Example: Passive Flow Monitoring Configuration on M, MX and T Series Routers

[edit]
interfaces {
                   so-0/0/0 { # Traffic enters the router on this interface.
        description “ input interface”;
        encapsulation ppp;
        unit 0 {
                             passive-monitor-mode; # Disables SONET keepalives.
            family inet {
                filter {
                                         input input-monitoring-filter; # The firewall filter is applied here.
                }
            }
        }
    }
                   so-0/1/0 { # Traffic enters the router on this interface.
        description “ input interface”;
        encapsulation ppp; 
        unit 0 {
                             passive-monitor-mode;  # Disables SONET keepalives.
            family inet {
                filter {
                                         input input-monitoring-filter;  # The firewall filter is applied here.
                }
            }
        }
    }
                   es-3/1/0 {  # This is where the TCP traffic enters the ES PIC.
        unit 0 {
            tunnel {
                source 10.8.8.1;
                destination 10.8.8.2;
            }
            family inet {
                ipsec-sa sa-esp;
                address 192.0.2.1/32 {
                    destination 192.0.2.2;
                }
            }
        }
    }
                   fe-3/0/0 { # Flow records exit here and travel to the flow server.
        description “ export interface to the flow server”;
        unit 0 {
            family inet;
            address 192.168.245.1/30;
        }
    }
                   fe-3/2/0 { # This export interface for UDP traffic leads to a packet analyzer.
        description “ export interface to the packet analyzer”;
        unit 0 {
            family inet {
                address 10.9.9.1/30;
            }
        }
    }
                   fe-3/2/1 {  # This IPSec tunnel source exports TCP traffic to a packet analyzer.
        unit 0 {
            family inet {
                address 10.8.8.1/30;
            }
        }
    }
                   mo-4/0/0 { # This marks the beginning of the monitoring services interfaces.
        unit 0 { # Unit 0 is part of the inet.0 routing table and generates flow records.
            family inet;
        }
                         unit 1 { # Unit 1 receives monitored traffic and is part of the VRF instance.
            family inet;
        }
    }
                   mo-4/1/0 {
        unit 0 { # Unit 0 is part of the inet.0 routing table and generates flow records.
            family inet;
        }
                         unit 1 { # Unit 1 receives monitored traffic and is part of the VRF instance.
            family inet;
        }
    }
                   mo-4/2/0 {
        unit 0 { # Unit 0 is part of the inet.0 routing table and generates flow records.
            family inet;
        }
                         unit 1 { # Unit 1 receives monitored traffic and is part of the VRF instance.
            family inet;
        }
    }
                   mo-4/3/0 {
        unit 0 { # Unit 0 is part of the inet.0 routing table and generates flow records.
            family inet;
        }
                         unit 1 { # Unit 1 receives monitored traffic and is part of the VRF instance.
            family inet;
        }
    }
                   vt-0/2/0 {  # The tunnel services interface receives the port-mirrored traffic.
        unit 0 {
            family inet {
                filter {
                                         input tunnel-interface-filter;  # The filter splits traffic into TCP and UDP
                }
            }
        }
    }
}
forwarding-options {
                   monitoring group1 {  # Monitored traffic is processed by the monitoring services
        family inet { # interfaces and flow records are sent to the flow server.
                               output {                 
                export-format cflowd-version-5;
                flow-active-timeout 60;
                flow-inactive-timeout 30;
                                   flow-server 192.168.245.2 port 2055; # IP address and port for server.
                                     interface mo-4/0/0.1 {  # Use monitoring services interfaces for output.
                    engine-id 1; # engine and interface-index statements are optional.
                    engine-type 1;
                    input-interface-index 44;
                    output-interface-index 54;
                                         source-address 192.168.245.1; # This is the IP address of fe-3/0/0.
                }
                interface mo-4/1/0.1 {
                    engine-id 2; # engine and interface-index statements are optional.
                    engine-type 1;
                    input-interface-index 45;
                    output-interface-index 55;
                    source-address 192.168.245.1; # This is the IP address of fe-3/0/0.
                }
                interface mo-4/2/0.1 {
                    engine-id 3; # engine and interface-index statements are optional.
                    engine-type 1;
                    input-interface-index 46;
                    output-interface-index 56;
                    source-address 192.168.245.1; # This is the IP address of fe-3/0/0.
