Understanding Stateful and Stateless Data Processing for J Series Services Routers

JUNOS Software for J Series Services Routers integrates the world-class network security and routing capabilities of Juniper Networks.

JUNOS Software uses a modular architecture as shown in Figure 6. The operating system consists of discrete processes that implement specific features and functionality. These processes are compartmentalized with their associated data to provide functional independence, information privacy, and improved scalability.

Traffic that enters and exits a services router running JUNOS Software is processed according to features you configure, such as security policies, packet filters, and screens. For example, the software can determine:

Whether the packet is allowed into the router
Which class of service (CoS) to apply to the packet, if any
Which firewall screens to apply to the packet
Whether to send the packet through an IPsec tunnel
Whether the packet requires an Application Layer Gateway (ALG)
Whether to apply Network Address Translation (NAT) to translate the packet's address
The route the packet takes to reach its destination

Packets that enter and exit a services router running JUNOS Software undergo both packet-based and flow-based processing.

Flow-based, or stateful, packet processing treats related packets, or a stream of packets, in the same way. Packet treatment depends on characteristics that were established for the first packet of the packet stream, which is referred to as a flow.
Packet-based, or stateless, packet processing treats packets discretely. Each packet is assessed individually for treatment.

The software implements flow-based security and services, with packet-based application of filters, policers, traffic shapers, and other classification features as described in the following sections:

Understanding Flow-Based Processing

A packet undergoes flow-based processing after any packet-based filters and policers have been applied to it.

Figure 6 shows an architectural overview of traffic flow in a services router running JUNOS Software. See Figure 8 to follow the path of the traffic as it traverses through the flow services module.

Figure 6: Traffic Flow for Flow-Based Processing

Image g030006.gif

A flow is a stream of related packets that meet the same matching criteria and share the same characteristics. JUNOS Software treats packets belonging to the same flow in the same manner.

Configuration settings that determine the fate of a packet—such as the security policy that applies to it, whether the packet is sent through an IPsec tunnel, if it requires an Application Layer Gateway (ALG), if Network Address Translation (NAT) is applied to translate the packet's address—are assessed for the first packet of a flow. The settings are then applied to the rest of the packets in the flow.

To determine if a packet belongs to an existing flow, the router attempts to match the packet's information to that of an existing flow based on the following six match criteria:

Source address
Destination address
Source port
Destination port
Protocol
Session token

If the packet matches an existing flow, processing for the packet is assessed in the context of its flow state, which is maintained by the flow's session. If it does not match the session for an existing flow, the packet is used to create a flow state and a session is allocated for it.

Zones and Policies

The security policy to be used for the first packet of a flow is cached in a flow table for use with the same flow and closely related flows. Security policies are associated with zones. A zone is a collection of interfaces that define a security boundary. A packet's incoming zone, as determined by the interface through which it arrived, and its outgoing zone, as determined by the forwarding lookup, together determine which policy is used for packets of the flow.

Flows and Sessions

Flow-based packet processing, which is stateful, requires the creation of sessions. A session is created, based on the characteristics assessed for the first packet of a flow, for the following purposes:

To store the security measures to be applied to the packets of the flow
To cache information about the state of the flow
For example, logging and counting information for a flow is cached in its session. (Some stateful firewall screens rely on threshold values that pertain to individual sessions or across all sessions.)
To allocate required resources for the flow for features such as Network Address Translation (NAT) and IPsec tunnels
To provide a framework for features such as Application Layer Gateways (ALGs) and firewall features

Most packet processing occurs in the context of a flow. The flow engine and session bring together the following features and events that affect a packet as it undergoes flow-based processing:

Flow-based forwarding
Session management, including session aging and changes in routes, policy, and interfaces
Management of virtual private networks (VPNs), ALGs, and authentication
Management of policies, NAT, zones, and screens

Policies can be configured to log session permit, close, and deny events.

Understanding Packet-Based Processing

A packet undergoes packet-based processing when it is dequeued from its input (ingress) interface and before it is enqueued on its output (egress) interface.

Packet-based processing applies stateless firewall filters and class-of-service (CoS) features to discrete packets. You can apply a firewall filter to an ingress or egress interface, or to both.

When a packet arrives at an interface on the router, any packet-based filters and policers associated with the interface are applied to the packet before any security policies are evaluated.
Before a packet leaves the router, any packet-based filters and traffic shapers associated with the output interface are applied to the packet after any security policies have been evaluated.

Figure 7 shows architectural overview of traffic flow in a standard JUNOS router.

Figure 7: Traffic Flow for Packet-Based Processing

Image g030004.gif

Filters and CoS features are typically associated with one or more interfaces to influence which packets are allowed to transit the system and to apply special actions to packets as necessary.

Note: Packet-based processing occurs only if you configure filters, CoS, IPv6, and MPLS features for an interface that handles the packet.

The following sections describe the kinds of packet-based features that you can configure and apply to transit traffic. For details on specific stateless firewall filters and CoS features, see the JUNOS Software Routing Protocols and Policies Configuration Guide for Security Devices, the JUNOS Software Class of Service Configuration Guide for Security Devices, and the JUNOS Software CLI Reference.

Stateless Firewall Filters

Also referred to as access control lists (ACLs), stateless firewall filters control access and limit traffic rates. They statically evaluate the contents of packets transiting the router from a source to a destination, or packets originating from or destined for the Routing Engine. A stateless firewall filter evaluates every packet, including fragmented packets.

You can apply a stateless firewall filter to an input or output interface, or to both. A filter contains one or more terms, and each terms consists of two components—match conditions and actions. By default, a packet that does not match a firewall filter is discarded.

You can plan and design stateless firewall filters to be used for various purposes—for example, to limit traffic to certain protocols, IP source or destination addresses, or data rates.

Class-of-Service Features

CoS features allow you to police and shape traffic.

Policing traffic—Policers allow you to limit traffic of a certain class to a specified bandwidth and burst size. Packets exceeding the policer limits can be discarded or assigned to a different forwarding class, a different loss priority, or both. You can use policers to limit the amount of traffic passing into or out of an interface.
Traffic shaping—You can shape traffic by assigning service levels with different delay, jitter, and packet loss characteristics to particular applications served by specific traffic flows. Traffic shaping is especially useful for real-time applications, such as voice and video transmission.