Configuring MAP-E on NFX Series Devices
Overview
This example describes how to configure Mapping of Address and Port with Encapsulation (MAP-E) functionality on NFX Series devices. For more information about MAP-E, see Mapping of Address and Port with Encapsulation on NFX Series Devices.
Requirements
This example uses the following hardware and software components:
NFX150 device running Junos OS Release 19.4R1, deployed as a customer edge (CE) device.
MX480 device, deployed as a border relay (BR) device.
Map physical interfaces to virtual interfaces. For more information, see Mapping Interfaces on NFX150 Devices.
Topology Overview
This topology shows how to configure MAP-E CE functionality on NFX Series devices. This topology also shows how the IPv4 packets from MAP-E CE devices are encapsulated and transported through an IPv4-over-IPv6 tunnel to MAP-E provider edge (PE) devices (also known as border relay [BR] devices) through an IPv6 routing topology, where the packets are detunneled for further processing. An MX Series device is used as the MAP-E BR device, which is a dual-stack device connected to both a public IPv4 network and an IPv6 MAP-E network.
Figure 1 shows the MAP-E deployment on NFX Series devices.
Configure an NFX Series Device as a MAP-E CE Device
To configure an NFX Series device as a MAP-E customer edge device:
Configure an MX Series Device as a BR Device
To configure an MX Series device as a border relay device:
Verify the MAP-E Configuration
Purpose
After completing the MAP-E configuration on an NFX Series device, you can verify the status of the MAP-E configuration.
Action
Verify the status of the packet flow:
user@host> show security flow session Session ID: 134218806, Policy name: my_ce/4, Timeout: 1800, Valid In: 10.10.10.2/57630 --> 203.0.113.2/22;tcp, Conn Tag: 0x0, If: ge-1/0/1.0, Pkts: 50, Bytes: 5797, Out: 203.0.113.2/22 --> 192.0.2.18/20691;tcp, Conn Tag: 0x0, If: lt-1/0/0.1, Pkts: 33, Bytes: 5697, Session ID: 134218807, Policy name: my_ce/4, Timeout: 1800, Valid In: 2001:db8:12:3400:c0:2:1200:3400/1 --> 2001:db8::a/1;ipip, Conn Tag: 0x0, If: lt-1/0/0.2, Pkts: 50, Bytes: 7797, Out: 2001:db8::a/1 --> 2001:db8:12:3400:c0:2:1200:3400/1;ipip, Conn Tag: 0x0, If: ge-1/0/2.0, Pkts: 33, Bytes: 7017, Total sessions: 2
Verify whether the IPv4 and IPv6 addresses are configured correctly:
user@host> show security softwires map-e domain mapce1 Role : CE Version : 3 Domain Name : mapce1 BR Address : 2001:db8::a/128 End User Ipv6 prefix : 2001:db8:12:3400::/56 BMR Mapping Rule : Rule Name : bmr Rule Ipv4 Prefix : 192.0.2.0/24 Rule Ipv6 Prefix : 2001:db8::/40 PSID offset : 6 PSID length : 8 EA bit length : 16 Port SetID : 0x34 MAP-E Ipv4 address : 192.0.2.18/32 MAP-E Ipv6 address : 2001:db8:12:3400:c0:2:1200:3400Verify the map rule statistics:
user@host> show security softwires map-e domain mapce1 statistics rule bmr BMR Rule Name :bmr Encapsulated packets :289 Decapsulated packets :269 Encapsulation errors :0 Decapsulation errors :0 Encapsulated fragmentation :0 Decapsulated fragmentation :0 Invalid port set :0 IPv6 address mismatch :0
View the details of the NAT source rule:
user@host> show security nat source rule all Total rules: 1 Total referenced IPv4/IPv6 ip-prefixes: 5/0 source NAT rule: r1 Rule-set: mape Rule-Id : 1 Rule position : 1 From zone : v4zone To interface : lt-1/0/0.1 : ge-1/0/1.0 Match Source addresses : 10.10.10.0 - 10.10.10.255 Destination addresses : 10.10.10.0 - 10.10.10.255 198.51.100.0 - 198.51.100.255 203.0.113.0 - 203.0.113.255 192.0.2.0 - 192.0.2.255 Action : my_mape Persistent NAT type : any-remote-host Persistent NAT mapping type : address-port-mapping Inactivity timeout : 300 Max session number : 30 Translation hits : 1 Successful sessions : 1 Failed sessions : 0 Number of sessions : 1View the details of the NAT source pool:
user@host> show security nat source pool all Total pools: 1 Pool name : my_mape Pool id : 4 Routing instance : default Host address base : 0.0.0.0 Map-e domain name : mapce1 Map-e rule name : bmr PSID offset : 6 PSID length : 8 PSID : 0x34 Port overloading : 1 Address assignment : no-paired Total addresses : 1 Translation hits : 1 Address range Single Ports Twin Ports 192.0.2.18 - 192.0.2.18 1 0 Total used ports : 1 0View the NAT source summary:
user@host> show security nat source summary show security nat source summary Total port number usage for port translation pool: 252 Maximum port number for port translation pool: 33554432 Total pools: 1 Pool Address Routing PAT Total Name Range Instance Address my_mape 192.0.2.18-192.0.2.18 default yes 1 Total rules: 1 Rule name Rule set From To Action r1 mape v4zone lt-1/0/0.1 my_mape r1 ge-1/0/1.0
View the persistent NAT table:
user@host> show security nat source persistent-nat-table all Internal Reflective Source Type Left_time/ Curr_Sess_Num/ Source In_IP In_Port I_Proto Ref_IP Ref_Port R_Proto NAT Pool Conf_time Max_Sess_Num NAT Rule 10.10.10.2 57630 tcp 192.0.2.18 20691 tcp my_mape any-remote-host -/300 1/30 r1
View the softwire statistics on the MX Series device:
user@host> show services inline softwire statistics mape Service PIC Name si-1/0/0 Control Plane Statistics MAPE ICMPv6 echo requests to softwire concentrator 0 MAPE ICMPv6 echo responses from softwire concentrator 0 MAPE Dropped ICMPv6 packets to softwire concentrator 0 Data Plane Statistics (v6-to-v4) Packets Bytes MAPE decaps 15034 1388760 MAPE ICMP decap errors 0 0 MAPE decap spoof errors 0 0 MAPE v6 reassembled 0 0 MAPE dropped v6 fragments 0 0 MAPE v6 unsupp protocol drops 0 0 Data Plane Statistics (v4-to-v6) Packets Bytes MAPE encaps 149544 223527457 MAPE ICMP encap errors 0 0 MAPE v6 mtu errors 0 0 MAPE v4 reassembled 0 0 MAPE dropped v4 fragments 0 0
Meaning
This section describes the output fields for the MAP-E configuration on NFX Series devices.
| Role | MAP-E is deployed on a CE device. Currently, only the CE role is supported. |
| Version | MAP-E version: MAP-E draft-3. |
| BR address | Border router address to be used as the destination address in the absence of a matching FMR rule. |
| Rule name | Name of the BMR or FMR rule configured. |
| Rule IPv4 prefix | IPv4 prefix in the BMR or FMR rule. |
| Rule IPv6 prefix | IPv6 prefix in the BMR or FMR rule. |
| Port set ID | Port set identifier, used to algorithmically identify a set of ports exclusively assigned to a CE device. |
| PSID offset | Port set identifier offset, used to specify the range of excluded ports. |
| PSID length | Port set identifier length, used to specify the sharing ratio. |
| EA bit length | Embedded address bit length, used to specify part of the IPv4 address or the PSID. |