Description

The Advanced Policy Based Routing (APBR) midstream function was introduced in Junos OS 15.1X49-D110 and 17.4R1 releases. However, when Network Address Translation (NAT) is used on an APBR device, the midstream function does not work as intended. Refer to KB32303 - [SRX] APBR mid-stream re-route does not change session NAT properties [juniper.net] for more information.

This article describes a use case when the APBR midstream function works.

Note: For more details about APBR, see Advanced Policy-Based Routing Midstream Support .

 

Solution

Scenario

  • APBR is configured on an SRX300 device at a branch office.

  • The Internet Gateway is located only at the Headquarters (HQ) and all traffic from the branch office goes through an SRX1500 device at HQ.

  • There is only one place where the source IP address can be translated in this example. ge-0/0/0 on SRX1500 is where NAT of the source IP address can occur.

  • The SRX300 device has two routes to reach the Internet Gateway. The default route is via the MPLS VPN but the goal is to route the web traffic via the IPsec Tunnel to indicate the successful working of the APBR function.

 

Topology

 

Configuration

SRX300 

set security policies default-policy permit-all
set security zones security-zone internet host-inbound-traffic system-services all
set security zones security-zone internet host-inbound-traffic protocols all
set security zones security-zone internet interfaces ge-0/0/0.0
set security zones security-zone internet interfaces st0.0
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust interfaces ge-0/0/1.0
set security zones security-zone trust advance-policy-based-routing-profile p1

set routing-options interface-routes rib-group inet apbr-group
set routing-options static route 0.0.0.0/0 next-hop 192.168.0.1
set routing-options rib-groups apbr-group import-rib inet.0
set routing-options rib-groups apbr-group import-rib APBR.inet.0

set security advance-policy-based-routing profile p1 rule http match dynamic-application junos:HTTP
set security advance-policy-based-routing profile p1 rule http match dynamic-application junos:HTTPS
set security advance-policy-based-routing profile p1 rule http then routing-instance APBR

set routing-instances APBR instance-type forwarding
set routing-instances APBR routing-options static route 0.0.0.0/0 next-hop st0.0
 

SRX1500

Note: The complete configuration on SRX1500 is omitted here for convenience and because the configuration itself is lengthy.

The important point, however, is that in this environment, the SRX1500 device must be configured with the no-syn-check option to bypass the TCP syn check because there is no TCP handshake for a re-routed session. 

set security flow tcp-session no-syn-check

With the above enhancement, the APBR midstream function can be applied to the first session of a cacheable application and to a non-cacheable application.

The following captures were collected for the first session of HTTP traffic through the MPLS VPN route and the IPsec VPN route.

  • Observe that the three-way handshake was done through the MPLS VPN route after which traffic was re-routed to the IPsec Tunnel.

  • When the SRX300 device received the HTTP GET command, the traffic hit the appid signature and the device re-routed the traffic to the IPsec Tunnel.

  • If the application is cacheable, the SRX device caches the destination IP and port in the application system cache. This cache information can be confirmed by using the show services application-identification application-system-cache command.

 

Packet capture at the MPLS VPN route

The following messages are a part of the security flow traceoptions log of the syn packet. It indicates that the outgoing interface was ge-0/0/0.0 . 

CID-0:THREAD_ID-01:RT:<192.168.60.10/50745->1.1.1.1/80;6,0x0> matched filter p1:
CID-0:THREAD_ID-01:RT: flow process pak fast ifl 73 in_ifp ge-0/0/1.0
CID-0:THREAD_ID-01:RT:  ge-0/0/1.0:192.168.60.10/50745->1.1.1.1/80, tcp, flag 2 syn
CID-0:THREAD_ID-01:RT:  flow_first_final_check: in <ge-0/0/1.0>, out <ge-0/0/0.0>
CID-0:THREAD_ID-01:RT:  flow session id 269860
 

Packet capture at the IPsec Tunnel route

The following messages are a part of the security flow traceoptions log of the HTTP GET packet. Note that the flow session ID is the same (ID 269860) but the outgoing interface has changed from ge-0/0/0.0 to st0.0 . 

CID-0:THREAD_ID-01:RT:<192.168.60.10/50745->1.1.1.1/80;6,0x0> matched filter p1:
CID-0:THREAD_ID-01:RT:packet [374] ipid = 23885, @0xddc440ce
CID-0:THREAD_ID-01:RT:---- flow_process_pkt: (thd 1): flow_ctxt type 15, common flag 0x0, mbuf 0x69302200, rtbl_idx = 0
CID-0:THREAD_ID-01:RT: flow process pak fast ifl 73 in_ifp ge-0/0/1.0
CID-0:THREAD_ID-01:RT:  ge-0/0/1.0:192.168.60.10/50745->1.1.1.1/80, tcp, flag 18
CID-0:THREAD_ID-01:RT:  flow session id 269860
CID-0:THREAD_ID-01:RT:flow_ipv4_rt_lkup_reroute: session 0x41e24 s2c if ge-0/0/0.0 -> st0.0
CID-0:THREAD_ID-01:RT:Flow log for route or nexthop change, reset counter, orig ifp ge-0/0/0.0, new ifp st0.0
 

Packet capture at the server side (between SRX1500 and the web server)

Note that the source IP address was translated from 192.168.60.1 to 100.100.100.1.

 

Verification

  • CLI command on SRX300 

root> show security advance-policy-based-routing statistics
Advance Profile Based Routing statistics:
  Sessions Processed               1164
  AppID cache hits                 574
  AppID requested                  595
  Rule matches                     340
  Route changed on cache hits      203
  Route changed midstream          137  <<< When APBR midstream works, counter increases.
  Zone mismatch                    0
  Drop on zone mismatch            0
  Next hop not found               0

  • Syslog on SRX300

The SRX device can be configured to generate a log message when APBR works. The following command is required to generate the syslog message: 

set security advance-policy-based-routing tunables enable-logging

When the above command is configured, the following message can be seen in the stream log.

Note: This message is not specific to the midstream function. The log message will also be seen when APBR works by cache hit.

Sample Log 

RT_FLOW: APPTRACK_SESSION_ROUTE_UPDATE: AppTrack route update: 192.168.60.10/63586->1.1.1.1/80 junos-http HTTP UNKNOWN 192.168.60.10/63586->1.1.1.1/80 N/A N/A 6 tr-un trust internet 58569 N/A N/A No p1 http APBR st0.0

 

Modification History

2018-11-30: Article reach extended to the Public user group