I have a need to configure FBF on IPsec tunnel interface st0
SRX-300#set interfaces st0.10 family inet ?
Possible completions: <[Enter]> Execute this command> address Interface address/destination prefix+ apply-groups Groups from which to inherit configuration data+ apply-groups-except Don't inherit configuration data from these groups> dhcp-client Dynamic Host Configuration Protocol client configuration mtu Protocol family maximum transmission unit negotiate-address Negotiate address with remote> next-hop-tunnel One or more next-hop tunnel tables no-neighbor-learn Disable neighbor address learning on interface> sampling Interface sampling unconditional-src-learn Glean from arp packets even when source cannot be validated | Pipe through a command
SRX-300 is running 15.1X49, It does not even have the option to configure filters on st0 interface, is FBF only supported on physical interfaces on low end SRXes? I do see "filter" option available on higher end SRX boxes (SRX-5400 running 15.1), but I need to verify the configuration on small SRX boxes in the lab before applying to production boxes.
This option appears on my SRX-300 running 15.1X49-D100.
# set interfaces st0.10 family inet filter ? Possible completions:+ apply-groups Groups from which to inherit configuration data+ apply-groups-except Don't inherit configuration data from these groups group Group to which interface belongs (1..255)> input Filter to be applied to received packets+ input-list List of filter modules applied to received packets> output Filter to be applied to transmitted packets+ output-list List of filter modules applied to transmitted packets
Cool, thanks, I will upgrade SRX-300, feature parity on the same Junos but different platform is annoying.
I upgraded to D100, indeed, I am able to configure the FBF on st0 interface, but unfortunately, the FBF functionality does not work, I need to source based routing with next hop in different routing instances than the routing instance st0 interface is in, when traffic arrives at st0 interface, SRX does route lookup at current routing instance in stead of of in the routing table of egress instance, which of cause will fill, same FBF filter applied on non-st0 interface works perfectly.
Firewall filters are not supported on tunnel interfaces.
I am able to get around this limitation by routing incoming traffic on st0 to an external device (a MX) and then hairpin back on physical interface (tagged vlans) via isolated routing instances, traffic flow is convoluted, but it works.