Can the SRX 240 just route packets between interfaces?

[shotput87]

I have a SSG240H connected over a wan to a SSG140. Not a VPN, it is layer 2. Everything works fine. I was wondering if the SRX (and SSG) can be set to just route for certain interfaces. No need to keep session info. I have eth0/4 in the same trusted zone as the vlan switching ports. vlan is 192.168.168.0/24 and eth0/4 is 192.168.34.0/24. I have a policy to allow any to any for any interfaces in the trusted zone.

I just want to route traffic. I am afraid that each session setup and tear down is what is causing delays in my application.

Any help would be appreciated.

[JNPRdhanks]

Put the SRX in packet mode.

delete security
set security forwarding-options family mpls mode packet-based
set security forwarding-options family iso mode packet-based
set security forwarding-options family inet6 mode packet-based

[shotput87]

I certain ports to route and the rest to act as a firewall vpn device. is setting to mpls an all or nothing?

[Screenie]

It sure is all or nothing. The whole box goes into packet mode. With filters you can do something like this:

firewall {

  family inet {

    filter <filter name> {

      term <term name> {

          from {…} ## Matching Conditions

           then {

            packet-mode; ## Warning: This action will bypass

            flow infrastructure!!

           accept;

          }

       }

     }

  }

}

Comes from this doc:

http://www.juniper.net/us/en/local/pdf/app-notes/3500192-en.pdf

You could write a filter with just then packet-mode and accept as an action, no from clause. Apply to incomming interface, and all traffic on just that interface should be handled stateless. All other traffic statefull.

Just theory, never tried it. Please report back!