downgrade to 9.3R4.4 then On Thu, Dec 6, 2012 at 6:47 PM, Caillin Bathern <[email protected]> wrote: > This just becomes long and painful when you want to run the box as an MPLS > device primarily and as an IPSec/Crypto box for some traffic.. > > -----Original Message----- > From: 叶雨飞 [mailto:[email protected]] > Sent: Friday, 7 December 2012 12:21 PM > To: Caillin Bathern > Cc: [email protected] > Subject: Re: [j-nsp] SRX, UDP traffic, routing asymmetry > > you can run your main routing instance in flow mode , and apply filters to > send those into other VRs (flow or not) for further processing. > > On Thu, Dec 6, 2012 at 4:45 PM, Caillin Bathern <[email protected]> > wrote: >> Sigh.. If only there was "selective flow mode" on the SRX/J... >> >> -----Original Message----- >> From: [email protected] >> [mailto:[email protected]] On Behalf Of Per >> Westerlund >> Sent: Friday, 7 December 2012 4:24 AM >> To: Phil Mayers; Dale Shaw >> Cc: [email protected] >> Subject: Re: [j-nsp] SRX, UDP traffic, routing asymmetry >> >> This is a flow mode configuration (Juniper calls it "router mode", not >> "packet mode"), that emulates pure packet mode by allowing all packets >> to start a flow, and having a default permit-all for all flows. >> >> The sole reason for having this is to enable flow-mode things like >> IPsec and NAT at the same time as having almost the same behavior as >> pure packet mode. >> >> I am working on another mail or two with examples of "selective packet >> mode" that I believe might solve Dale's original problem (and perhaps >> his quest for pure routing with IPsec). >> >> /Per >> >> 6 dec 2012 kl. 14:15 skrev Phil Mayers: >> >>> On 06/12/12 10:58, Per Westerlund wrote: >>>> To follow up my own post (even more to follow), here is the config >>>> you use on a J-series router to put it in router-mode. Nothing >>>> magic, >> >>>> just some configuration. This will work with SRX as well, there is >>>> nothing J-series specific in here. This config is found in >>>> /etc/config/jsr-series-routermode-factory.conf, and the box I picked >>>> it from was running Junos 10.2R4.8 >>> >>> Is this *actually* in router mode, or is it just in a permit-all flow >> mode? >>> >>> In particularly, you seem to be missing a "packet-mode" statement for >>> IPv4 or MPLS (which also disables flow mode for IPv4) >>> >>> What does "show security flow status" say? >>> _______________________________________________ >>> juniper-nsp mailing list [email protected] >>> https://puck.nether.net/mailman/listinfo/juniper-nsp >> >> >> _______________________________________________ >> juniper-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/juniper-nsp >> -- >> Message protected by MailGuard: e-mail anti-virus, anti-spam and >> content filtering.http://www.mailguard.com.au/mg >> >> >> _______________________________________________ >> juniper-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/juniper-nsp
_______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
