Example: Configuring HTTP Redirect Services Using a Next-Hop Method and Attaching It to a Static Interface

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

1. Configure the HTTP redirect service by specifying the location to which a subscriber's initial Web browser session is redirected, enabling initial provisioning and service selection for the subscriber.

   content_copy zoom_out_map

   [edit services]
   user@host# edit captive-portal-content-delivery
   

2. Configure the service filter as a walled garden by defining the rule the router references when applying this HTTP service.

   content_copy zoom_out_map

   [edit services captive-portal-content-delivery]
   user@host# edit rule redirect
   

3. Specify that the rule matches traffic coming in on the interface.

   content_copy zoom_out_map

   [edit services captive-portal-content-delivery rule redirect]
   user@host# match-direction input
   

4. Create the term match and action properties for the CPCD rule for the HTTP service.

   content_copy zoom_out_map

   [edit services captive-portal-content-delivery rule redirect]
   user@host# set term REDIRECT then redirect http://redirection-portal/redirection/
   

5. Create the CPCD profile for the IP destination address to redirect the HTTP service.

   content_copy zoom_out_map

   [edit services captive-portal-content-delivery]
   user@host# edit profile http-redirect
   

6. Specify the CPCD rule for the HTTP service.

   content_copy zoom_out_map

   [edit services captive-portal-content-delivery profile http-redirect]
   user@host# set cpcd-rules redirect
   

7. Create the service set for the CPCD services.

   content_copy zoom_out_map

   [edit services service-set]
   user@host# edit http-redirect-sset
   

8. Specify the CPCD profile for the service set.

   content_copy zoom_out_map

   [edit services service-set http-redirect-sset]
   user@host# set captive-portal-content-delivery-profile http-redirect
   

9. Specify the interface name for the next-hop service for an inside and outside service interfaces and attach them to static interfaces.

   content_copy zoom_out_map

   [edit services service-set http-redirect-sset]
   user@host# set next-hop-service inside-service-interface ms-11/1/0.1
   user@host# set next-hop-service outside-service-interface ms-11/1/0.2
   

Results

From configuration mode, confirm your configuration by entering the show services command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
root@host# show services
captive-portal-content-delivery {
    rule redirect {
        match-direction input;
        term REDIRECT {
            then {
                redirect http://redirection-portal/redirection/;
            }
        }
    }
    profile http-redirect {
        cpcd-rules redirect;
    }
}
service-set http-redirect-sset {
    captive-portal-content-delivery-profile http-redirect;
    next-hop-service {
        inside-service-interface ms-11/1/0.1;
        outside-service-interface ms-11/1/0.2;
    }
}

If you are done configuring the device, enter commit from configuration mode.

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

1. Configure Junos OS to support the service package on a service interface on an MX Series 5G Universal Routing Platform with MS-MPCs/MS-MICs.

   content_copy zoom_out_map

   [edit chassis]
   user@host# edit fpc 11 pic 1 adaptive-services service-package
   

2. Configure the CPCD service package to run on the PIC. When the extension-provider statement is first configured, the PIC reboots.

   content_copy zoom_out_map

   [edit chassis fpc 11 pic 1 adaptive-services service-package]
   user@host# set extension-provider package jservices-cpcd
   

3. Enable PIC system logging to record or view system log messages on the PIC but do not include daemon, external, kernel, or Packet Forwarding Engine processes.

   content_copy zoom_out_map

   [edit chassis fpc 11 pic 1 adaptive-services service-package extension-provider]
   user@host# set extension-provider syslog daemon none
   user@host# set extension-provider syslog external none
   user@host# set extension-provider syslog kernel none
   user@host# set extension-provider syslog pfe none
   

Results

From configuration mode, confirm your configuration by entering the show chassis command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
root@host# show chassis
    fpc 11 {
        pic 1 {
            adaptive-services {
                service-package {
                    extension-provider {
                        package jservices-cpcd;
                        syslog {
                            daemon none;
                            external none;
                            kernel none;
                            pfe none;
                        }
                    }
                }
            }
        }
    }

If you are done configuring the device, enter commit from configuration mode.

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

1. Configure a Gigabit interface with a logical interface on which traffic arrives before it is redirected.

   content_copy zoom_out_map

   [edit interfaces]
   user@host# edit ge-0/0/1 unit 900
   

2. Assign a description and VLAN ID to the logical interface.

   content_copy zoom_out_map

   [edit interfaces ge-0/0/1 unit 900]
   user@host# set description VLAN-REDIRECT
   user@host# set vlan-id 900
   

3. Configure the IPv4 family for the interface.

   content_copy zoom_out_map

   [edit interfaces ge-0/0/1 unit 900]
   user@host# edit family inet
   

4. Configure an input filter to evaluate when packets are received and redirected on the interface.

   content_copy zoom_out_map

   [edit interfaces ge-0/0/1 unit 900 family inet]
   user@host# set filter input FF_HTTP_REDIR_IN
   

5. Configure an address for the input filter.

   content_copy zoom_out_map

   [edit interfaces ge-0/0/1 unit 900 family inet]
   user@host# set address 203.0.113.250/30
   

6. Configure service options to be applied on the Multiservices interface.

   content_copy zoom_out_map

   [edit interfaces]
   user@host# edit ms-11/1/0 services-options
   

   Note:

   The values configured for the service options are shown for example only. You must configure and provision appropriate values as per the requirement.

