This article provides information about troubleshooting route lookups in custom routing-instances of type virtual-routers in SRX series platforms.
To understand how the route lookup works when using Virtual Routers in SRX series platforms
Below is a simple set up to explain the use of routing-instances. We have two zones named inside and DMZ, both with same subnet and want to reach the outside network. Two users, one in inside zone (10.20.30.2) and one in DMZ zone (10.20.30.101), which belong to same network want to access/SSH to 172.16.1.1 (loopback ip address of the other end device). Please refer to the highlighted portion to understand the concept of routing-instances and its various features, such as rib-group and next-table. Note : Use “flag all “ in security flow traceoptions, instead of basic-datapath.
[edit] root@test# run show route inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 10.20.30.0/24 *[Direct/0] 00:09:21 > via ge-0/0/1.0 10.20.30.1/32 *[Local/0] 00:10:40 Local via ge-0/0/1.0 172.16.1.1/32 *[Static/5] 00:03:25 > to 192.168.1.2 via ge-0/0/0.0 192.168.1.0/24 *[Direct/0] 00:03:25 > via ge-0/0/0.0 192.168.1.1/32 *[Local/0] 00:10:40 Local via ge-0/0/0.0 r1.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0 *[Static/5] 00:10:40 to table inet.0 10.20.30.0/24 *[Direct/0] 00:05:58 > via ge-0/0/2.0 10.20.30.100/32 *[Local/0] 00:10:40 Local via ge-0/0/2.0 [edit] root@test# run show security flow session Session ID: 3075, Policy name: i20/4, Timeout: 1724 In: 10.20.30.2/49159 --> 172.16.1.1/22;tcp, If: ge-0/0/1.0 Out: 172.16.1.1/22 --> 10.20.30.2/49159;tcp, If: ge-0/0/0.0 Session ID: 3096, Policy name: d20/5, Timeout: 1744 In: 10.20.30.101/49159 --> 172.16.1.1/22;tcp, If: ge-0/0/2.0 Out: 172.16.1.1/22 --> 10.20.30.101/49159;tcp, If: ge-0/0/0.0 2 sessions displayed
[edit security flow] root@test# show traceoptions { file ri; flag all; ( Use all instead of basic-datapath, as it shows the route lookup in detail inside routing-instance) packet-filter 1 { source-prefix 10.20.30.101/32; destination-prefix 172.16.1.1/32; } packet-filter 2 { source-prefix 172.16.1.1/32; destination-prefix 10.20.30.101/32; } packet-filter 3 { source-prefix 172.16.1.1/32; destination-prefix 10.20.30.2/32; } packet-filter 4 { source-prefix 10.20.30.2/32; destination-prefix 172.16.1.1/32; } }
Oct 28 03:10:28 03:10:28.656160:CID-0:RT:<10.20.30.101/49162->172.16.1.1/22;6> matched filter 1: Oct 28 03:10:28 03:10:28.656176:CID-0:RT:packet [52] ipid = 1011, @4b103b2e Oct 28 03:10:28 03:10:28.656183:CID-0:RT:---- flow_process_pkt: (thd 0): flow_ctxt type 0, common flag 0x0, mbuf 0x4b103920 Oct 28 03:10:28 03:10:28.656190:CID-0:RT: flow process pak fast ifl 73 in_ifp ge-0/0/2.0 Oct 28 03:10:28 03:10:28.656199:CID-0:RT: ge-0/0/2.0:10.20.30.101/49162->172.16.1.1/22, tcp, flag 2 syn Oct 28 03:10:28 03:10:28.656211:CID-0:RT: find flow: table 