[Contents] [Prev] [Next] [Index] [Report an Error]

Determining Traffic Direction

When you configure next-hop service sets, the AS PIC functions as a two-part interface, in which one part is the inside interface and the other part is the outside interface. The following sequence of actions takes place:

To associate the two parts with logical interfaces, you configure two logical interfaces with the service-domain statement, one with the inside value and one with the outside value, to mark them as either an inside or outside service interface.
The router forwards the traffic to be serviced to the inside interface, using the next-hop lookup table.
After the service is applied, the traffic exits from the outside interface. A route lookup is then performed on the packets to be sent out of the router.
When the reverse traffic returns on the outside interface, the applied service is undone; for example, IPSec traffic is decrypted or NAT addresses are unmasked. The serviced packets then emerge on the inside interface, the router performs a route lookup, and the traffic exits the router.

A service rule’s match direction, whether input, output, or input/output, is applied with respect to the traffic flow through the AS PIC, not through a specific inside or outside interface.

When a packet is sent to an AS PIC, packet direction information is carried along with it. This is true for both interface style and next-hop style service sets.

Packet direction is determined by whether a packet is entering or leaving any Packet Forwarding Engine interface (with respect to the forwarding plane) on which the interface-service statement is applied. This is similar to the input and output direction for stateless firewall filters.

The match direction can also depend on the network topology. For example, you might route all the external traffic through one interface that is used to protect the other interfaces on the router, and configure various services on this interface specifically. Alternatively, you might use one interface for priority traffic and configure special services on it, but not care about protecting traffic on the other interfaces.

Packet direction is determined by the AS PIC interface used to route packets to the AS PIC. If you use the inside-interface statement to route traffic, then the packet direction is input. If you use the outside-interface statement to direct packets to the AS PIC, then the packet direction is output.

The interface to which you apply the service sets affects the match direction. For example, apply the following configuration:



sp-1/1/0 unit 1 service-domain inside;
sp-1/1/0 unit 2 service-domain outside;

If you configure match-direction input, you include the following:



[edit]
services service-set test1 next-hop-service inside-service-interface
sp-1/0/0.1;
services service-set test1 next-hop-service outside-service-interface
sp-1/0/0.2;
services ipsec-vpn rule test-ipsec-rule match-direction
input;
routing-options static route 10.0.0.0/24 next-hop sp-1/1/0.1;

If you configure match-direction output, you include the following:



[edit]
services service-set test2 next-hop-service inside-service-interface
sp-1/0/0.1;
services service-set test2 next-hop-service outside-service-interface
sp-1/0/0.2;
services ipsec-vpn rule test-ipsec-rule match-direction
output;
routing-options static route 10.0.0.0/24 next-hop sp-1/1/0.2;

The essential difference between the two configurations is the change in the match direction and the static routes’ next hop, pointing to either the AS PIC's inside or outside interface.

[Contents] [Prev] [Next] [Index] [Report an Error]