Adaptive Services Overview

The Adaptive Services PIC (AS PIC) allows you to provide multiple services on a single Physical Interface Card (PIC) by configuring a set of services and applications. The AS PIC offers a special range of services you configure in one or more service sets.

The AS PIC is available in two versions that differ in memory size:

• The Adaptive Services PIC with 256 megabytes (MB) of memory is supported on all M-series routing platforms except the M320 router.
• The Adaptive Services PIC with 512 MB of memory is supported on all M-series and T-series routing platforms, including the M320 router.

The M7i router includes an integrated version of the AS PIC as an optional component, which offers all the features of the standalone version at a reduced bandwidth.

NOTE: To take advantage of all the features available on the AS PIC, you must install it in an Enhanced Flexible PIC Concentrator (FPC) in an M-series router equipped with an Internet Processor II ASIC, or a similarly equipped T-series routing platform. To find out whether your router hardware is suitably equipped, use the show chassis hardware command. For more information, see the JUNOS Protocols, Class of Service, and System Basics Command Reference.

The following services are configured within a service set and are available only on the Adaptive Services PIC:

• Stateful firewall—A type of firewall filter that considers state information derived from previous communications and other applications when evaluating traffic.
• Network Address Translation (NAT)—A security procedure for concealing host addresses on a private network behind a pool of public addresses.
• Intrusion detection services (IDS)—A set of tools for detecting, redirecting, and preventing certain kinds of network attack and intrusion.
• Internet Protocol Security (IPSec)—A set of tools for configuring manual or dynamic security associations (SAs) for encryption of data traffic.

The configuration for these services comprises a series of rules that you can arrange in order of precedence as a rule set. Each rule follows the structure of a firewall filter, with a from statement containing input or match conditions and a then statement containing actions to be taken if the match conditions are met.

The following services are also configured on the AS PIC, but do not use the rule set definition:

• Layer 2 Tunneling Protocol (L2TP)—A tool for setting up secure tunnels using Point-to-Point Protocol (PPP) encapsulation across Layer 2 networks.
• Link Services Intelligent Queuing (LSQ)—LSQ interfaces support JUNOS software class-of-service (CoS) components, link fragmentation and interleaving (LFI) (FRF.12), Multilink Frame Relay (MLFR) user-to-network interface (UNI) network-to-network interface (NNI) (FRF.16), and Multilink PPP (MLPPP).
• Voice services—A feature that uses the compressed real-time transport protocol (RTP) to enable voice over IP traffic to use low-speed links more effectively.

In addition, JUNOS software includes the following tools for configuring services:

• Application protocols definition—Allows you to configure properties of application protocols that are subject to processing by router services, and group the application definitions into application sets.
• Service-set definition—Allows you to configure combinations of directional rules and default settings that control the behavior of each service in the service set.
  

  NOTE: AS PIC logging to an external server by means of the fxp0 port is not supported on M-series routers. The architecture does not support syslog traffic out of a management interface. Instead, access to an external server is supported on a Packet Forwarding Engine interface.

  
  

This chapter includes the following topics:

• Enabling AS PIC Service Packages
• Services Configuration Flow
• Stateful Firewall Overview
• Network Address Translation Overview
• IPSec Overview
• Layer 2 Tunneling Protocol Overview
• Voice Services Overview
• Examples: Services Interfaces Configuration