passive-mode-tunneling
Syntax
passive-mode-tunneling;
Hierarchy Level
[edit services service-set service-set-name ipsec-vpn-options]
Description
Allows tunneling of malformed packets. When this statement is enabled, traffic bypasses the usual active IP checks. The IPsec tunnel is not treated as a next hop and TTL is not decremented. If the packet size exceeds the tunnel MTU value, an ICMP error is not generated. Starting with Junos OS Release 13.3R4 and 14.2R1, passive mode tunneling is supported on MS-MICs and MS-MPCs.
The header-integrity-check option that is supported
on MS-MICs and MS-MPCs to verify the packet header for anomalies in
IP, TCP, UDP, and ICMP information and flag such anomalies and errors
has a functionality that is opposite to the functionality caused by
passive mode tunneling. If you configure both the header-integrity-check statement and the passive-mode tunneling statement on
MS-MICs and MS-MPCs, and attempt to commit such a configuration,
an error is displayed during commit.
The passive mode tunneling functionality (by including the passive-mode-tunnelin statement at the [edit services
service-set service-set-name ipsec-vpn-options] hierarchy level) is a superset of the capability to disable IPsec
tunnel endpoint in the traceroute output (by including no-ipsec-tunnel-in-traceroute statement at the [edit services ipsec-vpn] hierarchy
level). Passive mode tunneling also bypasses the active IP checks
and tunnel MTU check in addition to not treating an IPsec tunnel
as a next-hop as configured by the no-ipsec-tunnel-in-traceroute statement.
Required Privilege Level
admin—To view this statement in the configuration.
admin-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 10.0.