JUNOS Software

Services Interfaces Configuration Guide

Release 9.0

Juniper Networks, Inc.1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408-745-2000

www.juniper.netPart Number: 530-022184-01, Revision 1

This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright 1986-1997, Epilogue Technology Corporation. All rights reserved. This program and its documentation were developed at private expense, and no part of them is in the public domain. This product includes memory allocation software developed by Mark Moraes, copyright 1988, 1989, 1993, University of Toronto. This product includes FreeBSD software developed by the University of California, Berkeley, and its contributors. All of the documentation and software included in the 4.4BSD and 4.4BSD-Lite Releases is copyrighted by the Regents of the University of California. Copyright 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994. The Regents of the University of California. All rights reserved. GateD software copyright 1995, the Regents of the University. All rights reserved. Gate Daemon was originated and developed through release 3.0 by Cornell University and its collaborators. Gated is based on Kirtons EGP, UC Berkeleys routing daemon (routed), and DCNs HELLO routing protocol. Development of Gated has been supported in part by the National Science Foundation. Portions of the GateD software copyright 1988, Regents of the University of California. All rights reserved. Portions of the GateD software copyright 1991, D. L. S. Associates. This product includes software developed by Maker Communications, Inc., copyright 1996, 1997, Maker Communications, Inc. Juniper Networks, the Juniper Networks logo, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. JUNOS and JUNOSe are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785. JUNOS Software Services Interfaces Configuration Guide Release 9.0 Copyright 2008, Juniper Networks, Inc. All rights reserved. Printed in USA. Writing: Alan Twhigg, Sarah Lesway-Ball, Justine Kangas Editing: Joanne McClintock, Nancy Kurahashi Illustration: Nathaniel Woodward Cover Design: Edmonds Design Revision History 1 February 2008Revision 1 The information in this document is current as of the date listed in the revision history. YEAR 2000 NOTICE Juniper Networks hardware and software products are Year 2000 compliant. The JUNOS software has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.

ii

End User License AgreementREAD THIS END USER LICENSE AGREEMENT (AGREEMENT) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE. BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE, AND (B) YOU MAY CONTACT JUNIPER NETWORKS REGARDING LICENSE TERMS. 1. The Parties. The parties to this Agreement are Juniper Networks, Inc. and its subsidiaries (collectively Juniper), and the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable license(s) for use of the Software (Customer) (collectively, the Parties). 2. The Software. In this Agreement, Software means the program modules and features of the Juniper or Juniper-supplied software, and updates and releases of such software, for which Customer has paid the applicable license or support fees to Juniper or an authorized Juniper reseller. Embedded Software means Software which Juniper has embedded in the Juniper equipment. 3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer a non-exclusive and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the following use restrictions: a. Customer shall use the Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by Customer from Juniper or an authorized Juniper reseller. b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units for which Customer has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access Client software only, Customer shall use such Software on a single computer containing a single physical random access memory space and containing any number of processors. Use of the Steel-Belted Radius software on multiple computers requires multiple licenses, regardless of whether such computers are physically contained on a single chassis. c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may specify limits to Customers use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent users, sessions, calls, connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of separate licenses to use particular features, functionalities, services, applications, operations, or capabilities, or provide throughput, performance, configuration, bandwidth, interface, processing, temporal, or geographical limits. In addition, such limits may restrict the use of the Software to managing certain kinds of networks or require the Software to be used only in conjunction with other specific Software. Customers use of the Software shall be subject to all such limitations and purchase of all applicable licenses. d. For any trial copy of the Software, Customers right to use the Software expires 30 days after download, installation or use of the Software. Customer may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not extend or create an additional trial period by re-installing the Software after the 30-day trial period. e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customers enterprise network. Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the Steel-Belted Radius software to support any commercial network access services. The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase the applicable license(s) for the Software from Juniper or an authorized Juniper reseller. 4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees not to and shall not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized copies of the Software (except as necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the Software, in any form, to any third party; (d) remove any proprietary notices, labels, or marks on or in any copy of the Software or any product in which the Software is embedded; (e) distribute any copy of the Software to any third party, including as may be embedded in Juniper equipment sold in the secondhand market; (f) use any locked or key-restricted feature, function, service, application, operation, or capability without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even if such feature, function, service, application, operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper to any third party; (h) use the Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper reseller; (i) use the Embedded Software on non-Juniper equipment; (j) use the Software (or make it available for use) on Juniper equipment that the Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking of the Software to any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly provided herein. 5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper, Customer shall furnish such records to Juniper and certify its compliance with this Agreement. 6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper. As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence, which at a minimum includes restricting access to the Software to Customer employees and contractors having a need to use the Software for Customers internal business purposes.

