Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Enable Packet-Based Forwarding on Virtual Interfaces

Juniper Networks supports packet-based forwarding on virtual interfaces using Cloud-Native Contrail® Networking™ Release 22.1 or later in a Kubernetes-orchestrated environment.


By default, Contrail compute nodes use flow mode for packet forwarding on a virtual interface. This means that every vRouter has a flow table to keep track of all flows that passes through it. In flow mode, the virtual interface processes all traffic by analyzing the state or session of traffic. However, there might be instances when you want to switch from flow mode to packet mode. Specifically, to achieve higher traffic forwarding performance, or to get around certain limitations of flow mode.

In packet mode, the virtual interface processes the traffic on a per-packet basis and ignores all flow information. The main advantage of this mode is that the processing type is stateless. Stateless mode means that the virtual interface does not keep track of session information or go through traffic analysis to determine how a session is established.


Features that require a network policy (such as ACLs, security groups, floating IP's) are unable to work in packet mode.

Configure Packet Mode on a Virtual Interface

Follow these steps to enable packet mode on a virtual interface.

  1. Verify that you are running flow mode. Flow mode is the default forwarding mode.
    Generate some traffic by pinging another pod in the same network. In this example, the pod's IP address is
  2. Use the flow command-line tool to check for flows. The following example indicates that the virtualMachineInterface is in flow mode.
  3. Enable packet mode on the virtualMachineInterface.

    Create a patch file named packet-mode-patch.yaml and set the VMI policy to true.

  4. Apply the patch.
  5. After you apply the patch, flow mode switches to packet mode.
  6. Verify that packet mode is active.
    Generate traffic by pinging another pod in the same network that you pinged in Step 1.
  7. Use the flow command-line tool to check for flows.
    Success! No flows exist which indicates you are in packet mode.