Hi Saku,
Many thanks for your reply.
Could you expand a bit more about potential limitations that I might run
into in the future with this forwarding-options based setup?
Mostly concerned about these two:
- egress iface filter requires that egress is IP tagged (trinity
allows mpls)
- if egress forw FW filter is used, interface filter groups
cannot be used
The router that this is being deployed on will likely be a part of a
mpls backbone at a later date.
On 9/13/2016 11:10 PM, Saku Ytti wrote:
On 13 September 2016 at 14:35, Paul S. <[email protected]> wrote:
Hey Paul,
Issue is, the filter only works when it's applied to the
'forwarding-options' level of hierarchy, not the interface itself. i.e: If I
apply it to 'unit 0 family inet filter input filter-dcu-local,' ...it does
absolutely nothing.
I wish I had good news for you. From my notes when labbing this many
many years ago:
Flow is:
packet > ingress int FW > SCU > ingress forw FW > DCU > egress
forw FW > egress int FW
This means:
- you cannot match on SCU/DCU at all in ingress iface
- you can do SCU matches in ingress forwarding fw filter, but not DCU
- you can do SCU and DSU matches in egress forwarding filter and
egress iface filter
- egress iface filter requires that egress is IP tagged (trinity
allows mpls)
- if egress forw FW filter is used, interface filter groups cannot be
used
These limitations are certainly from IP2 days, I can't imagine Trio HW
imposing these limits. If you have leverage to JNPR, I'm confident it
would be possible to consider DCU/SCU in ingress interface filter.
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