                }
                interface mo-4/3/0.1 {
                    engine-id 4; # engine and interface-index statements are optional.
                    engine-type 1;
                    input-interface-index 47;
                    output-interface-index 57;
                                         source-address 192.168.245.1; # This is the IP address of fe-3/0/0.
                }
            }
        }
    }
                   port-mirroring {  # Copies the traffic and sends it to the Tunnel Services PIC.
        family inet {
            input {
                rate 1;
                run-length 1;
            }
            output {
                                   interface vt-0/2/0.0;                 
                no-filter-check;
            }
        }
    }
}
             routing-options { # This installs the interface routes into the forwarding instances.
                   interface-routes {             
        rib-group inet bc-vrf;
    }
    rib-groups {
        bc-vrf {
            import-rib [inet.0 tcp-routing-table.inet.0 udp-routing-table.inet.0];
        }
    }
    forwarding-table {
        export pplb; # Applies per-packet load balancing to the forwarding table.
    }
}
policy-options {
    policy-statement monitoring-vrf-import {
        then reject;
    }
    policy-statement monitoring-vrf-export {
        then reject;
    }
    policy-statement pplb {
        then {
            load-balance per-packet;
        }
    }
}
             security { # This sets IPSec options for the ES PIC.
    ipsec {
        proposal esp-sha1-3des {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 180;
        }
        policy esp-group2 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals esp-sha1-3des;
        }
        security-association sa-esp {
            mode tunnel;
            dynamic {
                ipsec-policy esp-group2;
            }
        }
    }
    ike {
        proposal ike-esp {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 180;
        }
        policy 10.8.8.2 {
            mode aggressive;
            proposals ike-esp;
            pre-shared-key ascii-text "$ABC123";
        }
    }
}
firewall {
    family inet {
        filter input-monitoring-filter { # This filter selects traffic to send into the VRF 
            term 1 { # instance and prepares the traffic for port mirroring.
                from {
                    destination-address {
                        10.7.0.0/16;
                    }
                }
                then {
                    port-mirror;
                    accept;
                }
            }
            term 2 {
                from {
                    destination-address {
                        10.6.0.0/16;
                    }
                }
                then accept;
            }
        }
                         filter tunnel-interface-filter {  # This filter breaks the port-mirrored traffic into two
            term tcp { # filter-based forwarding instances: TCP packets and UDP packets.
                from {
                    protocol tcp;
                }
                then { # This counts TCP packets and sends them into a TCP instance.
                    count tcp;
                    routing-instance tcp-routing-table;
                }
            }
            term udp {
                from {
                    protocol udp;
                }
                then { # This counts UDP packets and sends them into a UDP instance.
                    count udp;
                    routing-instance udp-routing-table;
                }
            }
            term rest {
                then {
                    count rest;
                    discard;
                }
            }
        }
    }
}
routing-instances {
                   monitoring-vrf { # This is the VRF instance where you send the traffic. It contains
        instance-type vrf; # the input interface and the monitoring services interfaces.
                       interface so-0/0/0.0; # Traffic enters the router on these input interfaces.
        interface so-0/1/0.0;
        interface mo-4/0/0.1;
        interface mo-4/1/0.1; # These are output interfaces (use them as
        interface mo-4/2/0.1; # output interfaces in your monitoring group). 
        interface mo-4/3/0.1;
        route-distinguisher 69:1;
        vrf-import monitoring-vrf-import;
        vrf-export monitoring-vrf-export;
        routing-options { # Sends traffic to a group of monitoring services interfaces.
            static {
                route 0.0.0.0/0 next-hop [mo-4/0/0.1 mo-4/1/0.1 
mo-4/2/0.1 mo-4/3/0.1];
            }
        }
    }
                   tcp-routing-table {  # This is the filter-based forwarding instance for TCP traffic.
        instance-type forwarding;
                         routing-options {  # The next hop is the ES PIC.
            static {
                route 0.0.0.0/0 next-hop es-3/1/0.0;
            }
        }
    }
    udp-routing-table { # This is the filter-based forwarding instance for UDP traffic.
        instance-type forwarding;
        routing-options { # The next hop is the second packet analyzer.
            static {
                route 0.0.0.0/0 next-hop 10.9.1.2;
            }
        }
    }
}