iii

7. Ownership. Juniper and Juniper's licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to the Software, associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance of any right, title, or interest in the Software or associated documentation, or a sale of the Software, associated documentation, or copies of the Software. 8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty statement that accompanies the Software (the Warranty Statement). Nothing in this Agreement shall give rise to any obligation to support the Software. Support services may be purchased separately. Any such support shall be governed by a separate, written support services agreement. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA, OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW, JUNIPER DISCLAIMS ANY AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES JUNIPER WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT ERROR OR INTERRUPTION, OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Junipers or its suppliers or licensors liability to Customer, whether in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid by Customer for the Software that gave rise to the claim, or if the Software is embedded in another Juniper product, the price paid by Customer for such other product. Customer acknowledges and agrees that Juniper has set its prices and entered into this Agreement in reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same form an essential basis of the bargain between the Parties. 9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination of the license granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related documentation in Customers possession or control. 10. Taxes. All license fees for the Software are exclusive of taxes, withholdings, duties, or levies (collectively Taxes). Customer shall be responsible for paying Taxes arising from the purchase of the license, or importation or use of the Software. 11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any applicable foreign agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such restrictions, laws or regulations, or without all necessary approvals. Customer shall be liable for any such violations. The version of the Software supplied to Customer may contain encryption or other capabilities restricting Customers ability to export the Software without an export license. 12. Commercial Computer Software. The Software is commercial computer software and is provided with restricted rights. Use, duplication, or disclosure by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS 227.7201 through 227.7202-4, FAR 12.212, FAR 27.405(b)(2), FAR 52.227-19, or FAR 52.227-14(ALT III) as applicable. 13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer with the interface information needed to achieve interoperability between the Software and another independently created program, on payment of applicable fee, if any. Customer shall observe strict obligations of confidentiality with respect to such information and shall use such information in compliance with any applicable terms and conditions upon which Juniper makes such information available. 14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products or technology are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement, and such licensor or vendor shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party software may be provided with the Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent portions of the Software are distributed under and subject to open source licenses obligating Juniper to make the source code for such portions publicly available (such as the GNU General Public License (GPL) or the GNU Library General Public License (LGPL)), Juniper will make such source code portions (including Juniper modifications, as appropriate) available upon request for a period of up to three years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA 94089, ATTN: General Counsel. You may obtain a copy of the GPL at http://www.gnu.org/licenses/gpl.html, and a copy of the LGPL at http://www.gnu.org/licenses/lgpl.html. 15. Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws principles. The provisions of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes arising under this Agreement, the Parties hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal courts within Santa Clara County, California. This Agreement constitutes the entire and sole agreement between Juniper and the Customer with respect to the Software, and supersedes all prior and contemporaneous agreements relating to the Software, whether oral or written (including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in writing by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity of the remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the Parties agree that the English version will govern. (For Canada: Les parties aux prsents confirment leur volont que cette convention de mme que tous les documents y compris tout avis qui s'y rattach, soient redigs en langue anglaise. (Translation: The parties confirm that this Agreement and all related documentation is and will be in the English language)).

iv

Abbreviated Table of ContentsAbout This Guide xxxix

Part 1Chapter 1 Chapter 2

OverviewServices Interfaces Overview Services Interfaces Configuration Statements 3 5

Part 2Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Chapter 12 Chapter 13 Chapter 14 Chapter 15 Chapter 16 Chapter 17 Chapter 18 Chapter 19 Chapter 20 Chapter 21 Chapter 22 Chapter 23 Chapter 24 Chapter 25 Chapter 26 Chapter 27

Adaptive ServicesAdaptive Services Overview Applications Configuration Guidelines Summary of Applications Configuration Statements Stateful Firewall Services Configuration Guidelines Summary of Stateful Firewall Configuration Statements Network Address Translation Services Configuration Guidelines Summary of Network Address Translation Configuration Statements Intrusion Detection Service Configuration Guidelines Summary of Intrusion Detection Service Configuration Statements IPSec Services Configuration Guidelines Summary of IPSec Services Configuration Statements Layer 2 Tunneling Protocol Services Configuration Guidelines Summary of Layer 2 Tunneling Protocol Configuration Statements Link Services IQ Interfaces Configuration Guidelines Summary of Link Services IQ Configuration Statements Voice Services Configuration Guidelines Summary of Voice Services Configuration Statements Class-of-Service Configuration Guidelines Summary of Class-of-Service Configuration Statements Service Set Configuration Guidelines Summary of Service Set Configuration Statements Interface Configuration Guidelines Summary of Interface Configuration Statements Packet Gateway Configuration Guidelines Summary of Packet Gateway Configuration Statements 25 51 89 99 109 121 143 165 177 199 241 273 291 305 365 377 391 403 413 427 445 461 475 491 505

Part 3Chapter 28

Data Link SwitchingData Link Switching Overview 537

Abbreviated Table of Contents

v

JUNOS 9.0 Services Interfaces Configuration Guide

Chapter 29 Chapter 30

Data Link Switching Configuration Guidelines Summary of Data Link Switching Configuration Statements

539 551

Part 4Chapter 31 Chapter 32 Chapter 33

Encryption ServicesEncryption Overview Encryption Interfaces Configuration Guidelines Summary of Encryption Configuration Statements 573 575 585

Part 5Chapter 34 Chapter 35 Chapter 36 Chapter 37 Chapter 38 Chapter 39 Chapter 40 Chapter 41

Flow Monitoring and Discard Accounting ServicesFlow Monitoring and Discard Accounting Overview Flow Monitoring and Discard Accounting Configuration Guidelines Summary of Flow-Monitoring Configuration Statements Flow Collection Configuration Guidelines Summary of Flow Collection Configuration Statements Dynamic Flow Capture Configuration Guidelines Flow-Tap Configuration Guidelines Summary of Dynamic Flow Capture and Flow-Tap Configuration Statements 595 599 647 705 717 735 745 751

