[j-nsp] Output filter on discard interface doesn't work as expected
Alex D.
listensammler at gmx.de
Fri Mar 10 10:07:38 EST 2017
Hi,
i have a problem with my firewall filter bound to a discard interface
dsc.0 in a quite simple RTBH setup...
I receive a bgp route with a next-hop ip 192.0.2.101 which is configured
on a discard interface. Blackholing works as expected, means that
traffic coming in from a directly connected router is discarded. Problem
is that blackholed traffic will not be counted by the configured filter.
Configuration and counter looks as follows:
user at R1# show firewall
family inet {
filter blackhole-counter {
interface-specific;
term one {
then count blackholed-packets;
}
}
}
user at R1# show interfaces
dsc {
unit 0 {
family inet {
filter {
output blackhole-counter;
}
address 192.0.2.102/32 {
destination 192.0.2.101;
}
}
}
}
Here's the bgp route (don't be scared because of the ip, it's just a lab
setup):
user at R1# run show route protocol bgp 8.8.8.8 detail
inet.0: 35 destinations, 35 routes (35 active, 0 holddown, 0 hidden)
8.8.8.8/32 (1 entry, 1 announced)
*BGP Preference: 170/-101
Next hop type: Indirect
Address: 0x9335600
Next-hop reference count: 6
Source: 1.1.1.99
Next hop type: Router, Next hop index: 587
Next hop: 192.0.2.101 via dsc.0, selected
Protocol next hop: 192.0.2.101
Indirect next hop: 94802b8 131071
State: <Active Int Ext>
Local AS: 1111 Peer AS: 1111
Age: 34:10 Metric2: 0
Task: BGP_1111.1.1.1.99+35805
Announcement bits (3): 0-KRT 4-BGP_RT_Background
5-Resolve tree 2
AS path: I (Originator) Cluster list: 1.1.1.99
AS path: Originator ID: 10.15.40.154
Communities: 1111:9999
Accepted
Localpref: 100
Router ID: 1.1.1.99
My "problem" filter:
user at R1# run show firewall filter blackhole-counter-dsc.0-i
Filter: blackhole-counter-dsc.0-o
Counters:
Name Bytes
Packets
blackholed-packets-dsc.0-i
0 0
Same filter on the interface towards an directly connected neighbor
router, from where a ping to 8.8.8.8 is running, shows that traffic is
comming in:
user at R1# run show firewall filter blackhole-counter-em0.0-i
Filter: blackhole-counter-em0.0-i
Counters:
Name Bytes
Packets
blackholed-packets-em0.0-i
166290 2086
Any suggestions, why my firewall filter with count action doesn't work ?
Regards,
Alex
More information about the juniper-nsp
mailing list