Juniper SRX packet mode switch back to flow mode (verification)

Probably you know how to enable srx to run in packet mode (due to MPLS header being just after the ethernet header, it applies to inet family also).

To check the mode that an SRX box is running under:

Code:

# run show security flow status    
  Flow forwarding mode:
    Inet forwarding mode: packet based
    Inet6 forwarding mode: drop
    MPLS forwarding mode: packet based
    ISO forwarding mode: drop
    Advanced services data-plane memory mode: Default
  Flow trace status
    Flow tracing status: off

Right now my box is running in packet mode. This means that nat/ipsec/stateless firewall functions and policies are all disabled. The box is a soho router.

SRX change packet mode to flow mode

Deleting the configuraiton under "security forwarding-options family mpls" will disable packet mode (but not immediately):

Code:

root@cameron# show security forwarding-options 
family {
    mpls {
        mode packet-based;
    }
}

[edit]
# delete security forwarding-options 

[edit]
# commit 
run show security flow status 
commit complete

[edit]
# run show security flow status 
  Flow forwarding mode:
    Inet forwarding mode: packet based (reboot needed to change to flow based)
    Inet6 forwarding mode: drop
    MPLS forwarding mode: packet based (reboot needed to change to drop)
    ISO forwarding mode: drop
    Advanced services data-plane memory mode: Default
  Flow trace status
    Flow tracing status: off

Switching back to flow mode will trigger MPLS family to be dropped by default, unless you are configuring selective packet mode ( only some interfaces will work in packet mode) for both families mpls and inet on the input (see http://www.juniper.net/us/en/local/pdf/app-notes/3500192-en.pdf, page 16 for more details.

After reboot:

Code:

> show security flow status 
  Flow forwarding mode:
    Inet forwarding mode: flow based
    Inet6 forwarding mode: drop
    MPLS forwarding mode: drop
    ISO forwarding mode: drop
    Advanced services data-plane memory mode: Default
  Flow trace status
    Flow tracing status: off

https://forum.ivorde.com/juniper-srx-packet-mode-how-to-switch-between-flow-mode-and-packet-mode-t19681.html