Part 6Chapter 42 Chapter 43 Chapter 44

Link and Multilink ServicesLink and Multilink Services Overview Link and Multilink Services Configuration Guidelines Summary of Link Services Configuration Statements 763 767 809

Part 7Chapter 45 Chapter 46 Chapter 47

Real-Time Performance Monitoring ServicesReal-Time Performance Monitoring Services Overview Real-Time Performance Monitoring Configuration Guidelines Summary of Real-Time Performance Monitoring Configuration Statements 831 833 849

Part 8Chapter 48 Chapter 49 Chapter 50

Tunnel ServicesTunnel Services Overview Tunnel Interfaces Configuration Guidelines Summary of Tunnel Services Configuration Statements 871 875 891

Part 9

IndexIndex Index of Commands and Statements 905 923

vi

Table of ContentsAbout This Guide xxxix Objectives .................................................................................................xxxix Audience ..................................................................................................xxxix Supported Routing Platforms ..........................................................................xl Using the Indexes ...........................................................................................xl Using the Examples in This Manual ................................................................xl Merging a Full Example ...........................................................................xli Merging a Snippet ...................................................................................xli Documentation Conventions ........................................................................xlii List of Technical Publications .......................................................................xliv Documentation Feedback .................................................................................l Requesting Technical Support .........................................................................li

Part 1Chapter 1

OverviewServices Interfaces Overview 3

Services PIC Types ..........................................................................................3 Supported Platforms ........................................................................................4 Chapter 2 Services Interfaces Configuration Statements 5

[edit applications] Hierarchy Level ..................................................................5 [edit forwarding-options] Hierarchy Level .......................................................6 [edit interfaces] Hierarchy Level ......................................................................8 [edit logical-routers] Hierarchy Level .............................................................11 [edit protocols] Hierarchy Level .....................................................................11 [edit services] Hierarchy Level .......................................................................12

Table of Contents

vii

JUNOS 9.0 Services Interfaces Configuration Guide

Part 2Chapter 3

Adaptive ServicesAdaptive Services Overview 25

Enabling Service Packages ............................................................................27 Layer 2 Service Package Capabilities and Interfaces ...............................30 Services Configuration Procedure ..................................................................31 Packet Flow Through the Adaptive Services or MultiServices PIC ..................32 Stateful Firewall Overview .............................................................................33 Stateful Firewall Support for Application Protocols ..................................34 Stateful Firewall Anomaly Checking ........................................................34 Network Address Translation Overview .........................................................36 Traditional NAT .......................................................................................36 Twice NAT ..............................................................................................37 IPSec Overview .............................................................................................37 IPSec .......................................................................................................38 Security Associations ..............................................................................38 IKE ..........................................................................................................38 Comparison of IPSec Services and ES Interface Configuration ................39 Layer 2 Tunneling Protocol Overview ............................................................40 Voice Services Overview ...............................................................................40 Class of Service Overview .............................................................................41 Packet Gateway Overview .............................................................................41 Examples: Services Interfaces Configuration .................................................41 Chapter 4 Applications Configuration Guidelines 51

Configuring Application Protocol Properties ..................................................52 Configuring an Application Protocol ........................................................52 Configuring the Network Protocol ...........................................................54 Configuring the ICMP Code and Type .....................................................55 Configuring Source and Destination Ports ...............................................57 Configuring the Inactivity Timeout Period ...............................................60 Configuring SIP .......................................................................................60 Configuring an SNMP Command ............................................................61 Configuring an RPC Program Number ....................................................61 Configuring the TTL Threshold ................................................................61 Configuring a Universal Unique Identifier ...............................................62 Configuring Application Sets .........................................................................62 ALG Descriptions ...........................................................................................62 Basic TCP ALG ........................................................................................63 Basic UDP ALG ........................................................................................63 BOOTP ....................................................................................................64 DCE RPC Services ...................................................................................64 FTP .........................................................................................................64 H323 .......................................................................................................65 ICMP .......................................................................................................65 IIOP ........................................................................................................66 NetShow .................................................................................................66

viii

Table of Contents

Table of Contents

RealAudio ...............................................................................................66 RPC and RPC Portmap Services ..............................................................66 RTSP .......................................................................................................67 SMB ........................................................................................................68 SNMP ......................................................................................................68 SQLNet ...................................................................................................68 TFTP .......................................................................................................69 Traceroute ..............................................................................................69 UNIX Remote-Shell Services ....................................................................69 WinFrame ...............................................................................................70 Verification ....................................................................................................70 FTP Example ..........................................................................................70 Sample Output .................................................................................70 FTP System Log Messages ................................................................71 Analysis ............................................................................................72 Troubleshooting Questions ...............................................................72 RTSP ALG Example .................................................................................73 Sample Output .................................................................................73 Analysis ............................................................................................73 Troubleshooting Questions ...............................................................74 System Log Messages .............................................................................75 System Log Configuration ................................................................76 System Log Output ...........................................................................77 JUNOS Default Groups ...................................................................................77 Examples: Referencing the Preset Statement from the JUNOS Default Group ...............................................................................................83 Examples: Configuring Applications ..............................................................85 Chapter 5 Summary of Applications Configuration Statements 89

application ....................................................................................................89 application-protocol .......................................................................................90 application-set ...............................................................................................91 applications ...................................................................................................91 destination-port .............................................................................................92 icmp-code .....................................................................................................92 icmp-type ......................................................................................................93 inactivity-timeout ..........................................................................................93 learn-sip-register ............................................................................................94 protocol .........................................................................................................95 rpc-program-number .....................................................................................96 sip-call-hold-timeout ......................................................................................96 snmp-command ............................................................................................97 source-port ....................................................................................................97 ttl-threshold ...................................................................................................98 uuid ...............................................................................................................98

