close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Subscriber-Aware and Application-Aware Traffic Treatment Overview
- play_arrow Subscriber-Aware and Application-Aware Traffic Treatment Overview
  - Subscriber-Aware and Application-Aware Traffic Treatment Overview
  - Configuring Subscriber-Aware and Application-Aware Traffic Treatment Overview
play_arrow Applying Subscriber-Aware and Application-Aware Policies and Services
play_arrow Configuring Reporting for Subscriber-Aware Data Sessions
- play_arrow Configuring Reporting
play_arrow Modifying Subscriber-Aware Configuration
- play_arrow Modifying Subscriber-Aware Configuration in Maintenance Mode
play_arrow Monitoring and Troubleshooting
- play_arrow Monitoring and Troubleshooting
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

keyboard_arrow_right

Configuring Custom Application Signatures

date_range 06-Dec-23

arrow_backward

arrow_forward

Note:

Starting in Junos OS Release 19.3R2 and 19.4R1, application identification is also supported for Broadband Subscriber Management if you have enabled Next Gen Services on the MX240, MX480 or MX960 router with the MX-SPC3 card.

You can configure custom application definitions using custom signatures. These definitions enable identification of protocol bundles through deep packet inspection (DPI) for use by interested services in the service chain.

Before you configure custom application signatures, ensure that jservices-jdpi is configured on all required interfaces of your MS-MPC, or of your MX-SPC3 services card if you have enabled Next Gen Services on the MX240, MX480, or MX960. To review how to configure the package on your MS-MPC or MX-SPC3 services card:

For Junos OS Subscriber Aware, see Preconfigured Groups for Service PICs and for Session PICs Overview .
For Junos OS Broadband Subscriber Management, see Installing Services Packages for Subscriber Management Application-Aware Policy Management.

To configure one or more custom application signatures:

Specify a name for the application.

content_copy zoom_out_map
[edit services application-identification]
user@host# edit application application-name

For example:

content_copy zoom_out_map
[edit services application-identification]
user@host# edit application my:http

Specify a description for the application.

content_copy zoom_out_map
[edit services application-identification application application-name]
user@host# set description description

For example:

content_copy zoom_out_map
[edit services application-identification application my:http]
user@host# set description "Test application"

Specify an alternative name for the application.

content_copy zoom_out_map
[edit services application-identification application application-name]
user@host# set alt-name alt-name

For example:

content_copy zoom_out_map
[edit services application-identification application my:http]
user@host# set alt-name my:http-app

Enable saving of the application system cache (ASC).

content_copy zoom_out_map
[edit services application-identification application my:http]
user@host# set cacheable

Specify the name of the Junos OS release for compatibility.

content_copy zoom_out_map
[edit services application-identification application application-name]
user@host# set compatibility junos-compatibility-version

For example:

content_copy zoom_out_map
[edit services application-identification application my:http]
user@host# set compatibility 17.1

Specify any desired application tags, consisting of a user-defined name and value.

content_copy zoom_out_map
[edit services application-identification application application-name]
user@host# set tags tag-name tag-value

For example:

content_copy zoom_out_map
[edit services application-identification application my:http]
user@host# set tags traffic-type video-stream

Specify one or more address-based signatures.

Specify a destination address and destination port-range.

content_copy zoom_out_map
[edit services application-identification application application-name]
user@host# set filter ip 200.0.0.2/24 port-range [80]

Specify an ICMP-based signature.

Specify ICMP type and code.

content_copy zoom_out_map
[edit services application-identification application application-name]
user@host# set icmp-mapping type icmp-type code icmp-code 

For example:

content_copy zoom_out_map
[edit services application-identification application my:http]
user@host# set icmp-mapping type 33 code 34 

Specify an IP protocol-based signature.
1. Specify the IP protocol by protocol number.
  [edit services application-identification application application-name] user@host# set ip-protocol-mapping protocol protocol-number
  For example:
  [edit services application-identification application my:http] user@host# set ip-protocol-mapping protocol 103
  All ip-protocol-mappings are allowed except Protocol numbers 1,6,17 are not allowed to be configured under ip-protocol based signatures. If you try to configure protocols 1,6,17 under ip-protocol-mapping you will get commit errors.

Specify one or more Layer 4 and Layer 7 signatures using pattern matching in conjunction with a Layer 4 protocol.

Specify a name for the Layer 4 and Layer 7 signature.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type]
user@host# set signature l4-l7-signature-name

For example:

content_copy zoom_out_map
[edit services application-identification application my:http over http]
user@host# set signature myl3l7

Specify the order to be used if conflicts occur during the application classification. In such a case, the application with lowest order is classified.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name member member-name]
user@host# set order order

For example:

content_copy zoom_out_map
[edit services application-­identification application my:http over http signature myl3l7 member m01] 
user@host# set order 1

Specify the priority for using this signature instead of using any matched predefined signatures.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name]
user@host# set order-priority (high | low)

For example:

content_copy zoom_out_map
[edit services application-identification application my:http over http signature myl3l7]
user@host# set order-priority high

(Optional) Specify the protocol. If you are using Next Gen Services with the MX-SPC3 services card, do not perform this step.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name]
user@host# set protocol (http | ssl | tcp | udp)

For example:

content_copy zoom_out_map
[edit services application-identification application my:http over http signature myl3l7]
user@host# set protocol http

(Optional) Specify that members are to be matched in order.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name]
user@host# set chain-order

Specify a member. You can repeat this step to define up to four members.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name]
user@host# edit member member-name

For example:

content_copy zoom_out_map
[edit services application-identification application my:http over http signature myl3l7]
user@host# edit member m01

Specify the member’s identifying pattern.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name member member-name]
user@host# set pattern pattern

For example:

content_copy zoom_out_map
[edit services application-identification application my:http over http signature myl3l7 member m01]
user@host# set pattern "www\.facebook\.net"

Specify the direction of flows to which pattern matching is applied.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name member member-name]
user@host# set direction (any | client-to-server | server-to-client)

For example:

content_copy zoom_out_map
[edit services application-identification application my:http over http signature myl3l7 member m01]
user@host# set direction any

Specify the number of check-bytes. This option applies to TCP and UDP only.

content_copy zoom_out_map
[edit services application-identification application application-name over protocol-type signature l4-l7-signature-name member member-name]
user@host# set check-bytes max-bytes-to-check

For example:

content_copy zoom_out_map
[edit services application-­identification application my:http over http signature myl3l7 member m01] 
user@host# set check-bytes 5000

(For Next Gen Services with the MX-SPC3 services card only) After you have committed your changes, you can check the status of the custom signature commitment.
```
[edit services application-identification application my:http over http signature myl3l7 member m01] 
user@host> show services application-identification commit-status
```

arrow_backward PREVIOUS Downloading and Installing Predefined Junos OS Application Signature Packages

NEXT arrow_forward Uninstalling a Predefined Junos OS Application Signature Package

Subscriber-Aware and Application-Aware Traffic Treatment User Guide

Configuring Custom Application Signatures

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Subscriber-Aware and Application-Aware Traffic Treatment User Guide

Configuring Custom Application Signatures

Related Documentation

Stay in touch