-size 256;
                    host address 2001:DB8:1111::1/120;
                }
            }
        }

    rule rule-deterministic-napt64 {
        match-direction input;
        term t1 {
            from {
                source-address {
                    2001:DB8:1111::1/120;
                }
            }
            then {
                translated {
                    destination-prefix 2001:DB8:2222::/96;
                    source-pool src-pool;
                    translation-type {
                        deterministic-napt64;
                    }
                }
            }
        }
    }

    # This source rule applies after the destination rule.
        rule-set rule-deterministic-napt64-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 2001:DB8:1111::1/120;
                    # Since destination NAT happens first, the destination
                    # address refers to the NAT’d address.
                    destination-address 0.0.0.0/0;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    
        pool dest-pool {
            address {
                10.99.10.2/32;
            }
        }

    # This destination rule applies before the source rule.
        rule-set rule-destination-napt64-dest {
            match-direction input;
            rule r1 {
                match {
                    destination-address 2001:DB8:2222::/96;
                }
                then {
                    destination-nat {
                        destination-prefix 2001:DB8:2222::/96;
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]

[edit services]

service-set sset1 {
    nat-rules rule-napt-pt;
    interface-service {
        service-interface ms-1/2/0;
    }
}

service-set sset1 {
    nat-rule-sets rule-napt-pt-src;
    nat-rule-sets rule-napt-pt-dest;
    interface-service {
        service-interface vms-2/0/0;
    }
}

nat {

nat {
    source {

    pool src-pool {
        address 10.10.10.2/32;
    }
    pool dest-pool {
        address 10.99.10.2/32;
    }

    
        pool src-pool {
            address {
                10.10.10.2/32;
            }
        }

    rule rule-napt-pt {
        match-direction input;
        term t1 {
            from {
                source-address {
                    2001:DB8:1111::2/128;
                }
                destination-address {
                    2001:DB8:2222::2/128;
                }
            }
            then {
                translated {
                    source-pool src-pool;
                    destination-pool dest-pool;
                    translation-type {
                        napt-pt;
                    }
                }
            }
        }
    }

        rule-set rule-napt-pt-src {
            match-direction input;
            rule r1 {
                match {
                    source-address 2001:DB8:1111::2/128;
                    destination-address 10.99.10.0/24;
                }
                then {
                    source-nat {
                        pool {
                            src-pool;
                        }
                    }
                }
            }
        }

} # end nat

    
    } # end source

    destination {

    
        pool dest-pool {
            address {
                10.99.10.2/32;
            }
        }

        rule-set rule-napt-pt-dest {
            match-direction input;
            rule r1 {
                match {
                    destination-address 2001:DB8:2222::2/128;
                }
                then {
                    destination-nat {
                        pool {
                            dest-pool;
                        }
                    }
                }
            }
        }

    
    } # end destination
} # end nat

[edit services]
service-set sset1 {
    ids-rules r1;
    ids-rules r2;
}

[edit services]
service-set sset1 {
    # Replace ids-rules with ids-option.
    ids-option ids1;
    ids-option ids2;
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            <...>
        }
    }
}

[edit services]
# Define ids rules under the screen branch.
screen {
    # Replace rule with ids-option.
    ids-option ids1 {
        match-direction input;
        # Flatten hierarchy by removing term and placing 
        # contents directly under ids-option.
        <...>
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                allow-ip-options [ loose-source-route route-record router-alert security stream-id strict-source-route timestamp ];
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        # By default, all ip options are allowed.
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                <no allow-ip-options configured>
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        # Explicitly specify the disallowed options.
        ip {
            loose-source-route-option;
            record-route-option;
            security-option;
            stream-option;
            strict-source-route-option;
            timestamp-option;
            # router-alert option for IPv4 is not supported.
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                allow-ipv6-extension-header [ ah dstopts esp fragment hop-by-hop mobility routing ];
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        # By default, all ipv6 extensions are allowed.
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                <no allow-ipv6-extension-header configured>
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        ip {
            # Explicitly specify the disallowed extensions.
            ipv6-extension-header {
                AH-header;
                ESP-header;
                fragment-header;
                hop-by-hop-header;
                mobility-header;
                routing-header;
                # dstoptions is not supported.
            }
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                aggregation {
                    source-prefix 24;
                    destination-prefix 24;
                    source-prefix-ipv6 64;
                    destination-prefix-ipv6 64;
                }
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        aggregation {
            source-prefix-mask 24;
            destination-prefix-mask 24;
            source-prefix-v6-mask 64;
            destination-prefix-v6-mask 64;
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                icmp-fragment-check;
                icmp-large-packet-check;
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        # Group icmp checks under icmp.
        icmp {
            fragment;
            large;
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                land-attack-check;
                tcp-winnuke-check;
                tcp-syn-fragment-check;
                tcp-syn-defense;
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        # Group tcp checks under tcp.
        tcp {
            land;
            winnuke;
            syn-frag;
            # tcp-syn-defense is not supported.
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                session-limit {
                    by-source {
                        maximum 100;
                        rate 10;
                        packets 1k;
                    }
                    by-destination {
                        maximum 100;
                        rate 10;
                        packets 1k;
                    }
                }
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        limit-session {
            by-source {
                maximum-sessions 100;
                session-rate 10;
                packet-rate 1k;
            }
            by-destination {
                maximum-sessions 100;
                session-rate 10;
                packet-rate 1k;
            }
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                session-limit {
                    by-source {
                        by-protocol {
                            tcp {
                                maximum 100;
                                rate 10;
                                packets 1k;
                            }
                            udp {
                                maximum 100;
                                rate 10;
                                packets 1k;
                            }
                            icmp {
                                maximum 100;
                                rate 10;
                                packets 1k;
                            }
                        }
                }
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        limit-session {
            by-source {
                by-protocol {
                    tcp {
                        maximum-sessions 100;
                        session-rate 10;
                        packet-rate 1k;
                    }
                    udp {
                        maximum-sessions 100;
                        session-rate 10;
                        packet-rate 1k;
                    }
                    icmp {
                        maximum-sessions 100;
                        session-rate 10;
                        packet-rate 1k;
                    }
                }
            }
        }
    }
}

[edit services]
ids {
    rule r1 {
        match-direction input;
        term t1 {
            then {
                session-limit {
                    by-destination {
                        by-protocol {
                            tcp {
                                maximum 100;
                                rate 10;
                                packets 1k;
                            }
                            udp {
                                maximum 100;
                                rate 10;
                                packets 1k;
                            }
                            icmp {
                                maximum 100;
                                rate 10;
                                packets 1k;
                            }
                        }
                }
            }
        }
    }
}

[edit services]
screen {
    ids-option ids1 {
        match-direction input;
        limit-session {
            by-destination {
                by-protocol {
                    tcp {
                        maximum-sessions 100;
                        session-rate 10;
                        packet-rate 1k;
                    }
                    udp {
                        maximum-sessions 100;
                        session-rate 10;
                        packet-rate 1k;
                    }
                    icmp {
                        maximum-sessions 100;
                        session-rate 10;
                        packet-rate 1k;
                    }
                }
            }
        }
    }
}