Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Enable Packet-Based Forwarding on Virtual Interfaces

Juniper Networks supports packet-based forwarding on virtual interfaces using CN2 Release 22.1 or later in a Kubernetes-orchestrated environment.

Overview

By default, Contrail compute nodes use flow mode for packet forwarding on a virtual interface. This means that every vRouter has a flow table to keep track of all flows that pass through it. In flow mode, the virtual interface processes all traffic by analyzing the state or session of traffic. However, in some instances you might want to switch from flow mode to packet mode. For example, you might want to achieve higher traffic-forwarding performance or get around certain limitations of flow mode.

In packet mode, the virtual interface processes the traffic on a per-packet basis and ignores all flow information. The main advantage of packet mode is that the processing type is stateless. Stateless mode means that the virtual interface does not keep track of session information or goes through traffic analysis to determine how a session is established.

Note:

Features that require a network policy (such as ACLs, security groups, and floating IPs) are unable to work in packet mode.

Configure Packet Mode on a Virtual Interface

To configure packet mode on a virtual interface:

  1. Verify that you are running flow mode. For example:
    Generate some traffic by pinging another pod in the same network. In this example, the pod's IP address is 25.26.27.2.
  2. Use the flow command-line tool to check for flows. The following example indicates that the virtualMachineInterface is in flow mode.
  3. Enable packet mode on the virtualMachineInterface.

    Create a patch file named packet-mode-patch.yaml, and set the VMI policy to true.

  4. Apply the patch.
    After you apply the patch flow mode switches to packet mode, as shown in the following example:
  5. Verify that packet mode is active.
    Generate traffic by pinging another pod in the same network that you pinged in Step 1.
  6. Use the flow command-line tool to check for flows.
    Success! No flows exist, which indicates that you are in packet mode.