In the following scenario where a PTX10001-36MR pops an MPLS label and assigns an LSI Label will not be able to sample IPFIX for family MPLS on ingress due to a product limitation.
Refer to topology:
ISP --- PTX10001-36MR (AE0)--- P1 ---- P2 ---- PE/CE
Sample config applied to the PTX:
services {
flow-monitoring {
version-ipfix {
template mpls-ipv4 {
flow-active-timeout 60;
flow-inactive-timeout 10;
nexthop-learning {
enable;
}
template-refresh-rate {
packets 30;
seconds 60;
option-refresh-rate {
seconds 30;
mpls-template {
label-position [ 1 2 ];
tunnel-observation {
ipv4;
ipv6;
template ipv4 {
flow-inactive-timeout 15;
ipv4-template;
template ipv6 {
ipv6-template;
forwarding-options {
sampling {
instance {
SAMPLE-INS {
input {
rate 1000;
family inet {
output {
flow-server 1.1.1.2 {
port 9995;
autonomous-system-type origin;
template {
inline-jflow {
source-address 2.2.2.2;
family inet6 {
family mpls {
mpls-ipv4;
ae0 {
aggregated-ether-options {
bfd-liveness-detection {
minimum-interval 333;
multiplier 3;
neighbor 91.91.91.192;
local-address 91.91.91.193;
minimum-links 1;
lacp {
active;
unit 0 {
filter {
input SAMPLE-PACKETS-4;
address 91.91.91.193/31;
family iso;
input SAMPLE-PACKETS-6;
address 2a09:1000:1:20::1/127;
input SAMPLE-PACKETS-MPLS;
• MPLS flows show as empty:
user@PTX> show services accounting flow inline-jflow fpc-slot 0
Flow information
FPC Slot: 0
Flow Packets: 63544725400, Flow Bytes: 83331008557746
Active Flows: 0, Total Flows: 63544725400
Flows Exported: 63544725363, Flow Packets Exported: 5897542121
Flows Inactive Timed Out: 63544725363, Flows Active Timed Out: 0
IPv4 Flows:
IPv4 Flow Packets: 43763104077, IPv4 Flow Bytes: 56653557326030
IPv4 Active Flows: 0, IPv4 Total Flows: 43763104077
IPv4 Flows Exported: 43763104054
IPv4 Flows Inactive Timed Out: 43763104054, IPv4 Flows Active Timed Out: 0
IPv6 Flows:
IPv6 Flow Packets: 19781621323, IPv6 Flow Bytes: 26677451231716
IPv6 Active Flows: 0, IPv6 Total Flows: 19781621323
IPv6 Flows Exported: 19781621309
IPv6 Flows Inactive Timed Out: 19781621309, IPv6 Flows Active Timed Out: 0
MPLS Flows:
MPLS Flow Packets: 0, MPLS Flow Bytes: 0
MPLS Active Flows: 0, MPLS Total Flows: 0
MPLS Flows Exported: 0
MPLS Flows Inactive Timed Out: 0, MPLS Flows Active Timed Out: 0
Following the label:
1) On PE device lookup the label for a route in the L3vpn table, you can see there are two labels.