0x57c509e8, hash 64006(0xffff), sa 10.20.30.101, da 172.16.1.1, sp 49162, dp 22, proto 6, tok 648 Oct 28 03:10:28 03:10:28.656225:CID-0:RT: no session found, start first path. in_tunnel - 0, from_cp_flag - 0 Oct 28 03:10:28 03:10:28.656239:CID-0:RT: flow_first_create_session Oct 28 03:10:28 03:10:28.656248:CID-0:RT:Installing pending sess (3466) in ager Oct 28 03:10:28 03:10:28.656255:CID-0:RT:First path alloc and instl pending session, natp=0x4f7e9e40, id=3466 Oct 28 03:10:28 03:10:28.656262:CID-0:RT: flow_first_in_dst_nat: in <ge-0/0/2.0>, out <N/A> dst_adr 172.16.1.1, sp 49162, dp 22 Oct 28 03:10:28 03:10:28.656271:CID-0:RT: chose interface ge-0/0/2.0 as incoming nat if. Oct 28 03:10:28 03:10:28.656285:CID-0:RT:flow_first_rule_dst_xlate: DST no-xlate: 0.0.0.0(0) to 172.16.1.1(22) Oct 28 03:10:28 03:10:28.656295:CID-0:RT:flow_first_routing: call flow_route_lookup(): src_ip 10.20.30.101, x_dst_ip 172.16.1.1, in ifp ge-0/0/2.0, out ifp N/A sp 49162, dp 22, ip_proto 6, tos 0 Oct 28 03:10:28 03:10:28.656306:CID-0:RT:Doing DESTINATION addr route-lookup Oct 28 03:10:28 03:10:28.656311:CID-0:RT:flow_ipv4_rt_lkup in VR-id: 4 Oct 28 03:10:28 03:10:28.656321:CID-0:RT:flow_ipv4_rt_lkup: Found route entry 0x0x5a3e8548,nh id 0x1, out if 0x0 Oct 28 03:10:28 03:10:28.656328:CID-0:RT:flow_ipv4_rt_lkup: Route NH points to another table doing lookup again Oct 28 03:10:28 03:10:28.656335:CID-0:RT:flow_ipv4_rt_lkup in VR-id: 0 Oct 28 03:10:28 03:10:28.656341:CID-0:RT:flow_ipv4_rt_lkup: Found route entry 0x0x5a37feb0,nh id 0x23f, out if 0x45 Oct 28 03:10:28 03:10:28.656349:CID-0:RT:flow_ipv4_rt_lkup: nh word 0x60010 Oct 28 03:10:28 03:10:28.656355:CID-0:RT:flow_ipv4_rt_lkup success 172.16.1.1, iifl 0x49, oifl 0x45 Oct 28 03:10:28 03:10:28.656366:CID-0:RT: routed (x_dst_ip 172.16.1.1) from dmz (ge-0/0/2.0 in 0) to ge-0/0/0.0, Next-hop: 192.168.1.2 Oct 28 03:10:28 03:10:28.656399:CID-0:RT: policy search from zone dmz-> zone outside Oct 28 03:10:28 03:10:28.656430:CID-0:RT: app 22, timeout 1800s, curr ageout 20s Oct 28 03:10:28 03:10:28.656439:CID-0:RT:Permitted by policy 5 Oct 28 03:10:28 03:10:28.656451:CID-0:RT:flow_first_src_xlate: src nat 0.0.0.0(49162) to 172.16.1.1(22) returns status 0, rule/pool id 0/0. Oct 28 03:10:28 03:10:28.656464:CID-0:RT: dip id = 0/0, 10.20.30.101/49162->10.20.30.101/49162 Oct 28 03:10:28 03:10:28.656476:CID-0:RT: choose interface ge-0/0/0.0 as outgoing phy if Oct 28 03:10:28 03:10:28.656483:CID-0:RT:is_loop_pak: No loop: on ifp: ge-0/0/0.0, addr: 172.16.1.1, rtt_idx:0 Oct 28 03:10:28 03:10:28.656493:CID-0:RT:policy is NULL (wx/pim scenario) Oct 28 03:10:28 03:10:28.656503:CID-0:RT:sm_flow_interest_check: app_id 0, policy 5, app_svc_en 0, flags 0x2. not interested Oct 28 03:10:28 03:10:28.656513:CID-0:RT:sm_flow_interest_check: app_id 1, policy 5, app_svc_en 0, flags 0x2. not interested Oct 28 03:10:28 