Understanding the Data Path for J Series Services Routers

Figure 8 shows the path of a data packet as it traverses through the services router. Refer to Figure 6 to see how the flow module in Figure 8 fits in with the architecture of the software.

Figure 8: Data Packet Traversing the Flow Module on the Services Router

Image g030005.gif

As a packet transits the router, it takes the following path. This packet “ walk” brings together the packet-based processing and flow-based processing that JUNOS Software performs on the packet.

Understanding the Forwarding Processing

JUNOS Software performs forwarding processing as follows:

The packet enters the system and is treated on a per-packet basis.
The system applies stateless policing filters and class-of-service (CoS) classification to the packet.
For details, see the JUNOS Software Routing Protocols and Policies Configuration Guide for Security Devices, the JUNOS Software Class of Service Configuration Guide for Security Devices, and the JUNOS Software CLI Reference.

Understanding the Session-Based Processing

After forwarding processing, JUNOS Software performs session lookup and either first-packet processing or fast-path processing on the packet.

Session Lookup

If the packet has not already been dropped, JUNOS Software performs session lookup to determine whether the packet belongs to an existing session. The system uses six match criteria to perform the session lookup:

Session token
Source and destination IP addresses
Source and destination ports
Protocol

If the packet does not match an existing session, the system creates a new session for it. This process is called the first-packet path. (See First-Packet Path Processing.)

If the packet matches a session, fast-path processing is performed. (See Fast-Path Processing.)

First-Packet Path Processing

If a packet does not match an existing session, JUNOS Software creates a new session for it as follows:

For the first packet, the system creates a session based on the routing for the packet and the policy lookup so that the packet becomes the first packet of a flow.
Depending on the protocol and whether the service is TCP or UDP, the session is programmed with a timeout value.
- For TCP, the default timeout is 30 minutes.
- For UDP, the default timeout is 1 minute.
You can configure these timeouts to be more aggressive or less aggressive. If you have changed the session timeout value, it is applied here. If no traffic uses the session during the service timeout period, the router ages out the session and releases its memory for reuse.
Firewall screens are applied.
Session initialization screens are applied.
Route lookup is performed.
The destination zone is determined:
1. The system determines a packet's incoming zone by the interface through which it arrives.
2. The system determines a packet's outgoing zone by route lookup.
Together they determine which policy is applied to the packet.
Policy lookup is performed.
The system checks the packet against policies you have defined to determine how the packet is to be treated.
If NAT is used, the system performs address allocation.
The system sets up the Application Layer Gateway (ALG) service vector.
The system creates and installs the session.
Decisions made for the first packet of a flow are cached in a flow table for use with following, related flows.
Fast—path processing is applied to the packet.

Fast-Path Processing

If a packet matches a session, JUNOS Software performs fast-path processing as follows:

Configured screens are applied.
TCP checks are performed.
NAT is applied.
Forwarding features are applied. (See the following topic Understanding Forwarding Features.)

Understanding Forwarding Features

After the packet has passed through session-based processing, JUNOS Software prepares the packet and transmits it:

Routing packet filters are applied.
Traffic shaping is applied.
The packet is transmitted.

For information about packet filters and CoS traffic shaping, see the JUNOS Software Class of Service Configuration Guide for Security Devices.