INTERNET.inet.0: 1000964 destinations, 3876914 routes (1000964 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
33.33.33.33/24 *[BGP/170] 20w0d 23:47:04, MED 0, localpref 160, from 91.193.8.22
AS path: 2906 I, validation-state: unverified
> to 91.193.8.166 via ae0.0, Push 32, Push 129(top)
2) On the P core router looup the mpls table and the Push Label 129
user@P1> show route table mpls.0
mpls.0: 201 destinations, 201 routes (201 active, 0 holddown, 0 hidden)
Restart Complete
0 *[MPLS/0] 81w3d 01:29:00, metric 1
to table inet.0
0(S=0) *[MPLS/0] 81w3d 01:29:00, metric 1
to table mpls.0
1 *[MPLS/0] 81w3d 01:29:00, metric 1
Receive
2 *[MPLS/0] 81w3d 01:29:00, metric 1
to table inet6.0
2(S=0) *[MPLS/0] 81w3d 01:29:00, metric 1
13 *[MPLS/0] 81w3d 01:29:00, metric 1
117 *[L-ISIS/14] 20w0d 23:52:01, metric 1000
> to 91.193.8.161 via ae2.0, Pop
117(S=0) *[L-ISIS/14] 03:15:28, metric 1000
118 *[L-ISIS/14] 17w2d 00:33:32, metric 1000
> to 91.193.8.165 via ae3.0, Pop
118(S=0) *[L-ISIS/14] 03:15:28, metric 1000
119 *[L-ISIS/14] 10w1d 03:22:16, metric 2000
> to 91.193.8.173 via ae12.0, Swap 375
120 *[L-ISIS/14] 10w1d 03:22:16, metric 2000
> to 91.193.8.173 via ae12.0, Swap 376
121 *[L-ISIS/14] 20w0d 23:50:15, metric 2000
> to 91.193.8.161 via ae2.0, Swap 377
122 *[L-ISIS/14] 17w2d 00:31:51, metric 2000
> to 91.193.8.165 via ae3.0, Swap 378
123 *[L-ISIS/14] 10w1d 03:22:16, metric 3000
> to 91.193.8.173 via ae12.0, Swap 379
124 *[L-ISIS/14] 10w1d 03:22:16, metric 3000
> to 91.193.8.173 via ae12.0, Swap 380
126 *[L-ISIS/14] 81w3d 01:10:10, metric 1000
> to 91.193.8.149 via ae0.0, Pop
126(S=0) *[L-ISIS/14] 03:15:28, metric 1000
127 *[L-ISIS/14] 10w1d 03:22:16, metric 1000
> to 91.193.8.173 via ae12.0, Pop
127(S=0) *[L-ISIS/14] 03:15:28, metric 1000
128 *[L-ISIS/14] 1d 17:56:12, metric 2000
to 91.193.8.149 via ae0.0, Swap 128
> to 91.193.8.173 via ae12.0, Swap 384
129 *[L-ISIS/14] 81w3d 01:11:05, metric 1000
> to 91.193.8.193 via ae4.0, Pop
129(S=0) *[L-ISIS/14] 03:15:28, metric 1000
<snip>
3> Finally moving onto the PTX, you can see the LSI label assigning the route to the routing-table called INTERNET:
user@PTX> show route table mpls.0
mpls.0: 143 destinations, 143 routes (143 active, 0 holddown, 0 hidden)
0 *[MPLS/0] 83w2d 02:25:49, metric 1
0(S=0) *[MPLS/0] 83w2d 02:25:49, metric 1
1 *[MPLS/0] 83w2d 02:25:49, metric 1
2 *[MPLS/0] 83w2d 02:25:49, metric 1
2(S=0) *[MPLS/0] 83w2d 02:25:49, metric 1
13 *[MPLS/0] 83w2d 02:25:49, metric 1
32 *[VPN/0] 81w3d 01:17:46
> via lsi.256 (INTERNET), Pop
33 *[VPN/0] 81w3d 01:17:47
> via lsi.257 (MANAGEMENT), Pop
4) When you then check the flow bytes for MPLS there will be no packets incrementing:
user@PTX# run show services accounting flow inline-jflow fpc-slot 0 | match "MPLS Flow Bytes" | refresh 1
---(refreshed at 2025-01-31 00:35:45 UTC)---
---(refreshed at 2025-01-31 00:35:46 UTC)---
---(refreshed at 2025-01-31 00:35:47 UTC)---
---(refreshed at 2025-01-31 00:35:48 UTC)---
---(refreshed at 2025-01-31 00:35:49 UTC)---
---(refreshed at 2025-01-31 00:35:50 UTC)---
---(refreshed at 2025-01-31 00:35:51 UTC)---
---(refreshed at 2025-01-31 00:35:52 UTC)---
---(refreshed at 2025-01-31 00:35:53 UTC)---
J-Flow - IPFIX Support was introduced in version Junos EVO 20.2R1 for PTX10001-36mr
However it is confirmed that this is a known production limitation and there is no issue with the mpls filter itself.
On the BT ASIC, a MPLS filter for the outer header's match is not supported because the layer3_type is changed to MPLS's payload type.
Additionally, the layer2 domain is modified (currently set to 0) once the MPLS outer header is removed in the SLU. As a result, any filters attached to the incoming interface cannot be triggered for MPLS packets after the MPLS packet is terminated in SLU.
You may refer to Juniper PR1859102
2025-01-31 : Article Created
https://gnats.juniper.net/web/default/1859102#audit_tab
https://gnats.juniper.net/web/default/1843342#audit_tab