Routing

I'm having trouble getting CBF to work on a J-series 10.0R3 using flow mode.

By default ospf directs traffic to the st0.1 interface. I'd like to use CBF to avoid encrypting ef class traffic. That is, ef should use next-hop interface ge-0/0/0.1 (to 10.1.0.1). However, ef (voip) keeps getting encrypted.

Any pointers would be appreciated.

Cheers

This is my partial config:

version 10.0R3.10;
interfaces {
    ge-0/0/0 {
        per-unit-scheduler;
        vlan-tagging;
        unit 1 {
            vlan-id 1;
            family inet {
                address 10.1.0.2/29;
            }
        }
    }
    st0 {
        unit 1 {
            family inet {
                mtu 1400;
                address 10.2.0.2/29;
            }
        }
    }
}
routing-options {
    forwarding-table {
        export cbf;
    }
}
protocols {
    ospf {
        area 0.0.0.1 {
            nssa;
            interface st0.1;
        }
    }
}
policy-options {
    policy-statement cbf {
        then cos-next-hop-map voip;
    }
}
class-of-service {
    forwarding-policy {
        next-hop-map voip {
            forwarding-class ef {
                next-hop ge-0/0/0.1;
            }
        }
    }
    forwarding-classes {
        queue 0 be;
        queue 1 ef;
        queue 2 af;
        queue 3 nc;
    }
}

Hi,

as far as I can see your routes  only have one next-hop (st.0). According to the documentation:

http://www.juniper.net/techpubs/software/junos/junos56/swconfig56-interfaces/html/cos-config12.html

The following algorithm is used when you apply a configuration to a route:

• If the route is a single next-hop route, all traffic will go to that route; that is, no CBF will take effect.

Kind Regards

Michael Pergament

If this worked for you please flag my post as an "Accepted Solution" so others can benefit.

A kudo would be cool if you think I earned it.

Thanks for pointing that out. I'm using the wrong tool for the job. Instead I've used a routing-instance to meet the requirement.

Cheers

[edit routing-options]
admin# show
interface-routes {
    rib-group inet cleartext;
}
rib-groups {
    cleartext {
        import-rib [ inet.0 cleartext.inet.0 ];
        import-policy link;
    }
}

[edit policy-options]
admin# show
policy-statement link {
    term next-hop {
        from {
            route-filter 10.1.0.0/29 exact;
        }
        then accept;
    }
    term default {
        then reject;
    }
}

[edit routing-instances]
admin# show
cleartext {
    instance-type forwarding;
    routing-options {
        static {
            route 0.0.0.0/0 {
                next-hop 10.1.0.1;
                retain;
            }
        }
    }
}

[edit firewall family inet]
admin# show
filter lan-input {
    term voip {
        from {
            prefix-list {
                pl-voip;
            }
        }
        then {
            routing-instance cleartext;
        }
    }
    term default {
        then {
            forwarding-class be;
        }
    }
}