MetricSplit › Guides › Juniper SRX

How to send IPFIX from a Juniper SRX firewall to a flow collector

SRX firewalls export IPFIX with inline J-Flow: a template, a sampling instance and sampling on the interfaces.

What it sends

IPFIX records with standard fields, one template per address family (Juniper: one IPv4 and one IPv6 template at a time). Juniper lists IPFIX templates on SRX4100, SRX4200, SRX4600, SRX5000-line and vSRX from Junos 19.4R1, and on SRX300, SRX320, SRX340, SRX345 and SRX550HM from 20.1R1.

Steps

1. An IPFIX template under services flow-monitoring version-ipfix (for example template ipfix-ipv4 with ipv4-template).
2. In that template, set the active timeout to 10 seconds, the shortest Junos allows there (Juniper: 10 - 600 seconds, default 60): set services flow-monitoring version-ipfix template ipfix-ipv4 flow-active-timeout 10. Why: MetricSplit works in 5-minute readings, so a long-running flow has to be reported at least every minute to land in the right reading.
3. A sampling instance under forwarding-options sampling instance that samples every packet: input rate 1 (one in 1, so the counts are the real totals, with nothing to scale up), and family inet output flow-server 192.0.2.10 port 2055 version-ipfix template ipfix-ipv4, with an inline-jflow source-address.
4. Sampling on the interfaces to report: family inet sampling input and output.
5. Juniper's guide gives the exact statements for your model and release; check them there.

Check it's working

Juniper's commands: show services accounting status inline-jflow, show services accounting flow inline-jflow and show services accounting errors inline-jflow.

Vendor documentation

• Junos: IPFIX formatting for SRX J-Flow
• Junos: Configuring inline active flow monitoring to use IPFIX flow templates

All vendors