Understanding Stateful and Stateless Data Processing for J Series Services Routers

JUNOS Software for J Series Services Routers integrates the world-class network security and routing capabilities of Juniper Networks.

JUNOS Software uses a modular architecture as shown in Figure 6. The operating system consists of discrete processes that implement specific features and functionality. These processes are compartmentalized with their associated data to provide functional independence, information privacy, and improved scalability.

Traffic that enters and exits a services router running JUNOS Software is processed according to features you configure, such as security policies, packet filters, and screens. For example, the software can determine:

Packets that enter and exit a services router running JUNOS Software undergo both packet-based and flow-based processing.

The software implements flow-based security and services, with packet-based application of filters, policers, traffic shapers, and other classification features as described in the following sections:

Understanding Flow-Based Processing

A packet undergoes flow-based processing after any packet-based filters and policers have been applied to it.

Figure 6 shows an architectural overview of traffic flow in a services router running JUNOS Software. See Figure 8 to follow the path of the traffic as it traverses through the flow services module.

Figure 6: Traffic Flow for Flow-Based Processing

Image g030006.gif

A flow is a stream of related packets that meet the same matching criteria and share the same characteristics. JUNOS Software treats packets belonging to the same flow in the same manner.

Configuration settings that determine the fate of a packet—such as the security policy that applies to it, whether the packet is sent through an IPsec tunnel, if it requires an Application Layer Gateway (ALG), if Network Address Translation (NAT) is applied to translate the packet's address—are assessed for the first packet of a flow. The settings are then applied to the rest of the packets in the flow.

To determine if a packet belongs to an existing flow, the router attempts to match the packet's information to that of an existing flow based on the following six match criteria:

If the packet matches an existing flow, processing for the packet is assessed in the context of its flow state, which is maintained by the flow's session. If it does not match the session for an existing flow, the packet is used to create a flow state and a session is allocated for it.

Zones and Policies

The security policy to be used for the first packet of a flow is cached in a flow table for use with the same flow and closely related flows. Security policies are associated with zones. A zone is a collection of interfaces that define a security boundary. A packet's incoming zone, as determined by the interface through which it arrived, and its outgoing zone, as determined by the forwarding lookup, together determine which policy is used for packets of the flow.

Flows and Sessions

Flow-based packet processing, which is stateful, requires the creation of sessions. A session is created, based on the characteristics assessed for the first packet of a flow, for the following purposes:

Most packet processing occurs in the context of a flow. The flow engine and session bring together the following features and events that affect a packet as it undergoes flow-based processing:

Policies can be configured to log session permit, close, and deny events.

Understanding Packet-Based Processing

A packet undergoes packet-based processing when it is dequeued from its input (ingress) interface and before it is enqueued on its output (egress) interface.

Packet-based processing applies stateless firewall filters and class-of-service (CoS) features to discrete packets. You can apply a firewall filter to an ingress or egress interface, or to both.

Figure 7 shows architectural overview of traffic flow in a standard JUNOS router.

Figure 7: Traffic Flow for Packet-Based Processing

Image g030004.gif

Filters and CoS features are typically associated with one or more interfaces to influence which packets are allowed to transit the system and to apply special actions to packets as necessary.

Note: Packet-based processing occurs only if you configure filters, CoS, IPv6, and MPLS features for an interface that handles the packet.

The following sections describe the kinds of packet-based features that you can configure and apply to transit traffic. For details on specific stateless firewall filters and CoS features, see the JUNOS Software Routing Protocols and Policies Configuration Guide for Security Devices, the JUNOS Software Class of Service Configuration Guide for Security Devices, and the JUNOS Software CLI Reference.

Stateless Firewall Filters

Also referred to as access control lists (ACLs), stateless firewall filters control access and limit traffic rates. They statically evaluate the contents of packets transiting the router from a source to a destination, or packets originating from or destined for the Routing Engine. A stateless firewall filter evaluates every packet, including fragmented packets.

You can apply a stateless firewall filter to an input or output interface, or to both. A filter contains one or more terms, and each terms consists of two components—match conditions and actions. By default, a packet that does not match a firewall filter is discarded.

You can plan and design stateless firewall filters to be used for various purposes—for example, to limit traffic to certain protocols, IP source or destination addresses, or data rates.

Class-of-Service Features

CoS features allow you to police and shape traffic.

Related Topics