4

Here is a scenario and working route-map example for Policy base routing.
I'm new Junos i'm struggling with Firewall filters and Policy-statements in Junos.

Can you help me to convert this simple scenario from Cisco IOS to JUNOS equivalent.

What it does below it matchs a packet from any source but destination 200.100.30.248/29 and set its next hop to 192.168.1.1

Matching criteria using Access List 

access-list 104 permit ip any 202.100.30.248 0.0.0.7 log-input

Route-map 

route-map PBR permit 10
 match ip address 104
 set ip default next-hop 192.168.1.1

And at the End it is applied. 

interface FastEthernet0/1  
 ip address 172.16.1.2 255.255.255.252  
 ip policy route-map PBR
Improve this question
5
  • @TeunVink Like i create a firewall family inet filter and i match the source and destination IPs with that then i try to create policy-statement and try to match filter and try to set the next hop but i can't find next hop thing in that and also not able to match inet filter i created earlier.I just want this question answered for how to do this basic thing as a reference
    – Terminator
    Commented Oct 15, 2017 at 20:46
  • You're mixing up things here. Firewall filters are used for blocking or allowing traffic, not for defining routing policies, you'll need to define policy statements for that under the 'policy-options' section: juniper.net/documentation/en_US/junos/topics/reference/…
    – Teun Vink
    Commented Oct 15, 2017 at 20:50
  • 1
    By the way, Stack Exchanges are not meant for a 'please do my work' type of question. We're happy to help you, but you will need to do some work yourself by showing us what you've tried and where you ran into problems.
    – Teun Vink
    Commented Oct 15, 2017 at 20:52
  • @TeunVink I'm learning about juniper this isn't my work.
    – Terminator
    Commented Oct 15, 2017 at 20:57
  • 1
    @TeunVink simply means that we're not going to convert the configuration for you. Since there really isn't a decent way to answer the question without doing all of the work for you, I'll point you in the right direction, and if you have questions about that, you can edit your question or ask a new one. This particular solution in Juniper is called Filter-Based Forwarding.
    – Jordan Head
    Commented Oct 16, 2017 at 12:58

2 Answers 2

Reset to default
4

This feature in JunOS called Filter based forwarding. You can find configurations examples for MX platform here. Example with dual-ISP routing on SRX platform here

Here also working example for SRX platform. We have network, traffic from which should be routed thru non-default route, except local destination networks.

user@srx1400> show route 0/0 exact

inet.0: 450 destinations, 474 routes (450 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 69w5d 17:17:29
                    > to 111.111.111.111 via ge-0/0/1.0

Interface, behind which source addresses are located:

user@srx1400> show configuration interfaces ge-0/0/2.100

description "SRV";
vlan-id 100;
family inet {
    filter {
        input ge-0/0/1.100-in;
    }
    address 192.168.100.1/24;
}

Firewall filter:

user@srx1400> show configuration firewall filter ge-0/0/1.100-in

term inject-default {
    from {
        source-address {
            192.168.100.0/24;
        }
        destination-address {
            10.0.0.0/8 except;
            172.16.0.0/12 except;
            192.168.0.0/16 except;
            0.0.0.0/0;
        }
    }
    then {
        routing-instance ri_fw_injdefault;
    }
}
term default {
    then accept;
}

Routing instance configuration:

user@srx1400> show configuration routing-instances ri_fw_injdefault

instance-type forwarding;
routing-options {
    static {
        route 0.0.0.0/0 next-hop 222.222.222.222;
    }
}

Set up RIB-Groups:

user@srx1400> show configuration routing-options

interface-routes {
    rib-group inet fbf-group;
}
static {
...
}
rib-groups {
    fbf-group {
        import-rib [ inet.0 ri_fw_injdefault.inet.0 ];
    }

}

After all set, lets check routing table for ri_fw_injdefault instance:

user@srx1400> show route 0/0 exact table ri_fw_injdefault.inet.0

ri_fw_injdefault.inet.0: 81 destinations, 81 routes (81 active, 0 holddown, 
0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 38w1d 00:19:55
                    > to 222.222.222.222 via ge-0/0/3.0
Improve this answer
0

set firewall family inet filter PBR term 1 from destination-address 200.100.30.248/29

set firewall family inet filter PBR term 1 then routing-instance next-hop 192.168.1.1

set firewall family inet filter PBR term 2 then accept

set interfaces fe-0/0/1 unit 0 family inet filter input PBR

set interface fe-0/0/1 unit 0 familt inet address 172.16.1.2 255.255.255.252

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.