Verifying Session Establishment On Internet Traffic

Purpose

Verify if in this example configuration, sessions are established when traffic is transmitted to the Internet.

Action

To verify if traffic to the Internet is using flow-based forwarding and sessions are established, perform the following tasks:

1. On device R1, enter the operational mode command clear security flow session all in the CLI to clear all existing security flow sessions.
2. On device R0, enter the operational mode command ping in the CLI to transmit traffic to device R2.
3. On device R1, with traffic transmitting from R0 to R2 through R1, enter the operational mode command show security flow session in the CLI.

Note: To verify established sessions, make sure to enter the show security flow session command while the ping command is sending and receiving packets.

Sample Output

PING 5.5.5.9 (5.5.5.9): 56 data bytes

64 bytes from 5.5.5.9: icmp_seq=0 ttl=62 time=2.593 ms
64 bytes from 5.5.5.9: icmp_seq=1 ttl=62 time=2.562 ms
64 bytes from 5.5.5.9: icmp_seq=2 ttl=62 time=2.563 ms
64 bytes from 5.5.5.9: icmp_seq=3 ttl=62 time=2.561 ms
64 bytes from 5.5.5.9: icmp_seq=4 ttl=62 time=2.310 ms
64 bytes from 5.5.5.9: icmp_seq=5 ttl=62 time=3.880 ms

...

Session ID: 189900, Policy name: default-policy/2, Timeout: 2
  In: 9.9.9.9/0 --> 5.5.5.9/5924;icmp, If: lt-0/0/0.1
  Out: 5.5.5.9/5924 --> 9.9.9.9/0;icmp, If: ge-0/0/3.0

Session ID: 189901, Policy name: default-policy/2, Timeout: 2
  In: 9.9.9.9/1 --> 5.5.5.9/5924;icmp, If: lt-0/0/0.1
  Out: 5.5.5.9/5924 --> 9.9.9.9/1;icmp, If: ge-0/0/3.0

Session ID: 189902, Policy name: default-policy/2, Timeout: 4
  In: 9.9.9.9/2 --> 5.5.5.9/5924;icmp, If: lt-0/0/0.1
  Out: 5.5.5.9/5924 --> 9.9.9.9/2;icmp, If: ge-0/0/3.0

 3 sessions displayed

Meaning

The output shows traffic transmitting from devices R0 to R2 and established sessions. In this example, you did not apply the bypass-flow-filter with the packet-mode action modifier on routing instance Internet-VR for your company’s Internet traffic. This output verifies that the traffic to the Internet is correctly using flow-based forwarding and hence sessions are established.

Note that sessions are established only when traffic is flowing between lt-0/0/0.1 and ge-0/0/3 and not when traffic is flowing between ge-0/0/2 and lt-0/0/0.0.

Related Topics

For more information about the show security flow session command, see the Junos OS CLI Reference.

For information about the ping command, see the Junos OS Administration Guide for Security Devices or the Junos System Basics Configuration Guide.