ACX7100-48L :
"routing-instance" as action not available. using Next-ip does not seems to match traffic
config :
set firewall filter FBF-Inbound-to-qfx5130-vrf-pbr interface-specific
set firewall filter FBF-Inbound-to-qfx5130-vrf-pbr term t1 from source-prefix-list PL-FBF-TO-MX304-8
set firewall filter FBF-Inbound-to-qfx5130-vrf-pbr term t1 then count FBF
set firewall filter FBF-Inbound-to-qfx5130-vrf-pbr term t1 then next-ip 65.0.1.26/32
set firewall filter FBF-Inbound-to-qfx5130-vrf-pbr term t1 then next-ip routing-instance VRF-PBR
set firewall filter FBF-Inbound-to-qfx5130-vrf-pbr term default then accept
lab@acx7100-48l-3> show route table VRF-PBR.inet.0 0.0.0
VRF-PBR.inet.0: 4 destinations, 6 routes (4 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 *[BGP/170] 12:29:39, localpref 100, from 10.200.1.4
AS path: 65000 I, validation-state: unverified
> to 10.100.1.30 via et-0/0/48.0, Push 517, Push 38(top)
to 10.100.1.36 via et-0/0/49.0, Push 517, Push 30(top)
[BGP/170] 12:29:39, localpref 100, from 10.200.1.5
Counters for the FBF seem to work but traffic is never sent out the configured next-hop.
Configuration:
set policy-options prefix-list PL-FBF-TO-MX304-8 215.71.66.0/24
lab@acx7100-48l-3# show firewall
filter FBF-Inbound-to-qfx5130-vrf-pbr {
interface-specific;
term t1 {
from {
source-prefix-list {
PL-FBF-TO-MX304-8;
}
then {
count FBF;
next-ip 65.0.1.24/30 routing-instance VRF-PBR;
term default {
then accept;
lab@acx7100-48l-3# run show route 65.0.1.24
inet.0: 1000097 destinations, 2000145 routes (1000096 active, 0 holddown, 1 hidden)
65.0.0.0/20 *[BGP/170] 1d 00:35:43, localpref 150, from 10.200.1.4
AS path: I, validation-state: unverified
> to 10.100.1.30 via et-0/0/48.0, Push 25
to 10.100.1.36 via et-0/0/49.0, Push 22
[BGP/170] 17:42:02, localpref 150, from 10.200.1.5
VRF-PBR.inet.0: 3 destinations, 5 routes (3 active, 0 holddown, 0 hidden)
65.0.1.24/30 *[BGP/170] 17:25:58, localpref 100, from 10.200.1.4
to 10.100.1.30 via et-0/0/48.0, Push 517, Push 38(top)
> to 10.100.1.36 via et-0/0/49.0, Push 517, Push 30(top)
[BGP/170] 17:25:58, localpref 100, from 10.200.1.5
[edit]
lab@acx7100-48l-3# run show firewall
Filter: FBF-Inbound-to-qfx5130-vrf-pbr-et-0/0/50.10-i
Counters:
Name Bytes Packets
FBF-et-0/0/50.10-i 19209728 75038
FBF-et-0/0/50.10-i 19708928 76988
lab@acx7100-48l-3:pfe> show evo-pfemand filter
Filter-Name Filter-index Installed
FBF-Inbound-to-qfx5130-vrf-pbr-et-0/0/50.10-i 48101 Yes
lab@acx7100-48l-3:pfe> show evo-pfemand filter format hide-pfe-specific
lab@acx7100-48l-3:pfe> show evo-pfemand filter pbr
PBR container KEY: FwPolicyRoute:nextIpv4:Prefix(Type=IPV4 bytes=[ 65 0 1 24 ] length=30)_ri_VRF-PBR_family_2
Rtt-Index Proto Prefix Prefix-len NH-ID NH-Valid PbrContext
--------- ----- --------------------------------------- ---------- ----- -------- ----------
52 2 65.0.1.24 30 0 0 1
lab@acx7100-48l-3:pfe> show evo-pfemand filter pbrcontexts pbrcontext 1
PbrContext: 1 Hw Entry Ids (unit,core,entry) : <0,0,371>
ab@acx7100-48l-3:pfe> show evo-pfemand filter counters all
Filter-Name Counter-Name Packets Bytes
FBF-Inbound-to-qfx5130-vrf-pbr-et-0/0/50.10-i FBF-et-0/0/50.10-i 559545 143243520
FBF is supported but not with MPLS as a NH. Support for this will come later.https://prsearch.juniper.net/problemreport/PR1784909