skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

srx-mpls-in-flow

Design and troubleshoot Juniper SRX MPLS L3VPN deployments in flow mode.

9|Updated Mar 7, 2026
Search Tags:#vrf#junos#juniper#mpls#flow-mode#srx#l3vpn
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-mpls-in-flow-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: srx-mpls-in-flow
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-mpls-in-flow
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-mpls-in-flow-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Configuring an SRX as a secure MPLS L3VPN PE or CPE is error-prone: forwarding modes, VRF context, policy matching, and NAT must all align across Junos releases, and a wrong stanza silently breaks tenant isolation or stateful inspection. This Skill pins the agent to verified Junos 24.2R1+/25.4R1 syntax and a structured verification workflow. ## Core Features & Use Cases - Forwarding-mode design: Configure family mpls packet-based while keeping inet/inet6 flow-based, with platform and release support notes per SRX model. - VRF-aware policy and NAT: Build L3VPN VRF-group policy matching (24.2 style) or VRF-to-zone mapping (25.4R1+), plus VRF-aware source/static NAT and AppID verification. - Troubleshooting matrix and verification workflow: Symptom-to-cause tables, operational show commands, packet capture guidance, and PowerMode/RFP performance cautions. - Use Case: An engineer must deploy an SRX4600 as a secure PE with two overlapping customer VRFs; the Skill produces the VRF, MP-BGP, zone, policy, and NAT configuration plus a step-by-step verification checklist. ## Quick Start Use the srx-mpls-in-flow skill to design and verify an SRX MPLS L3VPN flow-mode deployment for my PE router with two customer VRFs.

Frequently Asked Questions about srx-mpls-in-flow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure SRX MPLS L3VPN in flow mode?▼

Set family mpls to packet-based while leaving inet and inet6 flow-based, then build the MPLS underlay with MTU, IGP, LDP, and MP-BGP inet-vpn. Define VRFs with route distinguisher, vrf-target, and vrf-table-label, bind customer interfaces, and apply VRF-aware security policy.

What is the difference between L3VPN VRF-group policy and VRF-to-zone mapping?▼

VRF-group matching (Junos 24.2 style) adds source or destination l3vpn-vrf-group match conditions to zone policies. VRF-to-zone mapping (25.4R1+) binds a VRF directly to a security zone, simplifying policy, but cannot mix interfaces and VRFs in one zone and does not replace VRF-groups for NAT.

Which SRX platforms support MPLS in flow mode?▼

The decoupled model from Junos 24.2R1 covers SRX300 series, SRX1500, SRX4100/4200, SRX1600/2300/4120/4300, and vSRX; Junos 25.4R1 adds SRX4600/4700 with VRF-to-zone mapping. Always confirm the exact release and platform in current Juniper documentation.

Why does SRX VRF local interface traffic fail in an L3VPN?▼

The most common cause is a missing vrf-table-label statement, which SRX requires for VRFs with local interfaces. Also check route-target mismatches, interface binding to the routing instance, and routes in the VRF's inet.0 table.

Should I disable PowerMode for SRX MPLS traffic?▼

MPLS traffic is processed in the Regular Flow Path, not PowerMode, so disabling PM can remove eligibility-check overhead on MPLS-dedicated devices. Keep PM enabled if the SRX also carries non-MPLS or IPsec workloads that benefit from it.

Related Skills

Explore More Software Engineering Skills→
automateyournetworkautomateyournetwork
650

fwrule-analyzer

Detects firewall rule overlaps, shadowing, conflicts, and duplicates across ten vendor platforms.

Community
Intermediate
nguyenpv1980-wqnguyenpv1980-wq
2

rls-policy-auditor

Audit Postgres row-level security policies for tenant isolation failures.

Community
Advanced
rloisellrloisell
7

network-security

Define ACLs, NAT/PAT, IPsec VPNs, and zone-based firewall policies for Cisco IOS/IOS-XE and Linux iptables.

Community
Advanced
naruto11ethnaruto11eth
1

metaplex

Create and manage Solana NFTs, compressed NFTs, and token launches using Metaplex programs.

Community
Advanced