When troubleshooting the operation of an MS-MPC, it may be useful to apply firewall filters to the MS interfaces. Whether to apply these filters in the input or output direction depends on the packet that you want to match on, for example, the NATed vs deNATed packet in the case of a NATing MS-MPC.
This article provides a simple example on how to apply firewall filters to MS interfaces.
Here we have an MX device (middle router) that NATs (and de-NATs) traffic between private router A and public router B.
+ | | INSIDE | OUTSIDE | | | +-----------+ SA=10.10.10.1 +-----+-----+ SA=100.100.100.1 +-----------+ | | DA=20.20.20.2 | | DA=20.20.20.2 | | | | 1 -----> | | 2 -----> | | | A +-----------------+ +------------------+ B | | | | | | | | | | NATing MX | | | | | SA=20.20.20.2 | | SA=20.20.20.2 | | | | DA=10.10.10.1 | | DA=100.100.100.1 | | | | <----- 4 | | <----- 3 | | | +-----------------+ +------------------+ | | | | | | | +-----------+ +-----+-----+ +-----------+ | | | | | | +
We first send a single ping from A to B. A sends Packet 1 to the MX router. The MX router then uses its MS-MPC to NAT it and sends Packet 2 to B. B replies with Packet 3. The MX router's MS-MPC de-NATs this packet and sends Packet 4 to A. The "inside" of the NATing MX router indicates where the packet has A’s original source address 10.10.10.1, whereas the "outside" indicates where the packet has A’s NAT address 100.100.100.1.
The diagram below describes how these four packets hit the MS interfaces created by the LU chip of the MS-MPC that is installed on the MX router.
+----------------------------------------------------------+ | | | MS-MPC | | | | +-----------+ | | | | | | | | | | | XLP | | | | | | | | | | | +-----+-----+ | | | | | | | | | +----------+ | | +-----+-----+ | | | | | | <--- 1 +------------+ | | | | +-------------+ ms-inside | | | | | | 4 ---> +------------+ | | | | | | | | MX FABRIC <------>| XM | | LU | | | | | | | | | | | | | | | | | 2 ---> +------------+ | | | | +-------------+ ms-outside | | | | | | <--- 3 +------------+ | | | +-----------+ | | | | +----------+ | | | +----------------------------------------------------------+
The flow of these four packets can be described as follows:
The packet is received from router A over the fabric by the XM Chip, forwarded to the LU Chip, which decides based on the services configuration fed to it from the RE that the packet needs to be sent to the XLP chip for NATing (and other services, if so configured). The path to the XLP chip goes through the XM. And so the LU sends the packet to the XM chip. This is Packet 1.
After the XLP NATs the packet, it sends it to the XM Chip, which forwards it to the LU Chip. This is Packet 2.
The LU performs a forwarding lookup and sends it to the XM chip with information about how it should egress the router. The XM chip sends the packet to the fabric from where the packet goes on to exit the router on its way to router B, this time with a public NAT address instead of A’s source address. Router B replies to this packet, which is received over the fabric by the XM chip and forwarded to the LU Chip, which decides that the packet needs de-NATing by the XLP. So the LU sends the packet over to the XM chip. This is Packet 3.
The XM Chip sends the packet to the XLP chip, which de-NATs the packet and sends it back to the XM chip. The XM chip sends the de-NATed packet to the LU chip. This is Packet 4.
The LU chip performs a forwarding lookup on the packet and sends it back to the XM chip with information about how it should egress the router. The XM chip in turn sends the packet to the fabric from where the packet goes on to exit the router on its way back to router A, thus completing its journey.
The following filters can be configured to match on and count these four packets:
set firewall family inet filter count-packet-1 term 1 from source-address 10.10.10.1/32 set firewall family inet filter count-packet-1 term 1 from destination-address 20.20.20.2/32 set firewall family inet filter count-packet-1 term 1 then count packet-1
set firewall family inet filter count-packet-2 term 1 from source-address 100.100.100.1/32 set firewall family inet filter count-packet-2 term 1 from destination-address 20.20.20.2/32 set firewall family inet filter count-packet-2 term 1 then count packet-2
set firewall family inet filter count-packet-3 term 1 from source-address 20.20.20.2/32 set firewall family inet filter count-packet-3 term 1 from destination-address 100.100.100.1/32 set firewall family inet filter count-packet-3 term 1 then count packet-3
set firewall family inet filter count-packet-4 term 1 from source-address 20.20.20.2/32 set firewall family inet filter count-packet-4 term 1 from destination-address 10.10.10.1/32 set firewall family inet filter count-packet-4 term 1 then count packet-4
The directions in which to apply these filters to the "inside" and "outside" interfaces of the MS-MPC are as follows:
set interfaces ms-8/0/0 unit 0 family inet
set interfaces ms-8/0/0 unit 1 service-domain inside set interfaces ms-8/0/0 unit 1 family inet filter input count-packet-4 set interfaces ms-8/0/0 unit 1 family inet filter output count-packet-1
set interfaces ms-8/0/0 unit 2 service-domain outside set interfaces ms-8/0/0 unit 2 family inet filter input count-packet-2 set interfaces ms-8/0/0 unit 2 family inet filter output count-packet-3
Now a single ping from A to B will result in an increment in all the configured counters as follows:
user@test> show firewall Filter: count-packet-1 Counters: Name Bytes Packets packet-1 84 1 Filter: count-packet-2 Counters: Name Bytes Packets packet-2 84 1 Filter: count-packet-3 Counters: Name Bytes Packets packet-3 84 1 Filter: count-packet-4 Counters: Name Bytes Packets packet-4 84 1