Table of Contents

ix

JUNOS 9.0 Services Interfaces Configuration Guide

Chapter 6

Stateful Firewall Services Configuration Guidelines

99

Configuring Stateful Firewall Properties .......................................................100 Configuring the Stateful Firewall Rule Set .............................................100 Configuring Stateful Firewall Rule Content ............................................100 Configuring Match Direction ...........................................................101 Configuring Stateful Firewall Match Conditions ..............................101 Configuring Stateful Firewall Actions ..............................................102 Examples: Configuring Stateful Firewall Properties .....................................104 Chapter 7 Summary of Stateful Firewall Configuration Statements 109

allow-ip-option ............................................................................................110 application-sets ...........................................................................................111 applications .................................................................................................111 destination-address .....................................................................................112 destination-address-range ...........................................................................112 destination-prefix-list ...................................................................................113 from ............................................................................................................113 match-direction ...........................................................................................114 rule ..............................................................................................................115 rule-set ........................................................................................................116 services .......................................................................................................116 source-address ............................................................................................117 source-address-range ...................................................................................117 source-prefix-list ..........................................................................................118 syslog ..........................................................................................................118 term ............................................................................................................119 then .............................................................................................................120 Chapter 8 Network Address Translation Services Configuration Guidelines 121

Configuring Network Address Translation Properties ..................................122 Configuring Address and Port Information ............................................122 Configuring a Pool ..........................................................................122 Specifying the Destination or Source Prefix ....................................124 Addressing Information ..................................................................124 Configuring the NAT Rule Set ................................................................125 Configuring NAT Rule Content ..............................................................125 Configuring NAT Match Direction ...................................................126 Configuring NAT Type ....................................................................127 Configuring NAT Match Conditions ................................................128 Configuring NAT Actions ................................................................129 Examples: Configuring Network Address Translation Properties .................131 Dynamic Source Translation .................................................................131 Static Source Translation .......................................................................132 Dynamic and Static Source Translation .................................................132 Oversubscribed Pool with No Fallback ..................................................133 Oversubscribed Pool with a Fallback to NAPT .......................................134 Multiple Prefixes and Address Ranges in Static Source Translation .......134

x

Table of Contents

Table of Contents

Assigning Addresses from a Dynamic Pool for Static Use .....................135 Configuring NAT Rules Without Defining a Pool ....................................135 Configuring Specific Addresses That Are Not to Be Translated ..............136 Configuring Network Address Translation for Multicast Traffic .............137 Rendezvous Point Configuration ....................................................137 Router 1 Configuration ...................................................................140 Configuring Twice NAT .........................................................................141 Configuring Full-Cone NAT ....................................................................141 Chapter 9 Summary of Network Address Translation Configuration Statements

143

address ........................................................................................................143 address-range ..............................................................................................144 application-sets ...........................................................................................144 applications .................................................................................................145 destination-address .....................................................................................145 destination-address-range ...........................................................................146 destination-pool ..........................................................................................146 destination-prefix ........................................................................................147 destination-prefix-list ...................................................................................147 from ............................................................................................................148 hint .............................................................................................................149 match-direction ...........................................................................................149 nat-type .......................................................................................................150 no-translation ..............................................................................................150 overload-pool ..............................................................................................151 overload-prefix ............................................................................................151 pgcp ............................................................................................................152 pool .............................................................................................................153 port .............................................................................................................154 ports-per-session .........................................................................................154 remotely-controlled .....................................................................................155 rule ..............................................................................................................156 rule-set ........................................................................................................157 services .......................................................................................................157 source-address ............................................................................................158 source-address-range ...................................................................................158 source-pool ..................................................................................................159 source-prefix ...............................................................................................159 source-prefix-list ..........................................................................................160 syslog ..........................................................................................................160 term ............................................................................................................161 then .............................................................................................................162 translated ....................................................................................................163 translation-type ...........................................................................................164 translation-type (Traditional NAT) .........................................................164 translation-type (Twice NAT) .................................................................164

Table of Contents

xi

JUNOS 9.0 Services Interfaces Configuration Guide

Chapter 10

Intrusion Detection Service Configuration Guidelines

165

Configuring Intrusion Detection Properties ..................................................167 Configuring the IDS Rule Set .................................................................167 Configuring IDS Rule Content ...............................................................167 Configuring Match Direction ...........................................................169 Configuring IDS Match Conditions ..................................................169 Configuring IDS Actions .................................................................170 Examples: Configuring Intrusion Detection Properties ................................174 Chapter 11 Summary of Intrusion Detection Service Configuration Statements

