Could you please share the filter configuration and how you applied it on the inside interface?
You can filter traffic going over the IPSec tunnel i.e. From clear-->encrypted direction by applying an output firewall filter to sp- inside interface. To filter the traffic after it is decrypted from IPSec tunnel, you need apply an input filter to sp- inside interface. You can not apply a filter to match the internal (encrypted) IP header on sp- outside interface (in either direction) since on outside you will always receive encrypted traffic (in both direction) with an outer IP header consisting of local-gateway and remote-gateway. We will not see the original IP header inside the payload that you are trying to filter on since its encrypted. Try to narrow down the problem with filter using counters to see if the traffic is even hitting the filter terms. Thanks, Nilesh On 2/2/09 12:41 PM, "Matt Stevens" <[email protected]> wrote: > Nilesh, > > I actually tried it in both directions - neither seemed to work. JTAC > keeps trying to steer me towards JunOS enhanced services. > > I find it a little surprising that I can't filter traffic going over the > tunnel. I imagine I could do GRE over IPSec - but that would require a > pretty large change to our current IPSec mesh. _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
