Enabling Passive Flow Monitoring
You can monitor IPv4 traffic from another router if you have the following components installed in an M40e, M160, M320, or T Series router:
- Monitoring Services, Adaptive Services, or Multiservices PICs to perform the service processing.
- SONET/SDH, Fast Ethernet, or Gigabit Ethernet PICs as transit interfaces.
On SONET/SDH interfaces, you enable passive flow monitoring by including the passive-monitor-mode statement at the [edit interfaces so-fpc/pic/port unit logical-unit-number] hierarchy level:
On Asynchronous Transfer Mode (ATM), Fast Ethernet, or Gigabit Ethernet interfaces, you enable passive flow monitoring by including the passive-monitor-mode statement at the [edit interfaces interface-name] hierarchy level:
When you configure an interface in passive monitoring mode, the Packet Forwarding Engine silently drops packets coming from that interface and destined to the router itself. Passive monitoring mode also stops the Routing Engine from transmitting any packet from that interface. Packets received from the monitored interface can be forwarded to monitoring interfaces. If you include the passive-monitor-mode statement in the configuration:
- The ATM interface is always up, and the interface does not receive or transmit incoming control packets, such as Operation, Administration, and Maintenance (OAM) and Interim Local Management Interface (ILMI) cells.
- The SONET/SDH interface does not send keepalives or alarms, and does not participate actively on the network.
- Gigabit and Fast Ethernet interfaces can support both per-port passive monitoring and per-VLAN passive monitoring. The destination MAC filter on the receive port of the Ethernet interfaces is disabled.
- Ethernet encapsulation options are not allowed.
On monitoring services interfaces, you enable passive flow monitoring by including the family statement at the [edit interfaces interface-name unit logical-unit-number] hierarchy level, specifying the inet option:
For the monitoring services interface, you can configure multiservice physical interface properties. For more information, see Configuring Flow-Monitoring Interfaces.
For conformity with cflowd record structure, you must include the receive-options-packets and receive-ttl-exceeded statements at the [edit interfaces interface-name unit logical-unit-number family inet] hierarchy level:
For more information, see the following sections:
Passive Flow Monitoring for MPLS Encapsulated Packets
On monitoring services interfaces, you can process MPLS packets that have not been assigned label values and have no corresponding entry in the mpls.0 routing table. This allows you to assign a default route to unlabeled MPLS packets.
To configure a default label value for MPLS packets, include the default-route statement at the [edit protocols mpls interface interface-name label-map] hierarchy level:
For more information about static labels, see the Junos MPLS Applications Configuration Guide.
Removing MPLS Labels from Incoming Packets
The Junos OS can forward only IPv4 packets to a Monitoring Services, Adaptive Services, or Multiservices PIC. IPv4 packets with MPLS labels cannot be forwarded to a monitoring PIC. By default, if packets with MPLS labels are forwarded to the monitoring PIC, they are discarded. To monitor packets with MPLS labels, you must remove the MPLS labels as the packets arrive on the interface.
You can remove up to two MPLS labels from an incoming packet by including the pop-all-labels statement at the [edit interfaces interface-name (atm-options | fastether-options | gigether-options | sonet-options) mpls] hierarchy level:
By default, the pop-all-labels statement takes effect for incoming packets with one or two labels. You can specify the number of MPLS labels that an incoming packet must have for the pop-all-labels statement to take effect by including the required-depth statement at the [edit interfaces interface-name (atm-options | fastether-options | gigether-options | sonet-options) mpls pop-all-labels] hierarchy level:
The required depth can be 1, 2, or [ 1 2 ]. If you include the required-depth 1 statement, the pop-all-labels statement takes effect for incoming packets with one label only. If you include the required-depth 2 statement, the pop-all-labels statement takes effect for incoming packets with two labels only. If you include the required-depth [ 1 2 ] statement, the pop-all-labels statement takes effect for incoming packets with one or two labels. A required depth of [ 1 2 ] is equivalent to the default behavior of the pop-all-labels statement.
When you remove MPLS labels from incoming packets, note the following:
- The pop-all-labels statement has no effect on IP packets with three or more MPLS labels.
- When you enable MPLS label removal, you must configure all ports on a PIC with the same label popping mode and required depth.
- You use the pop-all-labels statement to enable passive monitoring applications, not active monitoring.
- You cannot apply MPLS filters or accounting to the MPLS labels because the labels are removed as soon as the packet arrives on the interface.
- On ATM2 interfaces, you must use a label value greater than 4095, because the lower range of MPLS labels is reserved for label-switched interface (LSI) and virtual private LAN service (VPLS) support. For more information, see the Junos VPNs Configuration Guide.
- The following ATM encapsulation types are not supported
on interfaces with MPLS label removal:
- atm-ccc-cell-relay
- atm-ccc-vc-mux
- atm-mlppp-llc
- atm-tcc-snap
- atm-tcc-vc-mux
- ether-over-atm-llc
- ether-vpls-over-atm-llc
Example: Enabling Passive Flow Monitoring
The following example shows a complete configuration for enabling passive flow monitoring on an Ethernet interface.
In this example, the Gigabit Ethernet interface can accept all Ethernet packets. It strips VLAN tags (if there are any) and up to two MPLS labels blindly, and passes IPv4 packets to the monitoring interface. With this configuration, it can monitor IPv4, VLAN+IPv4, VLAN+MPLS+IPv4, and VLAN+MPLS+MPLS+IPv4 labeled packets.
The Fast Ethernet interface can accept only packets with VLAN ID 100. All other packets are dropped. With this configuration, it can monitor VLAN (ID=100)+IPv4, VLAN (ID=100)+MPLS+IPv4, and VLAN (ID=100)+MPLS+MPLS+IPv4 labeled packets.
