Configuring Next-Hop Service Sets; Determining Traffic Direction - Juniper ACX1000 Configuration Manual

Configuring Next-Hop Service Sets

Determining Traffic Direction

Copyright © 2017, Juniper Networks, Inc.
A next-hop service set is a route-based method of applying a particular service. Only
packets destined for a specific next hop are serviced by the creation of explicit static
routes. This configuration is useful when services need to be applied to an entire virtual
routing and forwarding (VRF) table, or when routing decisions determine that services
need to be performed.
When a next-hop service is configured, the IPsec or NAT engine is considered to be a
two-part interface, with one part configured to be the inside interface (inside the network)
and the other configured as the outside interface (outside the network).
To configure the service domain, include the
interfaces interface-name unit logical-unit-number]
[edit interfaces interface-name unit logical-unit-number]
service-domain (inside | outside);
The service-domain setting must match the configuration for the next-hop's inside and
outside services interfaces. To configure the inside and outside services interfaces, include
the statement at the
next-hop-service
level. The interfaces you specify must be logical interfaces on the same NAT engine. You
cannot configure unit 0 for this purpose, and the logical interface you choose must not
be used by another service set.
next-hop-service {
inside-service-interface interface-name.unit-number;
outside-service-interface interface-name.unit-number;
}
Traffic on which the service is applied is forced to the inside interface using a static route.
For example:
routing-options {
static {
route 10.1.2.3 next-hop si-0/0/0.1;
}
}
After the service is applied, traffic exits through the outside interface. A lookup is then
performed in the Packet Forwarding Engine to send the packet out of the NAT engine.
The reverse traffic enters the outside interface, is serviced, and sent to the inside interface.
The inside interface forwards the traffic out of the NAT engine.
When you configure next-hop service sets, the IPsec or NAT engine functions as a two-part
interface, in which one part is the inside interface and the other part is the outside interface.
The following sequence of actions takes place:
service-domain statement at the
hierarchy level:
[edit services service-set service-set-name]
Chapter 33: Configuring IPsec
[edit
hierarchy
1093