Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Understanding Junos Packet Vision Architecture on MX, M and T Series Routers

    The Junos Packet Vision (previously known as Flow-Tap) architecture consists of one or more mediation devices that send requests to a Juniper Networks router to monitor incoming data and forward any packets that match specific filter criteria to a set of one or more content destinations:

    • Mediation device—A client that monitors electronic data or voice transfer over the network. The mediation device sends filter requests to the Juniper Networks router using the DTCP. The clients are not identified for security reasons, but have permissions defined by a set of special login classes. Each system can support up to 16 different mediation devices for each user, up to a maximum of 64 mediation devices for the whole system.
    • Monitoring platform—An M Series or T Series router containing one or more Adaptive Services (AS) or Multiservices PICs, which are configured to support the Junos Packet Vision application. The monitoring platform processes the requests from the mediation devices, applies the dynamic filters, monitors incoming data flows, and sends the matched packets to the appropriate content destinations.
    • Content destination—Recipient of the matched packets from the monitoring platform. Typically the matched packets are sent using an IP Security (IPsec) tunnel from the monitoring platform to another router connected to the content destination. The content destination and the mediation device can be physically located on the same host. For more information about IPsec tunnels, see Understanding Junos VPN Site Secure.
    • Dynamic filters—Firewall filters automatically generated by the Packet Forwarding Engine and applied to all routing instances. Each term in the filter includes a flow-tap action that is similar to the existing sample or port-mirroring actions. As long as one of the filter terms matches an incoming packet, the router copies the packet and forwards it to the Adaptive Services or Multiservices PIC that is configured for Junos Packet Vision service. The Adaptive Services or Multiservices PIC runs the packet through the client filters and sends a copy to each matching content destination.

    Following is a sample filter configuration; note that it is dynamically generated by the router (no user configuration is required):

    filter combined_LEA_filter {
    term LEA1_filter {
    from {
    source-address 192.0.2.4;
    destination-address 198.51.100.6;
    }
    then {
    flow-tap;
    }
    }
    term LEA2_filter {
    from {
    source-address 10.1.1.1;
    source-port 23;
    }
    then {
    flow-tap;
    }
    }
    }

    Figure 1 shows a sample topology that uses two mediation devices and two content destinations.

    Figure 1: Junos Packet Vision Topology

    Junos Packet Vision Topology

    Modified: 2018-01-31