J-Flow version of the Internet Protocol Flow Information Export (IPFIX) configuration is supported under virtual routing and forwarding (VRF). The flow collector should be reachable through the default routing table (inet.0 or inet6.0). If the flow collector is reachable via a non-default VPN routing and forwarding table (VRF), flow records and templates can be exported.
This article will provide a workaround to send IPFIX to flow server inside routing-instance.
The following setup will demonstrate sample traffic in the routing-instance and send flows to flow server via the same routing-instance .
routing-instance
Routing-instance = INTERNET
SERVER ---<ge-1/2/1> VR <ge-1/1/9>---<ge-1/1/11> INTERNET <---------------configuration ------------------>
set chassis tfeb slot 0 sampling-instance snake
set interfaces ge-1/1/9 unit 0 family inet address 100.101.1.1/30 --> VR interface set interfaces ge-1/1/11 unit 0 family inet filter input v4-sample set interfaces ge-1/1/11 unit 0 family inet address 100.101.1.2/30 ---> INTERNET interface set interfaces ge-1/2/1 unit 0 family inet address 159.10.10.1/30 --> connected to FLOW SERVER in VR instance set interfaces lo0 unit 1 family inet address 199.1.1.1/32 ---> INTERNET interface set firewall family inet filter v4-sample term 1 then count sample-count set firewall family inet filter v4-sample term 1 then sample set firewall family inet filter v4-sample term 1 then accept set services flow-monitoring version-ipfix template ipv4 flow-active-timeout 60 set services flow-monitoring version-ipfix template ipv4 flow-inactive-timeout 60 set services flow-monitoring version-ipfix template ipv4 template-refresh-rate packets 1000 set services flow-monitoring version-ipfix template ipv4 template-refresh-rate seconds 10 set services flow-monitoring version-ipfix template ipv4 option-refresh-rate packets 1000 set services flow-monitoring version-ipfix template ipv4 option-refresh-rate seconds 10 set services flow-monitoring version-ipfix template ipv4 ipv4-template set forwarding-options sampling instance snake input rate 1 set forwarding-options sampling instance snake family inet output flow-server 159.10.10.2 port 2055 <<<<<<<< server address set forwarding-options sampling instance snake family inet output flow-server 159.10.10.2 no-local-dump set forwarding-options sampling instance snake family inet output flow-server 159.10.10.2 version-ipfix template ipv4 set forwarding-options sampling instance snake family inet output inline-jflow source-address 100.101.1.2 lab@MX-80# show routing-instances INTERNET { instance-type vrf; interface ge-1/1/11.0; interface lo0.1; route-distinguisher 100:100; vrf-target target:100:100; protocols { ospf { rib-group VRF-to-G; <-- exported into Global via rib-groups *** area 0.0.0.0 { interface all; } } } } VR { instance-type virtual-router; interface ge-1/1/9.0; interface ge-1/2/1.0; <-- towards flow server protocols { ospf { area 0.0.0.0 { interface all; } } } } ================================================= lab# show routing-options rib-groups { VRF-to-G { import-rib [ INTERNET.inet.0 inet.0 ]; } } ================================================= lab@MX-80# show routing-instances INTERNET protocols ospf rib-group VRF-to-G; area 0.0.0.0 { interface all; } =================================================
Note : You can also use a static route for flow server pointing towards routing-instance instead of rib-groups.
Example: set routing-options static route 159.10.10.2/32 next-table INTERNET.inet.0
set routing-options static route 159.10.10.2/32 next-table INTERNET.inet.0
<----------------- configuration ------------------> <------------ verification & testing --------------> lab@MX-80> show route table INTERNET.inet.0 INTERNET.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 100.101.1.0/30 *[Direct/0] 00:31:53 > via ge-1/1/11.0 100.101.1.2/32 *[Local/0] 00:31:53 Local via ge-1/1/11.0 159.10.10.0/30 *[OSPF/10] 00:04:48, metric 2 > to 100.101.1.1 via ge-1/1/11.0 199.1.1.1/32 *[Direct/0] 00:31:53 > via lo0.1 224.0.0.5/32 *[OSPF/10] 00:31:54, metric 1 MultiRecv lab@MX-80> show route table VR.inet.0 VR.inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 100.101.1.0/30 *[Direct/0] 00:31:56 > via ge-1/1/9.0 100.101.1.1/32 *[Local/0] 00:31:56 Local via ge-1/1/9.0 159.10.10.0/30 *[Direct/0] 00:04:52 > via ge-1/2/1.0 159.10.10.1/32 *[Local/0] 00:30:36 Local via ge-1/2/1.0 199.1.1.1/32 *[OSPF/10] 00:31:06, metric 1 > to 100.101.1.2 via ge-1/1/9.0 224.0.0.5/32 *[OSPF/10] 00:31:57, metric 1 MultiRecv lab@MX-80> show route table inet.0 inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0 *[Static/5] 00:37:31 > to 10.141.227.100 via fxp0.0 10.141.227.0/24 *[Direct/0] 00:37:31 > via fxp0.0 10.141.227.80/32 *[Local/0] 22:11:01 Local via fxp0.0 159.10.10.0/30 *[OSPF/10] 00:04:58, metric 2 <-- Flow server route should be present in Global Instance > to 100.101.1.1 via ge-1/1/11.0 - lab@MX-80> ping 199.1.1.1 routing-instance VR rapid count 100 PING 199.1.1.1 (199.1.1.1): 56 data bytes !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! --- 199.1.1.1 ping statistics --- lab@MX-80> show firewall Filter: __default_bpdu_filter__ Filter: v4-sample Counters: Name Bytes Packets sample-count 92492 1202 <----------- verification & testing -------------->
Under the newer version, you will have the option to configure the routing instance name instead of using the rib-groups. This works only in VRF. The syntax is as follows:
Set forwarding-options sampling instance JTAC family inet output flow-server 1.1.1.1 routing-instance <VRF name>
In case you reach the collector over a VR instance, you can configure a VRF Import/Export Dummy policy to configure the VRF:
labroot@test-re0# show policy-options policy-statement Dummy | display set set policy-options policy-statement Dummy term 1 then reject [edit] labroot@test-re0# show routing-instances VRF | display set set routing-instances VRF instance-type vrf set routing-instances VRF vrf-import Dummy set routing-instances VRF vrf-export Dummy set routing-instances VRF route-distinguisher 1:1
Since IPFix/Version 9 will not support virtual-router instance for exporting the flows, the same configuration can be user for version 5.
set forwarding-options sampling family inet output flow-server 1.1.1.1 routing-instance
Note that this only works in VRF instance.
2020-06-12: Added to the end of the solution, steps on configuring the routing instance name in VRF.