7. Specify the open and close timeout periods in seconds for Transmission Control Protocol (TCP) session establishment.

   content_copy zoom_out_map

   [edit interfaces ms-11/1/0 services-options]
   user@host# set open-timeout 4
   user@host# set close-timeout 2
   

8. Specify the inactivity timeout periods in seconds for established TCP and non-TCP sessions.

   content_copy zoom_out_map

   [edit interfaces ms-11/1/0 services-options]
   user@host# set inactivity-tcp-timeout 5
   set inactivity-non-tcp-timeout 5
   

9. Specify the session lifetime in seconds globally for the Multiservices interface.

   content_copy zoom_out_map

   [edit interfaces ms-11/1/0 services-options]
   user@host# set session-timeout 5
   

10. Specify the maximum number of keep-alive messages sent before a TCP session is allowed to time out.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0 services-options]
    user@host# set tcp-tickles 0
    

11. Configure a logical interface on the Multiservices interface.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0]
    user@host# edit unit 1
    

12. Configure the service domain to specify that the logical interface is used within the network.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0 unit 1]
    user@host# set service-domain inside
    

13. Configure the IPv4 address family on the logical interface.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0 unit 1]
    user@host# set family inet
    

14. Configure a second logical interface on the Multiservices interface.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0]
    user@host# edit unit 2
    

15. Configure the service domain to specify that the logical interface is used outside the network.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0 unit 2]
    user@host# set service-domain outside
    

16. Configure an output filter to redirect CPCD packets from the logical interface.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0 unit 2]
    user@host# set filter output FF_CPCD_REDIRECT_OUTPUT
    

17. Configure the IPv4 address family on the logical interface.

    content_copy zoom_out_map

    [edit interfaces ms-11/1/0 unit 2]
    user@host# set family inet
    

Results

From configuration mode, confirm your configuration by entering the show interfaces command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
root@host# show interfaces
ge-0/0/1 {
    unit 900 { 
        description VLAN-REDIRECT;
        vlan-id 900;
    }
    family inet {
        filter {
            input FF_HTTP_REDIR_IN;
        }
        address 203.0.113.250/30;
    }
}
ms-11/1/0 {
    services-options {
        open-timeout 4;
        close-timeout 2;
        inactivity-tcp-timeout 5;
        inactivity-non-tcp-timeout 5;
        session-timeout 5;
        tcp-tickles 0;
    }
    unit 1 {
        family inet;
        service-domain inside;
    }
    unit 2 {
        family inet {
            filter {
                output FF_CPCD_REDIRECT_OUTPUT;
            }
        }
        service-domain outside;
    }
}

If you are done configuring the device, enter commit from configuration mode.

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

1. Configure a routing instance.

   content_copy zoom_out_map

   [edit routing-instances]
   user@host# edit CPCD_REDIRECT
   

2. Configure a virtual router routing instance.

   content_copy zoom_out_map

   [edit routing-instances CPCD_REDIRECT]
   user@host# set instance-type virtual-router
   

3. Configure the two previously defined multiservices interfaces for the routing instance.

   content_copy zoom_out_map

   [edit routing-instances CPCD_REDIRECT]
   user@host# set interface ms-11/1/0.1
   user@host# set interface ms-11/1/0.2
   

4. Configure static routing options.

   content_copy zoom_out_map

   [edit routing-instances CPCD_REDIRECT]
   user@host# edit routing-options static
   

5. Assign the next-hop static interfaces to the routes and routing instance.

   content_copy zoom_out_map

   [edit routing-instances CPCD_REDIRECT routing-options static]
   user@host# set route 0.0.0.0/0 next-hop ms-11/1/0.1
   user@host# set route 203.0.113.0/24 next-hop ms-11/1/0.2
   

Results

From configuration mode, confirm your configuration by entering the show routing-instances command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
root@host# show routing-instances
CPCD_REDIRECT {
    instance-type virtual-router;
    interface ms-11/1/0.1;
    interface ms-11/1/0.2;
    routing-options {
        static {
            route 0.0.0.0/0 next-hop ms-11/1/0.1;
            route 203.0.113.0/24 next-hop ms-11/1/0.2;
        }
    }
}

If you are done configuring the device, enter commit from configuration mode.

