SRX packet mode

JunOS can have two modes which are Flow and Packet mode in the following devices;

  • J-series services routers (I think after 9.3 version). This is also called junos enhanced services (junos-es)
  • SRX security devices

In default configuration SRX devices work in flow mode by which security policies are in place and unless otherwise allowed, packets are dropped i.e it works as a firewall device. What if you want to configure SRX as a router only device for this you should change from flow mode to packet mode as below.

or as SET command

For this config to commit properly, you must deactive/remove security policies otherwise you will receive the following warning;

Commit the config and reboot the device as this is required

To check the flow mode after the reboot;

Have a nice packet mode!

8 thoughts on “SRX packet mode

  1. Andrew Radford

    Thanks for this, nice post. The ‘set security forwarding-options family mpls mode packet-based’ command was just what I needed to get my solution working. I needed to strip out all the Firewall services on the SRX and just be a ‘router’.

    Reply
  2. Arsen

    Hi all, firefly-perimeter JUNOS Software Release [12.1X46-D10.2] “mpls mode packet-based” working incorrectly, if you delete interface or create new you will see warning “you have changed flow mode and you must reboot to take effect”.

    Reply
    1. rtoodtoo Post author

      Hi Arsen,
      that is a known bug. It will be fixed but you should check new release notes to see on which one it is fixed.

      Reply
  3. Arsen

    Thank you, I’ve fixed this problem, using security zones:
    security {
    zones {
    security-zone accept_all {
    interfaces {
    all {
    host-inbound-traffic {
    system-services {
    all;
    }
    protocols {
    all;
    }
    }
    }
    }
    }
    }
    }
    Do you know more brief decision?

    Reply
    1. rtoodtoo Post author

      Hi,
      You shouldn’t be allowing every service,zones in all interfaces. If it is for a test no problem. If not better to wait for the fixed release as I am not aware of any workaround yet.

      Reply
      1. Brju

        Hi,

        Nice post.
        One question here come to me. Once we turn SRX to packet / Router mode , Can we use SRX as Virtual chassis ?

        Many THanks,

        Brju

        Reply
        1. rtoodtoo Post author

          By virtual chassis, if you mean chassis cluster then no. There isn’t much point to have it in packet mode.Instead you can use VRRP

          Reply

You have a feedback?