You can optionally configure service sets to be applied at one of three points while the packets transit the router:
- An interface service set on the inbound interface.
- A next-hop service set on the forwarding table.
- An interface service set on the outbound interface.
The packet flow is as follows, graphically displayed in Figure 1. (You can configure a service set as either an interface service set or a next-hop service set.)
- Packets enter the router on the inbound interface.
- A policer, filter, service filter, service set, postservice filter, and input forwarding-table filter are applied sequentially to the traffic; these are all optional items in the configuration. If an interface service set is applied, the packets are forwarded to the AS or MultiServices PIC for services processing and then sent back to the Packet Forwarding Engine; if a service filter is also applied, only packets matching the service filter are sent to the PIC. The optional postservice filter is applied and postprocessing takes place.
- A next-hop service set can be applied to the VPN routing and forwarding (VRF) table or to
inet.0. If it is applied, packets are sent to the PIC for services processing and sent back to the Packet Forwarding Engine.
NOTE: For NAT, the next-hop service set can only be applied to the VRF table. For all other services, the next-hop service set can be applied to either the VRF table or to
inet.0.
- On the output interface, an output filter, output policer, and interface service set can be applied sequentially to the traffic if you have configured any of these items. If an interface service set is applied, the traffic is forwarded to the PIC for processing and sent back to the Packet Forwarding Engine, which then forwards the traffic.
- Packets exit the router.
