A PTX configured for Inline JFLOW:
set chassis fpc 0 sampling-instance IPFIX
set chassis network-services enhanced-mode
set services flow-monitoring version-ipfix template IPFIX_TEMP_V4 ipv4-template
set services flow-monitoring version-ipfix template IPFIX_TEMP_V6 ipv6-template
set forwarding-options sampling instance IPFIX input rate 2000
set forwarding-options sampling instance IPFIX family inet output flow-server 10.85.211.37 port 20013
set forwarding-options sampling instance IPFIX family inet output flow-server 10.85.211.37 routing-instance mgmt_junos
set forwarding-options sampling instance IPFIX family inet output flow-server 10.85.211.37 version-ipfix template IPFIX_TEMP_V4
set forwarding-options sampling instance IPFIX family inet output inline-jflow source-address 10.85.158.102
set forwarding-options sampling instance IPFIX family inet6 output flow-server 10.85.211.37 port 20013
set forwarding-options sampling instance IPFIX family inet6 output flow-server 10.85.211.37 version-ipfix template IPFIX_TEMP_V6
set forwarding-options sampling instance IPFIX family inet6 output inline-jflow source-address 10.85.158.102
Using a Filter:
set firewall family inet filter inet-sample interface-specific
set firewall family inet filter inet-sample term t1 then count v4sample
set firewall family inet filter inet-sample term t1 then sample
set firewall family inet filter inet-sample term t1 then accept
set interfaces et-0/0/0:0 unit 0 family inet filter input inet-sample
set interfaces et-0/0/0:0 unit 0 family inet address 100.0.0.1/24
Where the collector is accessed via re0-mgmt:
labroot@e05-40# run show route 10.85.211.37
inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 *[Static/5] 00:11:15
> to 10.85.158.1 via re0:mgmt-0.0
Is seeing an issue. Even though the filter shows hits:
labroot@e05-40> show firewall filter inet-sample-et-0/0/0:0.0-i
Filter: inet-sample-et-0/0/0:0.0-i
Counters:
Name Bytes Packets
v4sample-et-0/0/0:0.0-i 1509760888 1953291
v4sample-et-0/0/0:0.0-i 1512866746 1957315
And JFLOW statistics for the FPC show flow packets exported:
labroot@e05-40> show services accounting flow inline-jflow fpc-slot 0
Flow information
FPC Slot: 0
Flow Packets: 952, Flow Bytes: 731873
Active Flows: 0, Total Flows: 952
Flows Exported: 952, Flow Packets Exported: 1054
Flows Inactive Timed Out: 952, Flows Active Timed Out: 0
Nothing is seen on the server:
root@ubuntu:~# tcpdump -i ens32 host 10.85.158.102
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens32, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
The problem is that the functionality is not present in the code that the PTX is running. The documentation for Inline Flow Monitoring on PTX:
https://www.juniper.net/documentation/us/en/software/junos/flow-monitoring/topics/task/inline-flow-ptx-configuring.html
States
"VRF support: Starting in Junos OS Evolved 24.2R1, we support export of IPFIX or version 9 records of inline active flow monitoring sampled packets to collectors reachable through:
Interfaces belonging to the mgmt_junos VRF instance.
WAN ports belonging to the non-default VRF instance."
But, the documentation is not clearly indicating that there is no support for re0-mgmt use in the default VRF, which is added as well. And, it does not cover what is required to make it work.
In 24.2R1:
labroot@e05-40# run show version
Hostname: e05-40
Model: ptx10001-36mr
Junos: 24.2R1-S2.4-EVO
Yocto: 4.0.14
Linux Kernel: 5.15.76-yocto-standard-juniper-02086-gc538fa48cd57
JUNOS-EVO OS 64-bit [junos-evo-install-ptx-fixed-x86-64-24.2R1-S2.4-EVO]
There is a new CLI option under the flow-server to set a routing-instance:
labroot@e05-40# set forwarding-options sampling instance IPFIX family inet output flow-server 10.85.211.37 ?
Possible completions:
<[Enter]> Execute this command
+ apply-groups Groups from which to inherit configuration data
+ apply-groups-except Don't inherit configuration data from these groups
autonomous-system-type Type of autonomous system number to export
dscp Numeric DSCP value in the range 0 to 63 (0..63)
forwarding-class Forwarding-class for exported jflow packets, applicable only for inline-jflow
port UDP port number on host collecting cflowd packets
routing-instance Name of routing instance on which flow collector is reachable
> version-ipfix Export data in version ipfix format
> version9 Export data in version 9 format
| Pipe through a command
[edit]
With 3 possible options:
mgmt_junos The default instance created when 'set system management-instance' is configured
mgmt_default The "default" instance if the above is not set
<user defined vrf>
So, with 24.2R1 and the above set to mgmt_default:
labroot@e05-40# show forwarding-options | display set
set forwarding-options sampling instance IPFIX family inet output flow-server 10.85.211.37 routing-instance mgmt_default
set forwarding-options rpf-loose-mode-discard family inet
set forwarding-options rpf-loose-mode-discard family inet6
The route to server is still via re0:mgmt:
Sampled packets are now received by the server:
09:12:22.483057 IP 10.85.158.102.34980 > 10.85.211.37.20013: UDP, length 136
09:12:22.483058 IP 10.85.158.102.34980 > 10.85.211.37.20013: UDP, length 42
Or, the PTX is set for the management interface in the mgmt_junos instance and the flow RI is updated:
labroot@e05-40# set system management-instance
labroot@e05-40# set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 next-hop 10.85.18.1
labroot@e05-40# set forwarding-options sampling instance IPFIX family inet output flow-server 10.85.211.37 routing-instance mgmt_junos
labroot@e05-40# commit and-quit
Packets hit the filter, are sampled, and sent to the server from the mgmt_junos VRF:
labroot@e05-40> clear services inline-monitoring statistics fpc-slot 0
labroot@e05-40> clear firewall all
v4sample-et-0/0/0:0.0-i 1958105 2548
v4sample-et-0/0/0:0.0-i 5061749 6572
Flow Packets: 1208, Flow Bytes: 924798
Active Flows: 0, Total Flows: 1208
Flows Exported: 1208, Flow Packets Exported: 1331
Flows Inactive Timed Out: 1208, Flows Active Timed Out: 0
Server receives them:
09:29:02.177633 IP 10.85.158.102.42004 > 10.85.211.37.20013: UDP, length 111
09:29:04.177832 IP 10.85.158.102.42004 > 10.85.211.37.20013: UDP, length 202
09:29:05.178799 IP 10.85.158.102.42004 > 10.85.211.37.20013: UDP, length 111