Configuring FlowTapLite

A lighter version of the flow-tap application is available on MX Series routers and also on M120 and M320 routers with Enhanced III FPCs. All of the functionality resides in the Packet Forwarding Engine rather than a service PIC or DPC.

Note: On M320 routers only, if the replacement of FPCs results in a mode change, you must restart the DFC process manually by disabling and then re-enabling the CLI configuration.

FlowTapLite uses the same DTCP-SSH architecture to install the DTCP filters and authenticate the users as the original flow-tap application and supports up to 3000 filters per chassis.

Note: The original flow-tap application and FlowTapLite cannot be used at the same time.

To configure FlowTapLite, include the flow-tap statement at the [edit services] hierarchy level:

For the Packet Forwarding Engine to encapsulate of the intercepted packet, it must send the packet to a tunnel logical (vt-) interface. You will need to allocate a tunnel interface and assign it to the dynamic flow control process (dfcd) for FlowTapLite to use. To create the tunnel interface, include the following configuration:

Note: Currently FlowTapLite supports only one tunnel interface per instance.

For more information on this configuration, see the Junos System Basics Configuration Guide.

To configure the logical interfaces and assign them to dfcd, include the following configuration:

Note: If a service PIC or DPC is available, you can use its tunnel interface for the same purpose.