Hi, As far as I remember the firewall filter will be showing zeroes unless traffic going through demux interface gets policed.
/ET From: Catalin Petrescu <[email protected]<mailto:[email protected]>> Date: Mon, 30 Sep 2013 09:38:53 +0300 To: Evgeny <[email protected]<mailto:[email protected]>> Cc: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>> Subject: Re: [j-nsp] MX240 static-subscribers radius policy Hi, I've tested this on mx80 and works , so probably is MPC specific. filter 2M { interface-specific; term 10 { then { count 2M; accept; } } filter 5M { interface-specific; term 10 { then { count 5M; accept; } } ... junos 11.4R7.5. Regards, Catalin On Mon, Sep 30, 2013 at 8:39 AM, Terebizh, Evgeny <[email protected]<mailto:[email protected]>> wrote: Hi Please share the firewall filter configuration. /ET On 9/27/13 2:14 PM, "Catalin Petrescu" <[email protected]<mailto:[email protected]>> wrote: >I have a dynamic profile for static subscribers configure as below: > >root@MX240-1-R6# show dynamic-profiles 9 >interfaces { > "$junos-interface-ifd-name" { > unit "$junos-underlying-interface-unit" { > family inet { > filter { > input "$junos-input-filter"; > output "$junos-output-filter"; > } > } > } > } >} > >root@MX240-1-R6# show system services static-subscribers >access-profile { > sbr; >} >dynamic-profile { > 9; >} >authentication { > password "$9$At-bp1RcylMLx"; ## SECRET-DATA > username-include { > interface; > } >} >group IP1 { > interface demux0.1; >} > >The user is authenticated and the filter are activated but only input >works. > >root@MX240-1-R6> show subscribers >Interface IP Address/VLAN ID User Name > LS:RI >demux0.1 100.100.100.6 demux0.1 > default:default > >root@MX240-1-R6> show firewall > >ilter: 2M-demux0.1-in >Counters: >Name Bytes > Packets >2M-demux0.1-in 1596 >19 > >Filter: 5M-demux0.1-out >Counters: >Name Bytes > Packets >5M-demux0.1-out 0 > 0 > > >output counters is always 0. > >No idea why this is happening , with dynamic clients with dhcp output >filter is working. > > >Many thanks, > >Catalin Petrescu >_______________________________________________ >juniper-nsp mailing list >[email protected]<mailto:[email protected]> >https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