177

aggregation .................................................................................................177 application-sets ...........................................................................................178 applications .................................................................................................178 by-destination .............................................................................................179 by-pair .........................................................................................................180 by-source ....................................................................................................181 destination-address .....................................................................................182 destination-address-range ...........................................................................182 destination-prefix ........................................................................................183 destination-prefix-ipv6 ................................................................................183 destination-prefix-list ...................................................................................184 force-entry ..................................................................................................184 from ............................................................................................................185 ignore-entry ................................................................................................185 logging ........................................................................................................186 match-direction ...........................................................................................186 mss .............................................................................................................187 rule ..............................................................................................................188 rule-set ........................................................................................................189 services .......................................................................................................189 session-limit ................................................................................................190 source-address ............................................................................................191 source-address-range ...................................................................................191 source-prefix ...............................................................................................192 source-prefix-ipv6 .......................................................................................192 source-prefix-list ..........................................................................................193 syn-cookie ...................................................................................................193 syslog ..........................................................................................................194 term ............................................................................................................195 then .............................................................................................................197 threshold .....................................................................................................198

xii

Table of Contents

Table of Contents

Chapter 12

IPSec Services Configuration Guidelines

199

Minimum Security Association Configurations ............................................201 Manual SA Configuration ......................................................................201 Dynamic SA Configuration ....................................................................201 Configuring Security Associations ................................................................202 Configuring Manual Security Associations .............................................203 Configuring Direction .....................................................................203 Configuring the Protocol .................................................................204 Configuring the Security Parameter Index ......................................205 Configuring the Auxiliary Security Parameter Index .......................205 Configuring Authentication .............................................................205 Configuring Encryption ..................................................................206 Configuring Dynamic Security Associations ..........................................207 Clearing Security Associations ..............................................................207 Configuring an IKE Proposal ........................................................................208 Configuring an IKE Authentication Algorithm .......................................208 Configuring an IKE Authentication Method ...........................................209 Configuring an IKE Diffie-Hellman Group ..............................................209 Configuring an IKE Encryption Algorithm .............................................209 Configuring the Lifetime for an IKE SA .................................................210 Example: Configuring an IKE Proposal .................................................210 Configuring an IKE Policy ............................................................................211 Configuring the IKE Policy Mode ...........................................................212 Configuring IKE Policy Proposals ..........................................................212 Configuring a Preshared Key ................................................................212 Configuring a Local Certificate ..............................................................213 Configuring a Certificate Revocation List ........................................213 Configuring an IKE Policy Description ..................................................214 Configuring Local and Remote IDs ........................................................214 Example: Configuring an IKE Policy ...............................................215 Configuring an IPSec Proposal .....................................................................216 Configuring an Authentication Algorithm ..............................................216 Configuring an IPSec Proposal Description ...........................................216 Configuring an Encryption Algorithm ....................................................216 Configuring the Lifetime for an IPSec SA ..............................................217 Configuring the Protocol for the Dynamic SA ........................................218 Configuring an IPSec Policy .........................................................................218 Configuring an IPSec Policy Description ...............................................219 Configuring Perfect Forward Secrecy ....................................................219 Configuring IPSec Policy Proposals .......................................................219 Example: IPSec Policy Configuration ....................................................219 Configuring IPSec Service Rules ..................................................................220 Configuring the IPSec Rule Set ..............................................................220 Configuring IPSec Rule Content ............................................................221 Configuring IPSec Match Conditions ...............................................222 Configuring IPSec Actions ..............................................................223 Configuring Dynamic Endpoints ..................................................................226 Authentication Process .........................................................................226 Dynamic Implicit Rules .........................................................................227 Reverse Route Insertion ........................................................................227

Table of Contents

xiii

JUNOS 9.0 Services Interfaces Configuration Guide

Configuring an IKE Access Profile .........................................................228 Configuring the Service Set ...................................................................229 Configuring the Interface Identifier .......................................................230 Default IKE and IPSec Proposals ...........................................................230 Tracing IPSec Operations ............................................................................231 Examples: Configuring IPSec Services .........................................................232 Statically Assigned Tunnels ...................................................................232 Dynamically Assigned Tunnels .............................................................235 Chapter 13 Summary of IPSec Services Configuration Statements 241

authentication .............................................................................................241 authentication-algorithm .............................................................................242 authentication-algorithm (IKE) ..............................................................242 authentication-algorithm (IPSec) ...........................................................242 authentication-method ................................................................................243 auxiliary-spi .................................................................................................243 backup-remote-gateway ..............................................................................244 clear-dont-fragment-bit ................................................................................244 clear-ike-sas-on-pic-restart ...........................................................................245 description ..................................................................................................245 destination-address .....................................................................................246 dh-group ......................................................................................................246 direction ......................................................................................................247 dynamic ......................................................................................................248 encryption ...................................................................................................249 encryption-algorithm ...................................................................................250 from ............................................................................................................251 ike ...............................................................................................................252 ipsec ............................................................................................................253 ipsec-inside-interface ...................................................................................253 lifetime-seconds ..........................................................................................254 local-certificate ............................................................................................254 local-id ........................................................................................................255 manual ........................................................................................................256 match-direction ...........................................................................................256 mode ...........................................................................................................257 no-anti-replay ..............................................................................................257 perfect-forward-secrecy ...............................................................................258 policy ..........................................................................................................259 policy (IKE) ...........................................................................................259 policy (IPSec) ........................................................................................260 pre-shared-key ............................................................................................260 proposal ......................................................................................................261 proposal (IKE) .......................................................................................261 proposal (IPSec) ....................................................................................262 proposals .....................................................................................................262 protocol .......................................................................................................263 remote-gateway ..........................................................................................263 remote-id ....................................................................................................264

