Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Example: Configuring Logs in Flow Monitoring Format for NAT Events on MX Series Routers for Troubleshooting

You can configure MX Series routers with MS-MPCs, MS-MICs, and MX-SPC3s to log network address translation (NAT) events using the Junos Traffic Vision (previously known as Jflow) version 9 or IPFIX (version 10) template format. This method of generating flow monitoring records for NAT events, such as NAT44 and NAT64 session creation and deletion, and NAT44 and NAT64 binding information base events, enables cohesive and streamlined analysis of NAT traffic and troubleshooting of NAT-related problems.


This functionality is supported on MX Series routers with Junos OS Extension-Provider packages installed and configured on the device, and on MS-MPCs, MS-PICs, and MX-SPC3s. It is not supported on MS-DPCs with MX Series routers.

This example describes how to configure flow monitoring log generation in flow monitoring format for NAT events at the service-set level on MS-MIC, MS-MPC, and MX-SPC3, and contains the following sections:


This configuration example is for an Interface-Style service set.


This example uses the following hardware and software components:

  • One MX Series router with an MS-MPC, MS-MIC, or MX-SPC3

  • Junos OS Release 14.2R2 or later for MX Series routers

Generation of Log Messages Using Flow Templates for NAT Operations on MS-MPCs, MS-MICs, and MX-SPC3s

You can configure the mechanism to record logging messages in flow monitoring format for NAT events. You can create a template profile for a particular NAT service on an MX Series router with MS-MPCs, MS-MICs, or MX-SPC3s, or for a service set, which applies for all of the NAT services. You must define a template profile to generate flow monitoring logs in a specific flow template format and attach the template profile with a service set. You must configure a collector or a group of collectors, which are hosts that receive the log messages for NAT events from the service PIC or the exporter. You need to associate a template profile with the collector. The profile defines the characteristics of the flow monitoring record template, such as the version of flow monitoring (version 9 or IPFIX), the refresh rate, in either packets or seconds, and the type of service or application (NAT in this case) for which flow records must be sent to the collector.

Assume a sample deployment in which two collectors, c1 and c2, are defined. These collectors are clustered into two groups. The collector group, cg1, contains c1 and c2, and the collector group, cg2, contains c2. Two template profiles named t1 and t2 are defined. The profiles, t1 and t2, are associated with collectors, c1 and c2, respectively.

These profiles describe the properties or attributes for transmission of logs, such as the flow template format to be used, the rate at which the logs must be refreshed, and the service or event, such as NAT, for which logs must be sent to the specified collector.


To enable the flow monitoring log capability for NAT events and configure the transmission of logs to collectors, perform these tasks:

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them in a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level:

Configuring Service Set Properties

Applying Flow Monitoring Log Service on an Interface

Enabling and Configuring Flow Monitoring Logs for a Service Set

Associating the Template Profile with a Service Set


Step-by-Step Procedure

To configure the generation and transmission of flow monitoring template logs for NAT events:

  1. Create a service set properties.

  2. Define the flow monitoring log service to be applied on an interface.

  3. Configure the collectors and collector groups.

  4. Configure the template profiles and associate the template profile with the collector.

  5. Associate the template profile with the service set.


From the configuration mode, confirm your configuration by entering the show services, show services jflow-log, and show services service-set sset_0 jflow-log commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.


To confirm that the configuration is working properly, perform the following:

Verifying That the Flow Monitoring Logs Are Generated and Sent to Collectors


Verify that the flow monitoring log messages in the defined template format, such as IPFIX or version 9, are generated and transmitted to the configured collectors for the different NAT operations.


From operational mode, use the show services service-sets statistics jflow-log command:

From operational mode, use the show services service-sets statistics jflow-log detail command:


The output shows that the log messages in flow monitoring format associated with the specified service set and interface are generated for the different NAT events.