03:10:28.656523:CID-0:RT:flow_first_service_lookup(): natp(0x4f7e9e40): local_pak(0x4ce1b458.0x4b103920): TCP proxy NOT interested: 0. Oct 28 03:10:28 03:10:28.656532:CID-0:RT:tcp proxy not needed Oct 28 03:10:28 03:10:28.656537:CID-0:RT: service lookup identified service 22. Oct 28 03:10:28 03:10:28.656543:CID-0:RT: flow_first_final_check: in <ge-0/0/2.0>, out <ge-0/0/0.0> Oct 28 03:10:28 03:10:28.656550:CID-0:RT:In flow_first_complete_session Oct 28 03:10:28 03:10:28.656556:CID-0:RT: existing vector list 2-603a8728. Oct 28 03:10:28 03:10:28.656563:CID-0:RT: existing vector list 0-603e3c28. Oct 28 03:10:28 03:10:28.656568:CID-0:RT: Session (id:3466) created for first pak 2 Oct 28 03:10:28 03:10:28.656573:CID-0:RT:first pak processing successful Oct 28 03:10:28 03:10:28.656578:CID-0:RT: flow_first_install_session======> 0x4f7e9e40 Oct 28 03:10:28 03:10:28.656583:CID-0:RT: nsp 0x4f7e9e40, nsp2 0x4f7e9eb0 Oct 28 03:10:28 03:10:28.656590:CID-0:RT: make_nsp_ready_no_resolve() Oct 28 03:10:28 03:10:28.656598:CID-0:RT:flow_ipv4_rt_lkup in VR-id: 4 Oct 28 03:10:28 03:10:28.656605:CID-0:RT:flow_ipv4_rt_lkup: Found route entry 0x0x5a3f5020,nh id 0x220, out if 0x49 Oct 28 03:10:28 03:10:28.656613:CID-0:RT:flow_ipv4_rt_lkup: nh word 0x50010 Oct 28 03:10:28 03:10:28.656619:CID-0:RT:flow_ipv4_rt_lkup success 10.20.30.101, iifl 0x0, oifl 0x49 Oct 28 03:10:28 03:10:28.656630:CID-0:RT: route lookup: dest-ip 10.20.30.101 orig ifp ge-0/0/2.0 output_ifp ge-0/0/2.0 orig-zone 10 out-zone 10 vsd 0 Oct 28 03:10:28 03:10:28.656649:CID-0:RT: route to 10.20.30.101 Oct 28 03:10:28 03:10:28.656663:CID-0:RT:Installing c2s NP session wing Oct 28 03:10:28 03:10:28.656668:CID-0:RT: flow_spu_install_np_session: FLOW STUB Oct 28 03:10:28 03:10:28.656673:CID-0:RT:Installing s2c NP session wing Oct 28 03:10:28 03:10:28.656677:CID-0:RT: flow_spu_install_np_session: FLOW STUB Oct 28 03:10:28 03:10:28.656684:CID-0:RT:updating pending sess (3466) in ager Oct 28 03:10:28 03:10:28.656690:CID-0:RT:first path session installation succeeded Oct 28 03:10:28 03:10:28.656697:CID-0:RT: flow got session. Oct 28 03:10:28 03:10:28.656701:CID-0:RT: flow session id 3466 Oct 28 03:10:28 03:10:28.656712:CID-0:RT:flow_tcp_wsf_update: wsf 8 Oct 28 03:10:28 03:10:28.656718:CID-0:RT: tcp flags 0x2, flag 0x2 Oct 28 03:10:28 03:10:28.656723:CID-0:RT: Got syn, 10.20.30.101(49162)->172.16.1.1(22), nspflag 0x1021, 0x20 Oct 28 03:10:28 03:10:28.656737:CID-0:RT:mbuf 0x4b103920, exit nh 0x60010 Oct 28 03:10:28 03:10:28.656744:CID-0:RT: ----- flow_process_pkt rc 0x0 (fp rc 0) Oct 28 03:10:28 03:10:28.664087:CID-0:RT:<172.16.1.1/22->10.20.30.101/49162;6> matched filter 2: Oct 28 03:10:28 03:10:28.664102:CID-0:RT:packet [52] ipid = 39955, @4afa31ce Oct 28 03:10:28 03:10:28.664108:CID-0:RT:---- flow_process_pkt: (thd 0): flow_ctxt type 0, common flag 0x0, mbuf 0x4afa2fc0 Oct 28 03:10:28 03:10:28.664115:CID-0:RT: flow process pak fast ifl 69 in_ifp ge-0/0/0.0 Oct 28 03:10:28 03:10:28.664123:CID-0:RT: ge-0/0/0.0:172.16.1.1/22->10.20.30.101/49162, tcp, flag 12 syn ack Oct 28 03:10:28 03:10:28.664134:CID-0:RT: find flow: table 0x57c509e8, hash 49228(0xffff), sa 172.16.1.1, da 10.20.30.101, sp 22, dp 49162, proto 6, tok 704 Oct 28 03:10:28 03:10:28.664149:CID-0:RT:Found: session id 0xd8a. sess tok 704 Oct 28 03:10:28 03:10:28.664154:CID-0:RT: flow got session. Oct 28 03:10:28 03:10:28.664159:CID-0:RT: flow session id 3466 Oct 28 03:10:28 03:10:28.664169:CID-0:RT:flow_tcp_wsf_update: wsf 1 Oct 28 03:10:28 03:10:28.664175:CID-0:RT: tcp flags 0x12, flag 0x12 Oct 28 03:10:28 03:10:28.664180:CID-0:RT: Got syn_ack, 172.16.1.1(22)->10.20.30.101(49162), nspflag 0x1020, 0x1021 Oct 28 03:10:28 03:10:28.664194:CID-0:RT:mbuf 0x4afa2fc0, exit nh 0x50010 Oct 28 03:10:28 03:10:28.664200:CID-0:RT: ----- flow_process_pkt rc 0x0 (fp rc 0) Oct 28 03:10:28 03:10:28.664590:CID-0:RT:<10.20.30.101/49162->172.16.1.1/22;6> matched filter 1: Oct 28 03:10:28 03:10:28.664603:CID-0:RT:packet [40] ipid = 1012, @4afd150e Oct 28 03:10:28 03:10:28.664609:CID-0:RT:---- flow_process_pkt: (thd 0): flow_ctxt type 0, common flag 0x0, mbuf 0x4afd1300 Oct 28 03:10:28 03:10:28.664616:CID-0:RT: flow process pak fast ifl 73 in_ifp ge-0/0/2.0 Oct 28 03:10:28 03:10:28.664623:CID-0:RT: ge-0/0/2.0:10.20.30.101/49162->172.16.1.1/22, tcp, flag 10 Oct 28 03:10:28 03:10:28.664633:CID-0:RT: find flow: table 0x57c509e8, hash 64006(0xffff), sa 10.20.30.101, da 172.16.1.1, sp 49162, dp 22, proto 6, tok 648 Oct 28 03:10:28 03:10:28.664647:CID-0:RT:Found: session id 0xd8a. sess tok 648 Oct 28 03:10:28 03:10:28.664652:CID-0:RT: flow got session. Oct 28 03:10:28 03:10:28.664656:CID-0:RT: flow session id 3466 Oct 28 03:10:28 03:10:28.664665:CID-0:RT: tcp seq check. Oct 28 03:10:28 03:10:28.664670:CID-0:RT: tcp flags 0x10, flag 0x10 Oct 28 03:10:28 03:10:28.664676:CID-0:RT: refreshing session Oct 28 03:10:28 03:10:28.664681:CID-0:RT: Got ack, 10.20.30.101(49162)->172.16.1.1(22), natpflag 0x40, nspflag 0x1021, 0x1020, timeout=900 Oct 28 03:10:28 03:10:28.664695:CID-0:RT:mbuf 0x4afd1300, exit nh 0x60010 Oct 28 03:10:28 03:10:28.664702:CID-0:RT: ----- flow_process_pkt rc 0x0 (fp rc 0)
Logical interface ge-0/0/2.0 (Index 73) (SNMP ifIndex 163) Logical interface ge-0/0/0.0 (Index 69) (SNMP ifIndex 158)
[edit security flow] root@test# run start shell root@test% vty fwdd BSD platform (Pentium processor, 428MB memory, 16384KB flash) FWDD( vty)# sh route ip table Protocol: IPv4 Table Name Table Index # of Routes Bytes ------------------------------------------------------------------ __juniper_private1__.1 1 9 785 __juniper_private2__.2 2 6 521 __master.anon__.3 3 5 433 default.0 0 16 1399 r1.4 4 10 872 (Refer to Oct 28 03:10:28 03:10:28.656598: CID-0:RT:flow_ipv4_rt_lkup in VR-id: 4) FWDD( vty)# run exit