This just becomes long and painful when you want to run the box as an MPLS device primarily and as an IPSec/Crypto box for some traffic..
-----Original Message----- From: 叶雨飞 [mailto:[email protected]] Sent: Friday, 7 December 2012 12:21 PM To: Caillin Bathern Cc: [email protected] Subject: Re: [j-nsp] SRX, UDP traffic, routing asymmetry you can run your main routing instance in flow mode , and apply filters to send those into other VRs (flow or not) for further processing. On Thu, Dec 6, 2012 at 4:45 PM, Caillin Bathern <[email protected]> wrote: > Sigh.. If only there was "selective flow mode" on the SRX/J... > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Per > Westerlund > Sent: Friday, 7 December 2012 4:24 AM > To: Phil Mayers; Dale Shaw > Cc: [email protected] > Subject: Re: [j-nsp] SRX, UDP traffic, routing asymmetry > > This is a flow mode configuration (Juniper calls it "router mode", not > "packet mode"), that emulates pure packet mode by allowing all packets > to start a flow, and having a default permit-all for all flows. > > The sole reason for having this is to enable flow-mode things like > IPsec and NAT at the same time as having almost the same behavior as > pure packet mode. > > I am working on another mail or two with examples of "selective packet > mode" that I believe might solve Dale's original problem (and perhaps > his quest for pure routing with IPsec). > > /Per > > 6 dec 2012 kl. 14:15 skrev Phil Mayers: > >> On 06/12/12 10:58, Per Westerlund wrote: >>> To follow up my own post (even more to follow), here is the config >>> you use on a J-series router to put it in router-mode. Nothing >>> magic, > >>> just some configuration. This will work with SRX as well, there is >>> nothing J-series specific in here. This config is found in >>> /etc/config/jsr-series-routermode-factory.conf, and the box I picked >>> it from was running Junos 10.2R4.8 >> >> Is this *actually* in router mode, or is it just in a permit-all flow > mode? >> >> In particularly, you seem to be missing a "packet-mode" statement for >> IPv4 or MPLS (which also disables flow mode for IPv4) >> >> What does "show security flow status" say? >> _______________________________________________ >> juniper-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/juniper-nsp > > > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > -- > Message protected by MailGuard: e-mail anti-virus, anti-spam and > content filtering.http://www.mailguard.com.au/mg > > > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