xiv

Table of Contents

Table of Contents

rule ..............................................................................................................265 rule-set ........................................................................................................266 services .......................................................................................................266 source-address ............................................................................................267 spi ...............................................................................................................267 syslog ..........................................................................................................268 term ............................................................................................................269 then .............................................................................................................270 traceoptions ................................................................................................271 tunnel-mtu ..................................................................................................272 Chapter 14 Layer 2 Tunneling Protocol Services Configuration Guidelines 273

L2TP Services Components .........................................................................275 L2TP Minimum Configuration .....................................................................276 Configuring L2TP Group Properties .............................................................278 Configuring a Tunnel Group ..................................................................278 Configuring Access Profiles ...................................................................279 Configuring Addressing .........................................................................279 Configuring Window Size ......................................................................280 Configuring Timers ...............................................................................280 Hiding Attribute-Value Pairs ..................................................................281 Configuring System Log Properties .......................................................281 Configuring the Logical Interface Identifier ..................................................282 Configuring Multilink on Shared Interfaces ...........................................283 L2TP Redundancy .......................................................................................284 Tracing L2TP Operations .............................................................................285 Examples: Configuring L2TP Services ..........................................................286 Chapter 15 Summary of Layer 2 Tunneling Protocol Configuration Statements

291

facility-override ...........................................................................................291 hello-interval ...............................................................................................292 hide-avps .....................................................................................................292 host .............................................................................................................293 l2tp-access-profile ........................................................................................293 local-gateway address .................................................................................294 log-prefix .....................................................................................................294 maximum-send-window ..............................................................................295 ppp-access-profile ........................................................................................295 receive-window ...........................................................................................296 retransmit-interval .......................................................................................296 service-interface ..........................................................................................297 services .......................................................................................................298 services (Hierarchy) ..............................................................................298 services (L2TP System Logging) ............................................................299 syslog ..........................................................................................................300 traceoptions ................................................................................................301

Table of Contents

xv

JUNOS 9.0 Services Interfaces Configuration Guide

tunnel-group ................................................................................................303 tunnel-timeout .............................................................................................304 Chapter 16 Link Services IQ Interfaces Configuration Guidelines 305

Layer 2 Service Package Capabilities and Interfaces ....................................306 LSQ Failure Recovery ..................................................................................307 Interchassis LSQ Failover ......................................................................308 Configuring Failover Options ..........................................................308 Configuring Interoperability ...........................................................309 Configuration Restrictions ..............................................................310 Stateless Intrachassis LSQ Failover .......................................................310 Stateful Intrachassis LSQ Failover .........................................................310 Configuring Intrachassis LSQ Redundancy .....................................311 LSQ Failure Conditions and Constraints .........................................312 Link PIC Redundancy .....................................................................313 Examples: Configuring Intrachassis LSQ Redundancy ....................314 Link Services IQ CoS Components ...............................................................318 Scheduler Buffer Size ............................................................................320 Scheduler Priority .................................................................................320 Scheduler Shaping Rate ........................................................................320 Drop Profiles .........................................................................................321 Configuring Fragmentation by Forwarding Class .........................................322 Configuring Link-Layer Overhead ................................................................324 Configuring Multiclass MLPPP .....................................................................324 Oversubscribing Interface Bandwidth ..........................................................325 Example: Oversubscribing an LSQ Interface .........................................328 Providing a Guaranteed Minimum Rate .......................................................329 Example: Providing a Guaranteed Minimum Rate .................................332 Configuring Link Services and CoS ..............................................................332 Link Services CoS on J-series Services Routers .............................................335 Common Uses for the Link Services IQ Interface .........................................337 Configuring an NxT1 Bundle Using MLPPP ...........................................337 Example: Configuring an NxT1 Bundle Using MLPPP .....................340 Configuring an NxT1 Bundle Using FRF.16 ...........................................342 Examples: Configuring an NxT1 Bundle Using FRF.16 ...................345 Configuring a Single Fractional T1 Interface Using MLPPP and LFI .......347 Example: Configuring a Single Fractional T1 Using MLPPP and LFI ...........................................................................................350 Configuring a Single Fractional T1 Interface Using FRF.12 ....................352 Examples: Configuring a Single Fractional T1 Interface Using FRF.12 .....................................................................................354 Configuring an NxT1 Bundle Using FRF.15 ...........................................359 Configuring a T3 Link for Compressed RTP over MLPPP .......................359 Configuring a T3 or OC3 Interface Using FRF.12 ..................................361 Configuring an ATM2 IQ Interface Using MLPPP ...................................363

xvi

Table of Contents

Table of Contents

Chapter 17

Summary of Link Services IQ Configuration Statements

365

cisco-interoperability ...................................................................................365 forwarding-class ..........................................................................................366 fragment-threshold ......................................................................................367 fragmentation-map .....................................................................................367 fragmentation-maps ....................................................................................368 hot-standby .................................................................................................368 link-layer-overhead ......................................................................................369 lsq-failure-options ........................................................................................369 multilink-class .............................................................................................370 multilink-max-classes ..................................................................................370 no-fragmentation ........................................................................................371 no-termination-request ................................................................................371 per-unit-scheduler .......................................................................................372 preserve-interface .......................................................................................372 primary .......................................................................................................373 redundancy-options ....................................................................................373 secondary ....................................................................................................374 trigger-link-failure ........................................................................................374 warm-standby .............................................................................................375 Chapter 18 Voice Services Configuration Guidelines 377

