On 22/10/10 04:39, Barny Sanchez wrote:
High-end SRXs (SRX3000s and SRX5000s) do not support packet-based
only processing.
Branch SRX (SRX100s, SRX200s, SRX650s) support either packet-based
only, flow-based only or mixed mode (selective packet services).
Please refer to the following app note for some great examples:
https://www.juniper.net/us/en/local/pdf/app-notes/3500192-en.pdf
That is a very interesting document.
I spent a bit of time trying this today, but failed; I think the
lt-x/x/x are not available/usable for this under the J-series platforms
(JunOS 10.1) correct? Shame..
Do you know if it's possible on the SRX do the MPLS -> flow stuff with
no physical interfaces; for example:
ge-0/0/0.0 = mpls interface
lt-0/0/0.100 = vrf interface, packet mode
lt-0/0/0.101 = virtual-router FIREWALL, flow mode, "Trust" zone
lt-0/0/0.200 = virtual-router FIREWALL, flow mode, "Untrust" zone
lt-0/0/0.201 = virtual-router OUTSIDE, packet mode
ge-0/0/1.0 = virtual-router OUTSIDE, packet mode
...i.e. traffic flows:
1. Labelled into ge-0/0/0.0
2. Label popped, packet-mode into lt.100
3. Into virtual router, lt.101 -> lt.200
4. Security policies applied
5. Egress from lt.201 -> ge-0/0/1.0
...and vice versa?
This would enable an SRX to be an MPLS one-armed firewall with only two
real/physical interfaces, and would be something we'd probably pay money
for!
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
