forwarding-options (Security)
Syntax
forwarding-options {
allow-dataplane-sleep;
family {
inet6 {
mode (drop | flow-based | packet-based);
}
iso {
mode packet-based;
}
mpls {
mode (flow-based | packet-based);
}
}
mirror-filter filter-name;
mode {
tap {
inspect-pass-through-tunnel {
gre;
ipip;
}
interface [ interface ... ];
}
}
receive-side-scaling {
nic-rss {
mode disable;
}
software-rss {
io-thread-number io-thread-number;
mode(automatic | disable | enable);
}
}
resource-manager {
cpu {
re re;
}
enhanced-logging;
}
secure-wire name;
security-service {
fail-open;
}
}Hierarchy Level
[edit security]
Description
Determine how the inet6, iso, and mpls protocol families manage security forwarding options.
Packet-based processing is not supported on the following SRX Series Firewalls: SRX5400, SRX5600, and SRX5800.
On SRX Series Firewalls, the default mode for processing traffic is flow mode. You can configure SRX Series Firewalls to operate in packet mode to process MPLS packets.
To configure the packet mode on SRX Series Firewall, use the following command:
user@host# set security forwarding-options family mpls mode packet-basedSelective stateless packet-based services allows you to configure the device to provide only packet-based processing for selected traffic based on input filter terms.
Options
| allow-dataplane-sleep | Enable sleep on dataplane. |
| family | Specify the protocol family to be used for packet forwarding.
|
| mirror-filter | Specify a mirror filter for filtering X2 packets to be mirrored and sent to a packet analyzer. |
| mode | Specify TAP or Sniffer mode.
|
| receive-side-scaling | Receive side scaling (RSS) enables the efficient distribution of network receive processing across multiple CPUs in multiprocessor systems.
|
| resource-manager | Display forward option status, the CPU, and memory allocated for the advance services to verify the vCPU allocation between routing engine and flow RT threads.
|
| secure-wire | Specify a name for the secure wire interface mapping. |
| security-service | Security service actions when memory resource is in shortage. The system resource management guarantees the resources are used according to priorities.
|
The remaining statements are explained separately. See CLI Explorer.
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 8.5.
secure-wire option introduced in Junos OS Release 19.3R1.
resource-manager option introduced in Junos OS Release 19.4R1 for vSRX Virtual Firewall.
mode option introduced in Junos OS Release 20.1R1.
enhanced-logging option introduced in Junos OS Release 23.1R1 to assign a dedicated CPU resource for on-box logging.