In this example, you configure devices to direct traffic to use packet-based forwarding on the internal LAN and then direct the same traffic to use flow-based forwarding as it transits to the Internet.
Figure 16 shows a network topology that is used in this example.
Figure 16: Selective Stateless Packet-Based Services—Packet-Based to Flow-Based
In this example, the interface facing the private LAN does not need any security services, but the interface facing the WAN needs security. In this case, you decide to configure both packet-based and flow-based forwarding for secure and not so secure traffic by configuring two routing instances—one handling the packet-based forwarding and the other handling the flow-based forwarding.
In this example, you create a virtual routing instance to perform flow-based forwarding. The default master routing instance is used to perform packet-based forwarding. You then configure an internal service interface lt-0/0/0 to transmit traffic between the two virtual router routing instances and configure OSPF to exchange the routes between the routing instances. Because all packets traversing the master routing instance need packet-based forwarding, you apply the stateless firewall filter with the packet-mode action modifier on all the interfaces (ge-0/0/2 and lt-0/0/0.0) associated with the master routing instance. Similarly, because all packets traversing the virtual routing instance Internet-VR need flow-based forwarding, you do not apply the stateless firewall filter with packet-mode action modifier to all interfaces (ge-0/0/3 and lt-0/0/0.1) associated with this virtual router routing instance.
To bypass flow-based processing on internal traffic, you configure interfaces on devices R0, R1, and R2 used in this configuration. Next, configure the following on device R1:
In this example, you configure the filter bypass-flow-filter with the term bypass-flow-term that contains the packet-mode action modifier. Because you have not specified any match conditions, this filter applies to all traffic that traverses the interfaces on which it is applied. Next, you apply this filter on interfaces associated with the master routing instance. You do not apply the filter to the interfaces associated with the Internet-VR routing instance. As a result, all traffic when traversing the LAN interfaces associated with the master routing instance uses packet-based forwarding and when traversing the Internet-VR routing instance uses flow-based forwarding.
This section includes the following topics:
To configure selective stateless packet-based services for end-to-end packet-based forwarding:
On device R0:
- user@R0# set interfaces description “Connect
to Master VR” ge-0/0/2 unit 0 family inet address 9.9.9.9/24
On device R1:
- user@R1# set interfaces description “Connect
to R0” ge-0/0/2 unit 0 family inet address 9.9.9.10/24
- user@R1# set interfaces description “Connect
to R2” ge-0/0/3 unit 0 family inet address 5.5.5.5/24
On device R2:
On device R0:
On device R1 (for Master-VR):
- user@R1# set protocols ospf area 0.0.0.0 interface
ge-0/0/2.0
- user@R1# set protocols ospf area 0.0.0.0 interface
lt-0/0/0.0
On device R1 (for Internet-VR):
- user@R1# set routing-instances Internet-VR protocols
ospf area 0.0.0.0 interface lt-0/0/0.1
- user@R1# set routing-instances Internet-VR protocols
ospf area 0.0.0.0 interface ge-0/0/3.0
On device R2:
For more information about the configuration statements used in this example, see the JUNOS Software CLI Reference.