VLAN Selection – How to Select S-VLAN from C-VLAN on Juniper EX4200?

Unfortunately not. This is a frustrating limitation of the way Juniper have implemented Isolated ports and Promiscuos ports in PVLANs - it essentially boils down to if the interfaces is in access mode, it's an Isolated port, but if it's tagged, it's a Promiscuous port.

This https://mellowd.co.uk/ccie/?p=5387 is worth a read if you haven't seen it already - goes into a bit more detail than the Juniper Support documentation examples.

Sadly the EX4200 (or any EX) is not able to do this. You would need a separate logical unit for the VLAN which has its own VLAN counters. This works for example on Junipers MX routers but not on EX.

What you can do however is count the packets and bytes with a firewall filter.

I have an working example here, for VLANS 14, 571, 572. You can of course use any VLAN IDs.

Here is the filter:

firewall {
    family ethernet-switching {
        filter vlan-counters {
            interface-specific;
            term vlan-14 {
                from {
                    dot1q-tag 14;
                }
                then {
                    accept;
                    count vlan-14;
                }
            }
            term vlan-571 {
                from {
                    dot1q-tag 571;
                }
                then {
                    accept;
                    count vlan-571;
                }
            }
            term vlan-572 {
                from {
                    dot1q-tag 572;
                }
                then {
                    accept;
                    count vlan-572;
                }
            }
            term default {
                then accept;
            }
        }
    }
}

As you can see we have a separate term for each VLAN we want to count and a default term at the end. This is important as without that last term traffic for other VLANs would be dropped. The interface-specific keyword tells the switch to generate separate counters for each interface.

You can apply this filter to your interfaces:

set interfaces ae0.0 family ethernet-switching filter input vlan-counters 
set interfaces ae0.0 family ethernet-switching filter output vlan-counters 

After that you can see the counters in the show firewall output. Note that they have interface-specific extensions:

Filter: vlan-counters-ae1.0-i                                  
Counters:
Name                                                Bytes              Packets
vlan-14-ae1.0-i                                   7474383                 8504
vlan-571-ae1.0-i                                        0                    0
vlan-572-ae1.0-i                                        0                    0

Filter: vlan-counters-ae1.0-o                                  
Counters:
Name                                                Bytes              Packets
vlan-14-ae1.0-o                                   2651051                 4919
vlan-571-ae1.0-o                                  2057853                14731
vlan-572-ae1.0-o                                      644                   10

Last but not least the SNMP part.

The packet and byte counters displayed above are visible in SNMP under the JUNIPER-FIREWALL-MIB::jnxFWCounterPacketCount and JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount tree.

For example:

$ snmpget -v2c -cpublic 10.1.2.3 'JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount."vlan-counters-ae1.0-o"."vlan-571-ae1.0-o".counter
JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount."vlan-counters-ae1.0-o"."vlan-571-ae1.0-o".counter = Counter64: 298848

If your program does not understand the encoded form of the OID you can translate it to the numeric form with the snmptranslate utility:

$ snmptranslate -On 'JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount."vlan-counters-ae1.0-o"."vlan-571-ae1.0-o".counter'
.1.3.6.1.4.1.2636.3.5.2.1.5.21.118.108.97.110.45.99.111.117.110.116.101.114.115.45.97.101.49.46.48.45.111.16.118.108.97.110.45.53.55.49.45.97.101.49.46.48.45.111.2