Редирект на Juniper MX80

[hillers]

Juniper MX80 не получатся реализовать схему Http-redirect для пользователей заблокированных по балансу.
Для подключения пользователей с положительным балансом используем фильтры:

set firewall family inet filter fltr-100Mb-NAT interface-specific
set firewall family inet filter fltr-100Mb-NAT term 1 from source-prefix-list NAT-PREFIX-LIST
set firewall family inet filter fltr-100Mb-NAT term 1 then service-accounting
set firewall family inet filter fltr-100Mb-NAT term 1 then routing-instance NAT-RI
set firewall family inet filter fltr-100Mb-NAT term 2 then service-accounting

set firewall family inet filter fltr-50Mb-NAT interface-specific
set firewall family inet filter fltr-50Mb-NAT term 1 from source-prefix-list NAT-PREFIX-LIST
set firewall family inet filter fltr-50Mb-NAT term 1 then policer plcr-100Mb
set firewall family inet filter fltr-50Mb-NAT term 1 then service-accounting
set firewall family inet filter fltr-50Mb-NAT term 2 then policer plcr-100Mb
set firewall family inet filter fltr-50Mb-NAT term 2 then service-accounting

set firewall policer plcr-100Mb logical-interface-policer
set firewall policer plcr-100Mb if-exceeding bandwidth-limit 1g
set firewall policer plcr-100Mb if-exceeding burst-size-limit 38400000
set firewall policer plcr-100Mb then discard



Для заблокированных по балансу пытались сделать через фильтр такого плана:

set firewall family inet filter fltr-http-redirect term 1 from source-prefix-list NAT-PREFIX-LIST
set firewall family inet filter fltr-http-redirect term 1 from protocol icmp
set firewall family inet filter fltr-http-redirect term 1 from port bootpc
set firewall family inet filter fltr-http-redirect term 1 from port dhcp
set firewall family inet filter fltr-http-redirect term 1 from port domain
set firewall family inet filter fltr-http-redirect term 1 from port netbios-ns
set firewall family inet filter fltr-http-redirect term 1 then policer plcr-8Mb
set firewall family inet filter fltr-http-redirect term 1 then count service_accept
set firewall family inet filter fltr-http-redirect term 1 then accept
set firewall family inet filter fltr-http-redirect term 2 from port http
set firewall family inet filter fltr-http-redirect term 2 then policer plcr-8Mb
set firewall family inet filter fltr-http-redirect term 2 then count redirected
set firewall family inet filter fltr-http-redirect term 2 then routing-instance http-redirect
set firewall family inet filter fltr-http-redirect term 3 then count else_discard

set firewall policer plcr-8Mb logical-interface-policer
set firewall policer plcr-8Mb if-exceeding bandwidth-limit 8m
set firewall policer plcr-8Mb if-exceeding burst-size-limit 1920000
set firewall policer plcr-8Mb then discard

set routing-instances http-redirect instance-type forwarding
set routing-instances http-redirect routing-options static route 0.0.0.0/0 next-hop xxx.xxx.xxx.xxx

Но данная схема не заработала.

[John_Doe]

А в роут инстансе http-redirect маршрут до хоста который туда отправляют есть?

[hillers]

set routing-instances http-redirect routing-options static route 0.0.0.0/0 next-hop xxx.xxx.xxx.xxx

 

на  IP "ххх.ххх.ххх.ххх" находится веб сервер

[Melanxolik]

Show route инстанса.

В той таблице возможно лишнеи маршруты.

[hillers]

root@MX80> show route instance

Instance             Type

         Primary RIB                                     Active/holddown/hidden

master               forwarding

         inet.0                                          604080/0/1718

         inet.1                                          2/0/0

         inet6.0                                         1/0/0

         inet6.1                                         2/0/0

 

NAT-RI               virtual-router

         NAT-RI.inet.0                                   17/0/0

 

juniper_private1 forwarding

         __juniper_private1__.inet.0                     5/0/0

         __juniper_private1__.inet6.0                    3/0/0

 

juniper_private2 forwarding

         __juniper_private2__.inet.0                     2/0/1

 

juniper_private4 forwarding

 

master.anon      forwarding

 

http-redirect        forwarding

 

root@MX80>

[John_Doe]

set routing-instances http-redirect routing-options static route 0.0.0.0/0 next-hop xxx.xxx.xxx.xxx

 

на  IP "ххх.ххх.ххх.ххх" находится веб сервер

Сформулирую по другому. Вы своим правилом поместили ип 1.2.3.4 в роут инстанс,в котором из маршрутов только дефолт.Вопрос как  пакет от  вебсервера вернется к получателю если в инстансе нет до него маршрута?

 

можно сделать как то так

set routing-options interface-routes rib-group inet web-stub

set routing-options rib-groups web-stub import-rib inet.0

set routing-options rib-groups web-stub import-rib http-redirect.inet.0