SRX

Expand all | Collapse all

Traceoption and packet filter for GRE encapsulated traffic on SRX

Jump to Best Answer
  • 1.  Traceoption and packet filter for GRE encapsulated traffic on SRX

    Posted 10-04-2017 12:00

    Hi everyone,

     

    Please coonsider the following scenario:

     

    H1-10.10.10.1---R1- f1199.199.199.1- tun10-------tun10---200.200.200.1 f1-SRX—10.10.11.2-G2

    R1 has GRE tun10 with tunnel source f1, tunnel destination 200.200.200.1

    SRX has GRE tunnel tun10 with tunnel source f1, tunnel destination 199.199.199.1

    H1 and H2 communicate with over GRE tunnel.

     

    If  I have  to do trace options using file and packet filter to see how packets received over GRE tunnel from R1 are treated inside SRX, should we define the packet filter  for trace option for GRE imposed IP i.e src 199.199.19.1 dest 200.200.200.1 or should we define packet filter for inner packet i.e. source 10.10.10.1 , destination 10.10.11.2?

     

     

    My hunch:

     

    We should define packet filter for traceoption  based on how packets arrived on SRX.  Above we have to analyze traces as traffic received from H1 to H2 over GRE tunnel, traffic will be arriving with GRE imposed header SRC 199.199.199.1 DEST 200.200.200.1, so if we define packet-filter for traceoption  based on these IP, we can see, how the packet is received, decapsulated,

     

    On the otherhand, we define packet filter for trace option  based on inner packet i,e src 10.10.10.1 dst 10.10.11.2, we will only see traces after the decapsulation by GRE.

    Not sure if the above is true .

     

    Thanks and have a nice day!!



  • 2.  RE: Traceoption and packet filter for GRE encapsulated traffic on SRX
    Best Answer

     
    Posted 10-04-2017 21:57
    Since GRE is terminated on SRX, you can apply traces for both address (GR end points and actual traffic end points). SRX flow will be able to see both of these.

    Let's say SRX was pass-through for GRE, then SRX will only see packets between GRE end points and will not be able to identify the internal traffic.


  • 3.  RE: Traceoption and packet filter for GRE encapsulated traffic on SRX

    Posted 10-05-2017 07:20

    Thanks Suraj