This article demonstrates how to configure a flex filter to match MPLS packet types such as Path message, Resv message, Path-Tear, or Resv-Tear and to define the action to be taken when the packets are received.
Topology
lo0.0 lo0.0 192.168.1.1 192.168.1.4 R1 (xe-0/0/0 - 4.4.4.1/30)--------------------------------------------------------------------(4.4.4.2/30 - xe-0/0/0) R2 (DUT)
In this example, we demonstrate how to capture a Path-Tear message via a flex filter on R2.
R2 has sent a Path-Error message to R1
When this Path-Error message arrives from R2, R1 generates a Path-Tear message, which it sends to R2.
We will see how to capture this Path-Tear message in this example. The firewall filter configured in the example is set to discard the received Path-Tear message on R2.
In the following configuration, we have configured a firewall filter on R2 to capture the Path-Tear message that is sent by R1. R2 will receive the Path-Tear message on its xe-0/0/0 interface. In the example, we have applied the filter in the input direction.
Configuration
interfaces { xe-0/0/0 { unit 0 { family inet { filter { input Block_RSVP_Path_Tear; } } } } } firewall { family inet { filter Block_RSVP_Path_Tear { term 1 { from { flexible-match-range { match-start layer-4; <--- RSVP Header byte-offset 1; <--- Byte offset is 1 as match starts from RSVP header bit-length 8; <--- Length of Type field of RSVP message range 0x05; <--- Value of Type field in the message, i.e 0x05 == Path-Tear } } then { count Path_Tear_Count; discard; } } term 2 { then { count Remaining_pkts; accept; } } } } } root@R2> show firewall filter Block_RSVP_Path_Tear Filter: Block_RSVP_Path_Tear Counters: Name Bytes Packets Path_Tear_Count 22032 204 Remaining_pkts 169708984322 114559368
Note: There is no MAC header in the captures.
IP Header RSVP Header <--- 05 in RSVP header signifies Path-Tear Message 4d 47 43 87 00 10 03 01 01 06 01 0e 01 02 00 99 04 04 61 01 00 00 02 00 00 00 46 c0 00 6c e2 4e 00 00 ff 2e bf fa c0 a8 01 01 c0 a8 01 04 94 04 00 00 10 05 59 5c ff 00 00 54 00 10 01 07 c0 a8 <--- 05 - RSVP Path-Tear Message Type 01 04 00 00 5d 23 c0 a8 01 01 00 0c 03 01 04 04 04 01 80 00 00 04 00 0c 0b 07 c0 a8 01 01 00 00 00 39 00 24 0c 02 00 00 00 07 01 00 00 06 7f 00 00 05 4e 83 57 7e 4e 83 57 7e 7f 80 00 00 00 00 00 14 00 00 05 dc
Packet Dump
No. Time Delta Time Source Destination Protocol Length Info 130 77.596813 0.000000 192.168.1.1 192.168.1.4 RSVP 134 PATH TEAR Message. SESSION: IPv4-LSP, Destination 192.168.1.4, Short Call ID 0, Tunnel ID 23843, Ext ID c0a80101. SENDER TEMPLATE: IPv4-LSP, Tunnel Source: 192.168.1.1, Short Call ID: 0, LSP ID: 57. Frame 130: 134 bytes on wire (1072 bits), 134 bytes captured (1072 bits) Encapsulation type: Juniper Ethernet (83) Arrival Time: May 9, 2021 02:51:07.921500000 India Standard Time [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1620508867.921500000 seconds [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 77.596813000 seconds] Frame Number: 130 Frame Length: 134 bytes (1072 bits) Capture Length: 134 bytes (1072 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: juniper:ip:rsvp] Juniper Ethernet Magic Number: 0x4d4743 .... ...1 = Direction: In (0x1) .... ..1. = L2 header presence: Unknown (0x1) Extension(s) Total length: 16 Device Media Type Extension TLV #3, length: 1 Device Media Type: Ethernet (1) Logical Interface Encapsulation Extension TLV #6, length: 1 Logical Interface Encapsulation: Ethernet (14) Device Interface Index Extension TLV #1, length: 2 Device Interface Index: 39168 Logical Interface Index Extension TLV #4, length: 4 Logical Interface Index: 353 [Payload Type: IPv4 (2)] Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.4 0100 .... = Version: 4 .... 0110 = Header Length: 24 bytes (6) Differentiated Services Field: 0xc0 (DSCP: CS6, ECN: Not-ECT) 1100 00.. = Differentiated Services Codepoint: Class Selector 6 (48) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 108 Identification: 0xe24e (57934) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment Offset: 0 Time to Live: 255 Protocol: Reservation Protocol (46) Header Checksum: 0xbffa [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.1.1 Destination Address: 192.168.1.4 Options: (4 bytes), Router Alert IP Option - Router Alert (4 bytes): Router shall examine packet (0) Type: 148 1... .... = Copy on fragmentation: Yes .00. .... = Class: Control (0) ...1 0100 = Number: Router Alert (20) Length: 4 Router Alert: Router shall examine packet (0) Resource ReserVation Protocol (RSVP): PATH TEAR Message. SESSION: IPv4-LSP, Destination 192.168.1.4, Short Call ID 0, Tunnel ID 23843, Ext ID c0a80101. SENDER TEMPLATE: IPv4-LSP, Tunnel Source: 192.168.1.1, Short Call ID: 0, LSP ID: 57. RSVP Header. PATH TEAR Message. 0001 .... = RSVP Version: 1 .... 0000 = Flags: 0x0 Message Type: PATH TEAR Message. (5) Message Checksum: 0x595c [correct] Sending TTL: 255 Message length: 84 SESSION: IPv4-LSP, Destination 192.168.1.4, Short Call ID 0, Tunnel ID 23843, Ext ID c0a80101. Length: 16 Object class: SESSION object (1) C-type: IPv4-LSP (7) Destination address: 192.168.1.4 Short Call ID: 0 Tunnel ID: 23843 Extended Tunnel ID: 3232235777 (192.168.1.1) HOP: IPv4, 4.4.4.1 Length: 12 Object class: HOP object (3) C-Type: IPv4 (1) Neighbor address: 4.4.4.1 Logical interface: 2147483652 SENDER TEMPLATE: IPv4-LSP, Tunnel Source: 192.168.1.1, Short Call ID: 0, LSP ID: 57. Length: 12 Object class: SENDER TEMPLATE object (11) C-Type: IPv4 LSP (7) Sender IPv4 address: 192.168.1.1 Short Call ID: 0 LSP ID: 57 SENDER TSPEC: IntServ, Token Bucket, 1101774592 bytes/sec. Length: 36 Object class: SENDER TSPEC object (12) C-Type: Integrated Services (2) 0000 .... = Message format version: 0 Data length: 7 words, not including header Service header: Traffic specification (1) Data length: 6 words, not including header Parameter: Token bucket (127)Rate=1101774592 Burst=1101774592 Peak=inf m=20 M=1500 Parameter flags: 0x00 Parameter length: 5 words, not including header Token bucket rate: 1.10177e+09 Token bucket size: 1.10177e+09 Peak data rate: inf Minimum policed unit [m]: 20 Maximum packet size [M]: 1500