Configuring Voice Services Properties .........................................................379 Configuring the Interface Address .........................................................379 Configuring Compression .....................................................................380 Configuring Delay-Sensitive Packet Interleaving ...................................381 Example: Configuring Compression ......................................................381 Configuring Encapsulation ...........................................................................382 Configuring the Network Interface ..............................................................383 Configuring Voice Services Bundles ......................................................383 Configuring the Compression Interface .................................................383 Configuring VoIP Routing on J-series Services Routers ................................384 Functional Components ........................................................................384 Configuring the VoIP Interface ..............................................................384 Configuring the Media Gateway Controller List .....................................385 Configuring Dynamic Call Admission Control .......................................386 Examples: Configuring Voice Services .........................................................387 Chapter 19 Summary of Voice Services Configuration Statements 391

activation-priority ........................................................................................391 address ........................................................................................................392 bearer-bandwidth-limit ................................................................................393 bundle .........................................................................................................393 compression ................................................................................................394 compression-device .....................................................................................394 dynamic-call-admission-control ...................................................................395 encapsulation ..............................................................................................396

Table of Contents

xvii

JUNOS 9.0 Services Interfaces Configuration Guide

f-max-period ...............................................................................................396 family ..........................................................................................................397 fragment-threshold ......................................................................................398 interfaces ....................................................................................................398 maximum-contexts .....................................................................................399 port .............................................................................................................399 queues .........................................................................................................400 rtp ...............................................................................................................400 unit .............................................................................................................401 Chapter 20 Class-of-Service Configuration Guidelines 403

Configuring Class-of-Service Properties .......................................................404 Configuring the Class-of-Service Rule Set ..............................................404 Configuring Class-of-Service Rule Content .............................................404 Configuring Class-of-Service Match Direction .................................405 Configuring Class-of-Service Match Conditions ...............................406 Configuring Class-of-Service Actions ...............................................407 CoS Configuration Restrictions .......................................................409 Output Packet Rewriting ................................................................409 CoS Hierarchy Configuration Examples .......................................................409 Examples: Configuring Class-of-Service Properties ......................................411 Chapter 21 Summary of Class-of-Service Configuration Statements 413

application-profile .......................................................................................413 application-sets ...........................................................................................414 applications .................................................................................................414 destination-address .....................................................................................415 destination-prefix-list ...................................................................................415 dscp ............................................................................................................416 forwarding-class ..........................................................................................416 from ............................................................................................................417 match-direction ...........................................................................................417 (reflexive | reverse) .....................................................................................418 rule ..............................................................................................................419 rule-set ........................................................................................................420 services .......................................................................................................420 sip-text ........................................................................................................421 sip-video ......................................................................................................421 sip-voice ......................................................................................................422 source-address ............................................................................................422 source-prefix-list ..........................................................................................423 syslog ..........................................................................................................423 term ............................................................................................................424 then .............................................................................................................425

xviii

Table of Contents

Table of Contents

Chapter 22

Service Set Configuration Guidelines

427

Configuring Service Sets ..............................................................................428 Configuring Services Interfaces .............................................................428 Configuring an Interface Service Set ...............................................428 Configuring a Next-Hop Service Set ................................................430 Determining Traffic Direction .........................................................430 Configuring Service Rules .....................................................................432 Configuring IPSec Options ....................................................................433 Configuring the Local Gateway Address ..........................................433 Configuring an IKE Access Profile ...................................................434 Configuring Certification Authorities ...............................................435 Configuring the Maximum Number of Flows ........................................435 Configuring System Log Properties .......................................................435 Allowing Multicast Traffic ......................................................................436 Service Set Extensions for JUNOS SDK Applications .............................437 Interface Service Sets for JUNOS SDK Applications .........................437 Next-Hop Service Sets for JUNOS SDK Applications ........................438 Enabling JUNOS SDK Services ........................................................439 Limitations and Constraints for SDK Services Sets .........................440 Tracing Adaptive Services or MultiServices PIC Operations .........................440 Configuring the Adaptive Services Log Filename ...................................441 Configuring the Number and Size of Adaptive Services Log Files ..........442 Configuring Access to the Log File ........................................................442 Configuring a Regular Expression for Lines to Be Logged ......................442 Configuring the Trace Operations .........................................................443 Example: Configuring Service Sets ..............................................................443 Chapter 23 Summary of Service Set Configuration Statements 445

adaptive-services-pics ..................................................................................445 allow-multicast ............................................................................................446 extension-service ........................................................................................446 facility-override ...........................................................................................447 host .............................................................................................................447 ids-rules .......................................................................................................448 ike-access-profile .........................................................................................448 interface-service ..........................................................................................449 ipsec-vpn-options ........................................................................................449 ipsec-vpn-rules ............................................................................................450 local-gateway ..............................................................................................450 log-prefix .....................................................................................................451 logging ........................................................................................................451 max-flows ...................................................................................................452 nat-rules ......................................................................................................452 next-hop-service ..........................................................................................453 pgcp-rules ....................................................................................................453 service-interface ..........................................................................................454