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

1. Create a family for the service filter under the [edit firewall] hierarchy.

   content_copy zoom_out_map

   [edit firewall]
   user@host# edit family inet
   

2. Create an interface-specific filter to redirect output traffic for CPCD.

   content_copy zoom_out_map

   [edit firewall family inet]
   user@host# edit filter FF_CPCD_REDIRECT_OUTPUT
   

3. Specify that this is an interface-specific filter.

   content_copy zoom_out_map

   [edit firewall family inet filter FF_CPCD_REDIRECT_OUTPUT]
   user@host# set interface-specific
   

4. Create a filter term for the interface-specific filter for the walled garden.

   content_copy zoom_out_map

   [edit firewall family inet filter FF_CPCD_REDIRECT_OUTPUT]
   user@host# edit term One
   

5. Specify both the action to count default traffic and the default routing instance.

   content_copy zoom_out_map

   [edit firewall family inet filter FF_CPCD_REDIRECT_OUTPUT interface-specific term One]
   user@host# set then count back-to-default
   set then routing-instance default
   

6. Create a filter to redirect HTTP input traffic.

   content_copy zoom_out_map

   [edit firewall family inet]
   user@host# edit filter FF_HTTP_REDIR_IN
   

7. Specify that this is an interface-specific filter.

   content_copy zoom_out_map

   [edit firewall family inet filter FF_HTTP_REDIR_IN]
   user@host# set interface-specific
   

8. Create a filter term for the interface-specific filter for the walled garden.

   content_copy zoom_out_map

   [edit firewall family inet filter FF_HTTP_REDIR_IN]
   user@host# edit term ACCEPTED_PREFIXES
   

9. Specify the list of accepted prefixes as a match conditions for the walled garden’s filter.

   content_copy zoom_out_map

   [edit firewall family inet filter FF_HTTP_REDIR_IN term ACCEPTED_PREFIXES]
   user@host# set from prefix-list User-PRIVATE-Blocks-01
   

10. Specify the action to take for all the matching HTTP traffic.

    content_copy zoom_out_map

    [edit firewall family inet filter FF_HTTP_REDIR_IN term ACCEPTED_PREFIXES]
    user@host# set then next term
    

11. Create a second filter term for the walled garden’s filter.

    content_copy zoom_out_map

    [edit firewall family inet filter FF_HTTP_REDIR_IN interface-specific]
    user@host# edit term HTTP
    

12. Specify the protocol and destination port as match conditions for the walled garden’s filter.

    content_copy zoom_out_map

    [edit firewall family inet filter FF_HTTP_REDIR_IN term HTTP]
    user@host# set from protocol tcp
    user@host# set from destination-port http
    

13. Specify the action to take for matching HTTP traffic destined to flow outside of the walled garden.

    content_copy zoom_out_map

    [edit firewall family inet filter filter FF_HTTP_REDIR_IN interface-specific term HTTP]
    user@host# set then count HTTP
    user@host# set then forwarding-class best-effort
    user@host# set then routing-instance CPCD_REDIRECT
    

Results

From configuration mode, confirm your configuration by entering the show firewall command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
root@host# show firewall
family inet {
    filter FF_CPCD_REDIRECT_OUTPUT {
        interface-specific;
        term One {
            then {
                count back-to-default;
                routing-instance default;
            }
        }
    }
    filter FF_HTTP_REDIR_IN {
        interface-specific;
        term ACCEPTED_PREFIXES {
            from {
                prefix-list {
                    User-PRIVATE-Blocks-01;
                }
            }
            then next term;
        }
        term HTTP {
            from {
                protocol tcp;
                destination-port http;
            }
            then {
                count http;
                forwarding-class best-effort;
                routing-instance CPCD_REDIRECT;
            }
        }
    }
}

If you are done configuring the device, enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

1. Create a policy option and statement to use a private blocks prefix list under the [edit policy-options] hierarchy.

   content_copy zoom_out_map

   [edit policy-options]
   user@host# set policy-statement User-PRIVATE-Blocks-01
   

2. Configure the source address for the private blocks prefix list.

   content_copy zoom_out_map

   [edit policy-options policy-statement User-PRIVATE-Blocks-01]
   user@host# set 203.0.113.0/24
   

Results

From configuration mode, confirm your configuration by entering the show policy-options command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
root@host# show policy-options
policy-statement User-PRIVATE-Blocks-01 {
    203.0.113.0/24;
}

If you are done configuring the device, enter commit from configuration mode.

Purpose

Display the configured CPCD service set.

Action

From operational mode, enter the show services captive-portal-content-delivery service-set http-redirect-sset detail command.

user@host> show services captive-portal-content-delivery service-set http-redirect-sset detail
Service Set             Id       Profile         Compiled Rules 
http-redirect-sset       1        http-redirect     1                        
     

Meaning

The output lists the service set configured for CPCD services.

Purpose

Display details for a specific configured HTTP service rule for a walled garden.

Action

From operational mode, enter the show services captive-portal-content-delivery rule redirect term REDIRECT command.

user@host> show services captive-portal-content-delivery rule redirect term REDIRECT
Rule name: redirect
Rule match direction: input
Term name: term REDIRECT
Term action: redirect
Term action option: http://redirection-portal/redirection/

Meaning

The output lists rule and term details for a specific HTTP service rule configured for the walled garden.