10

What is the functional difference between these two TPID values? 0x8100 This TPID is used in 802.1Q - its your average, everyday VLAN tagging. A common use for VLANs is for enterprises to organize their network into functional groups (like research, finance, or management). 0x88a8 This TPID is used in 802.1ad - its used for provider bridging (also known as ...


9

The problem is the: [edit protocols rsvp] load-balance bandwidth If you look at the Juniper documentation for Unequal Cost Load Balancing RSVP LSPs, it states: For uneven load balancing using bandwidth to work, you must have at least two equal-cost LSPs toward the same egress router and at least one of the LSPs must have a bandwidth value configured at ...


8

UPDATE: As of 16.1 this is possible with the following configuration: set system login idle-timeout n Where n is the number of minutes. https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/idle-timeout--edit-system-login.html For versions of code prior to 16.1, the following answer still works. Setting idle-timeout for ...


8

The Cisco command completion uses the <TAB> key (one of the Juniper options). Cisco commands also do not even need to be complete to work; they only need to be complete enough to be unambiguous. For example, most people type sh run rather than the full show running-config. You can also type ? to get the list of options.


8

There's no real difference between iBGP and eBGP here since you can specify a local-address for both. If you do not specify a local-address, the router will pick the address itself, typically the IP of the interface used to reach the peer. If you want to use a different address as a BGP source address, you can specify a local-address. In iBGP, this can be ...


7

Your Juniper EX2200 console connections will use the same connection you use when logging in remotely. Getting root is completely dependent on your setup. The following syntax would prevent root login: root-authentication { encrypted-password ****disabled****; ## SECRET-DATA This makes it impossible to login via the root account. If you absolutely ...


7

Do you need a "from" clause in a policy-statement? No. You don't. Without a "from" class everything will match. Can you pre-pend your own AS on advertisements in JUNOS to eBGP peers? Yes, of course you can, that's the typical way in which AS prepending is being done. So the real question is: why doesn't this work? One thing which I'm not sure ...


7

I don't think that will work, Juniper will just refuse the login since there's no valid authentication mechanism configured. The only way to do this properly is by actually setting a password: user@juniper# set system login user teun authentication plain-text-password and/or a SSH key: user@juniper# set system login user teun authentication ssh-rsa "<...


7

As per the RFC, link-local addresses will be used for any Neighbour Discovery including RA messages. Source: https://www.rfc-editor.org/rfc/rfc4861#section-4.2 PacketLife has a good blog post that clearly explains Neighbour Discovery. http://packetlife.net/blog/2008/aug/28/ipv6-neighbor-discovery/


7

set replaces the current communities on a route with the specified community, while add adds the specified community to any communities already present on that route.


6

Just to provide an answer for anyone else experiencing similar issues, this was a cosmetic bug that was fixed from JUNOS 12.3 onwards. Actual update from TAC "There is an issue with the stats collection command where the HW counter was not getting cleared. Thus the stats reporting was continuously incrementing it's counter even though no actual EOPE ...


6

Because it's entirely unnecessary. In JunOS you can have multiple addresses on a single logical interface. > show configuration interfaces lo0.0 family inet { address 127.0.0.1/32; address 127.0.0.2/32; }


6

Per port, not aggregate. Schedulers are not global, rather per interface queue.


6

X indicates that it is a aggressive feature train per KB27144 and TSB16034. The NN is a normal incremental version number.


6

Interface jsrv.1 is always associated to IP address 128.0.0.127. jsrv up up jsrv.1 up up inet 128.0.0.127/2 An archive at SourceForge has the below command output snippet that shows a connection between 128.0.0.127 and port 6343 (sFlow port)1: tcpdump -v udp port 6343 -s 1500: 11:52:07.624977 IP (tos 0x0, ...


6

You can add an individual lo0.x to each routing-instance present. So if you configure multiple routing-instances, you can configure multiple, separate loopback interfaces. And this is 'the proper way to do it', instead of multiple loopbacks per single routing-instance. The purpose of the loopback interface is to act as both an anchor interface for ...


6

I solved this problem finally. By capturing and comparing DHCP Discover packets sent from JunOS and Cisco, I found Cisco sends Option 64 Client Identifier and Option 12 Host Name by default. However, JunOS will not send them without explicit instructions. I think my ISP sets up a filter or something on their side. The above two options are mandatory. When I ...


6

Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly. The biggest practical example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have ...


6

TCNs are only generated from non-edge ports when they receive a BPDU. Verify that your access ports are configured as edge ports under your spanning-tree config. set protocols rstp interface ge-0/0/0 edge


6

This is actually default behavior. The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS). So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests. If you attempt to login, but TACACS rejects your password, the ...


6

It's just slightly different syntax, if you're trying to match lines containing specific strings, you'd use: show configuration | match "abc|xyz" Also, here's the documentation in case you want to get fancier: JUNOS Command Regex


6

You can use show ethernet switching table. The following is taken from, Configuring MAC Limiting (Official Juniper Documentation). Configure: [edit ethernet-switching-options secure-access-port] user@host# set interface all allowed-mac 00:05:85:3A:82:80 user@host# set interface all allowed-mac 00:05:85:3A:82:81 user@host# set interface all allowed-mac 00:...


6

For some reason the Juniper documentation (http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html) doesn't mention it, but it is possible. The command is: ssh <username>@<hostname>


6

Sadly the EX4200 (or any EX) is not able to do this. You would need a separate logical unit for the VLAN which has its own VLAN counters. This works for example on Junipers MX routers but not on EX. What you can do however is count the packets and bytes with a firewall filter. I have an working example here, for VLANS 14, 571, 572. You can of course use ...


6

I'll try to help where I can. I know next to nothing about Juniper, but the theory should be the same. Implementation should be the only difference. So let's start with RD's. Each tenant has one VRF. Each VRF has a single Route Distinguisher. If you're not familiar with RD's, they are a way to mark routes in the BGP database, to keep them unique. More ...


6

The easiest way to do this is: create a file with the set statements (probably using some script) copy that file to your router use load set <filename> to execute the set of statements More information on loading configuration files can be found in this Juniper document.


6

There are a number of ways to do this. You can do a 'show configuration | display xml' to get an XML output from the router. Another, probably better option would be to use netconf, which uses the XML representation mentioned before. If you want to use an API, I suggest you check out PyEZ, a python library which allows you to communicate with a Juniper ...


5

You should consider policing since your concern is that they don't get more bandwidth than they have been allotted. This will give you a hard limit. Your shaping in this instance is just ensuring that 31457280 goes into the BE forwarding-class, not that they can't get more bandwidth than 31457280.


5

In screenos the command set vrouter "trust-vr" is moving you into editing the trust-vr router section. trust-vr is normally the default routing instance. The next command set route 80.70.128.142/32 vrouter "UntrustGi-vr" preference 20 metric 1 adds an entry into the trust-vr routing table saying route all traffic to 80.70.128.142/32 to another virtual ...


5

The syntax of the show log command is show log "filename". First try: show log This command will show you all files in the log directory. You will probably get the log entries you want simply by typing: show log messages.0.gz No need to think about decompressing the file. Junos will do this for you.


Only top voted, non community-wiki answers of a minimum length are eligible