Table of Contents

xix

JUNOS 9.0 Services Interfaces Configuration Guide

service-set ...................................................................................................455 services .......................................................................................................456 services (Hierarchy) ..............................................................................456 services (System Logging) .....................................................................457 stateful-firewall-rules ...................................................................................457 syslog ..........................................................................................................458 traceoptions ................................................................................................459 trusted-ca ....................................................................................................460 Chapter 24 Interface Configuration Guidelines 461

Naming Services Interfaces .........................................................................462 Configuring Interface Properties ..................................................................463 Configuring the Interface Address and Domain ....................................464 Configuring Default Timeout Settings ....................................................464 Configuring Default System Log Properties ...........................................465 Enabling Fragmentation on GRE Tunnels ..............................................466 Applying Filters and Services to an Interface ...............................................467 Configuring Service Filters ....................................................................468 Configuring AS or MultiServices PIC Redundancy ........................................469 Examples: Configuring a Services Interface .................................................471 Chapter 25 Summary of Interface Configuration Statements 475

address ........................................................................................................475 clear-dont-fragment-bit ................................................................................476 dial-options .................................................................................................476 facility-override ...........................................................................................477 family ..........................................................................................................478 host .............................................................................................................479 inactivity-timeout ........................................................................................479 input ...........................................................................................................480 interfaces ....................................................................................................480 log-prefix .....................................................................................................481 open-timeout ...............................................................................................481 output .........................................................................................................482 post-service-filter .........................................................................................482 primary .......................................................................................................483 redundancy-options ....................................................................................483 secondary ....................................................................................................484 service .........................................................................................................484 service-domain ............................................................................................485 service-filter ................................................................................................485 service-set ...................................................................................................486 services .......................................................................................................487 services-options ...........................................................................................488 syslog ..........................................................................................................489 unit .............................................................................................................490

xx

Table of Contents

Table of Contents

Chapter 26

Packet Gateway Configuration Guidelines

491

Configuring Virtual Packet Gateways ...........................................................493 Configuring Media Inactivity Notification ..............................................494 Configuring a Connection to the Packet Gateway Controller ........................494 Configuring NAT Pools for the Packet Gateway ...........................................495 Configuring a Media Service ........................................................................496 Configuring a Virtual Interface .....................................................................496 Configuring H.248 Timers ...........................................................................496 Configuring Default Values for H.248 Properties .........................................497 Enabling Application Layer Gateways for RTP and RTCP for Media Flows ....498 Configuring Graceful Restart ........................................................................498 Configuring the Service State of a VPG or a Virtual Interface .......................498 Configuring the Service State of a VPG ..................................................498 Configuring the Service State of a Virtual Interface ...............................499 Configuring the Packet Gateway Rule Content .............................................499 Configuring the Packet Gateway Rule Set ....................................................500 Enabling Wildcards for Service Change Notifications ...................................500 Tracing PGCP Operations ............................................................................500 Example: Configuring a Packet Gateway .....................................................501 Chapter 27 Summary of Packet Gateway Configuration Statements 505

algorithm .....................................................................................................505 base-root .....................................................................................................506 cleanup-timeout ..........................................................................................506 controller-address ........................................................................................507 controller-port .............................................................................................507 diffserv ........................................................................................................508 dscp ............................................................................................................508 gate-inactivity-delay ....................................................................................509 gate-inactivity-duration ................................................................................509 gateway .......................................................................................................510 gateway-address ..........................................................................................511 gateway-controller .......................................................................................512 gateway-port ...............................................................................................512 graceful-restart ............................................................................................513 h248-options ...............................................................................................513 h248-properties ...........................................................................................514 h248-timers .................................................................................................515 initial-average-ack-delay ..............................................................................515 interface ......................................................................................................516 interim-ah-scheme ......................................................................................516 maximum-net-propagation-delay ................................................................517 maximum-synchronization-mismatches ......................................................517 maximum-synchronization-time .................................................................518 maximum-waiting-delay ..............................................................................518 media ..........................................................................................................519 media-service ..............................................................................................519 mg-maximum-pdu-size ...............................................................................520

Table of Contents

xxi

JUNOS 9.0 Services Interfaces Configuration Guide

mg-originated-pending-limit ........................................................................520 mg-provisional-response-timer-value ...........................................................521 mg-segmentation-timer ...............................................................................521 mgc-maximum-pdu-size ..............................................................................522 mgc-originated-pending-limit ......................................................................522 mgc-provisional-response-timer-value .........................................................523 mgc-segmentation-timer .............................................................................523 monitor .......................................................................................................524 nat-pool .......................................................................................................524 normal-mg-execution-time ................................................