Article Detail

Description

Flex filters can be used in an MX Trio family. They can be used to match L2, L3, L4 or payload locations. Additional offset criterias can be specified, thereby enabling pattern matches at custom, user-defined locations within a packet.

Flexible match filter terms are constructed by giving a start location or anchor point within the packet. The start locations can be any of: layer-2, layer-3, layer-4 or payload, depending on the protocol family in use. The MPLS available start locations are Layer-3 and payload.

This article explains how to use a flex filter for family MPLS

Solution

In the topology below, it is performing a ping with pattern 0xbadc0ffe from PE1 to PE2:

TOPO: (Src IP – 192.1.2.1 )PE1 ————— xe-0/2/0 P1—————P2—————PE2 (DST IP – 192.0.0.7)
                                   LabelIN – 300240

Ping the destination IP, then the ICMP requests with pattern go through the LSP.

LSP status on Transit P1 incoming label is 300240:

Transit LSP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
192.0.0.7       192.0.0.1       Up       0  1 FF  300240   299792 to-PE2

Take the following packet as an example: (ETHERNET MPLS IPV4 ICMP),

 0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15
AC 4B C8 45 80 A4 9C CC 83 09 41 00 88 47 49 4D
01 40 45 00 04 04 61 46 00 00 40 01 E3 A9 c0 01
02 01 c0 00 00 07 08 00 B7 32 B0 A2 00 2C 5B F9
E6 E8 00 07 C9 20 BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE BA DC
0F FE BA DC 0F FE BA DC 0F FE BA DC 0F FE

Packet decoded:

```
Frame 1: 254 bytes on wire (2032 bits)
```

Ethernet II

Destination: JuniperN_45:80:a4 (ac:4b:c8:45:80:a4)

Source: JuniperN_09:41:00 (9c:cc:83:09:41:00)

Type: MPLS label switched packet (0x8847)

MultiProtocol Label Switching Header

0100 1001 0100 1101 0000 .... .... .... = MPLS Label: 300240

.... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0

.... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1

.... .... .... .... .... .... 0100 0000 = MPLS TTL: 64

Internet Protocol Version 4

```
0100 .... = Version: 4
```
```
.... 0101 = Header Length: 20 bytes (5)
```

Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)

```
Total Length: 1028
```
```
Identification: 0x6146 (24902)
```
```
Flags: 0x0000
```
```
Time to live: 64
```
```
Protocol: ICMP (1)
```
```
Header checksum: 0xe3a9
```
```
Header checksum status: Unverified
```
```
Source: 192.1.2.1
```
```
Destination: 192.0.0.7
```

```
Internet Control Message Protocol
```

Example configuration of flex filter:

Router# show firewall family mpls filter flex-filter   
interface-specific;
term 1 {
    from {
        flexible-match-range {
            match-start layer-3; <--- MPLS header 
            byte-offset 0;       <--- Byte offset is 0 as this is mpls filter and match starts from MPLS header
            bit-length 20;       <--- MPLS label size is 20 
            range 0x494D0;       <--- Label value 300240
        }
    }
    then {
        count labeledpkts;
        accept;
    }
}
term 2 {
    then {
        count remainingpkts;
        accept;
    }
}

labroot@fir# show interfaces ae0 | display set | match flex
set interfaces xe-0/2/0 unit 0 family mpls filter input flex-filter

labroot@fir# run show firewall    
Filter: __default_bpdu_filter__                                
Filter: flex-filter-xe-0/2/0.0-i                               
Counters:
Name                             Bytes       Packets
labeledpkts-xe-0/2/0.0-i       1032000          1000 <--pinged 1000 packets from PE1 to PE2 and flex filter was able to capture
remainingpkts-xe-0/2/0.0-i           0             0

Modification History

2022-10-28: Article reviewed for accuracy. Article is valid and relevant