Can you add a default route in virtual-router PBR to point to next-table as inet.0?
- set virtual-router PBR routing-options static route 0.0.0.0/0 next-table inet.0 You will loose the granularity of defining the source address and port to forward the traffic but I am not sure if that matters in this case for reverse traffic. This route will forward all the return traffic received from port ge-0/1/0 to inet.0 for a second-level lookup if no specific route is found in PBR.inet.0 routing table. Thanks, Nilesh. On 12/2/09 6:17 PM, "Chris Evans" <[email protected]> wrote: > Question for you all.. > > We are a Cisco shop today primary and have some Juniper devices here and there > in the network. We have started an RFI for our next gen data center and > Juniper has provided some 8200's and 4200's for us to evaluate. We have come > up with a complication of how to introduce services into the environment.. > > Currently we have our server farms based on Cisco Catalyst 6500 switches. For > our services we have firewalling and load balancing in each server farm. > Introducing firewalling with an EX platform would not be an issue, however > load balancing appears to be. To avoic overloading the load balancers we > policy route select traffic to the load balancer instead of all traffic. In > general we just policy route http and https traffic to the load balancers > which then load balances on to the servers. We have to do the PBR ingress into > the container and also the return traffic from the server, as stateful flow > must be maintained. The policy apply points are on the layer 3 interfaces > between the distribution and core, as well as the VLAN interface service the > server segment. This easy to do in the Cisco world as we can apply a next-hop > for any traffic we chose via a simple route-map. > > Our difficulty comes when implementing this on a JUNOS platform as setting a > next-hop isn't possible with filter based forwarding. We have created the > firewall filters classifying the traffic which points it to another > routing-instance. This piece works fine, however the issues becomes the return > traffic. As all return traffic is in that routing-instance we have to create > another filter to punt this traffic back into the global/master > routing-instance. When you configure a firewall filter for the return traffic > and specify 'routing-instance master' it states this isn't valid, you cannot > create a master routing-instance either as its reserved.. It seems this is a > new thing for Juniper, how it's a new thing I cannot understand. > > Looking for details if anyone else has done anything like this. I have fear > this is another 'enterprise' not carrier feature that Juniper doesn't have. We > are running into many road blocks with their EX platform that prohibits us > from using it for our environment. We're finding this product line doesn't > even have the same level of critical features that a 5 year old Cisco platform > has. Pretty disappointing :( > > Here is the configuration that I did a spare M series box for grins.. Let me > know what you think and if you have ideas... > > Traffic would come into ge-1/3/0 destined for 172.16.1.140 port http, it would > leave towards the host via ge-0/1/0, return traffic would take this same path > backwards. > > Interface configuration: > ge-0/1/0 { > unit 0 { > family inet { > filter { > input RETURN; > } > address 172.16.1.129/25; > } > } > } > ge-1/3/0 { > unit 0 { > family inet { > filter { > input PBR; > } > address 192.168.1.252/24; > } > } > } > > Routing-Instance Configuration: > > PBR { > instance-type virtual-router; > interface ge-0/1/0.0; > } > > Firewall Configuration: > > filter RETURN { > interface-specific; > term term-1 { > from { > source-address { > 172.16.1.128/25; > } > protocol tcp; > source-port http; > } > then { > count RETURN; > log; > routing-instance master; ## 'master' is not defined > } > } > term ALL-ELSE { > then accept; > } > } > > filter PBR { > interface-specific; > term term-1 { > from { > destination-address { > 172.16.1.128/25; > } > protocol tcp; > destination-port http; > } > then { > count PBR; > routing-instance PBR; > } > } > term ALL-ELSE { > then accept; > } > } > > > Thanks > > Chris > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
