23

The MX platform does not have the general concept of a "VLAN" that is present on the whole platform. The MX only "sees" VLAN tags on incoming packets and can then act on these tags. What you want is to bridge packets from two ports that have the same VLAN-ID in the L2 header and then add a L3 interface to that bridge. On the MX platform you have two ways of ...


12

'monitor start messages' is roughly equivalent to 'term mon. 'messages' is the name of the log file you want to monitor. If you don't see the output you expect, you need to change what is logged to given file from 'set configuration system syslog file X ...'.


12

% strings jkernel-ppc-13.2R1.7|grep "FreeBSD: release" $FreeBSD: release/7.3.0/sys/kern/kern_pmc.c 193634 2009-06-07 10:00:35Z fabient $ 13.3 will be running 10.0. (edit: alas, this turned out not to be true)


10

What is the functional difference between these two TPID values? 0x8100 This TPID is used in 802.1Q - its your average, everyday VLAN tagging. A common use for VLANs is for enterprises to organize their network into functional groups (like research, finance, or management). 0x88a8 This TPID is used in 802.1ad - its used for provider bridging (also known as ...


9

The problem is the: [edit protocols rsvp] load-balance bandwidth If you look at the Juniper documentation for Unequal Cost Load Balancing RSVP LSPs, it states: For uneven load balancing using bandwidth to work, you must have at least two equal-cost LSPs toward the same egress router and at least one of the LSPs must have a bandwidth value configured at ...


8

UPDATE: As of 16.1 this is possible with the following configuration: set system login idle-timeout n Where n is the number of minutes. https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/idle-timeout--edit-system-login.html For versions of code prior to 16.1, the following answer still works. Setting idle-timeout for ...


8

The Cisco command completion uses the <TAB> key (one of the Juniper options). Cisco commands also do not even need to be complete to work; they only need to be complete enough to be unambiguous. For example, most people type sh run rather than the full show running-config. You can also type ? to get the list of options.


8

There's no real difference between iBGP and eBGP here since you can specify a local-address for both. If you do not specify a local-address, the router will pick the address itself, typically the IP of the interface used to reach the peer. If you want to use a different address as a BGP source address, you can specify a local-address. In iBGP, this can be ...


7

Your Juniper EX2200 console connections will use the same connection you use when logging in remotely. Getting root is completely dependent on your setup. The following syntax would prevent root login: root-authentication { encrypted-password ****disabled****; ## SECRET-DATA This makes it impossible to login via the root account. If you absolutely ...


7

Do you need a "from" clause in a policy-statement? No. You don't. Without a "from" class everything will match. Can you pre-pend your own AS on advertisements in JUNOS to eBGP peers? Yes, of course you can, that's the typical way in which AS prepending is being done. So the real question is: why doesn't this work? One thing which I'm not sure ...


7

test policy PS-Filter-Prefix-Size 0.0.0.0/0 This should display routes passing the policy There isn't direct way to ask the opposite, but you could create policy which calls 'PS-Filter-Prefix-Size' and then rejects and accepts rest. Testing this policy would yield opposite results, showing routes not passing 'PS-Filter-Prefix-Size'. As far as I understand ...


7

I don't think that will work, Juniper will just refuse the login since there's no valid authentication mechanism configured. The only way to do this properly is by actually setting a password: user@juniper# set system login user teun authentication plain-text-password and/or a SSH key: user@juniper# set system login user teun authentication ssh-rsa "<...


7

As per the RFC, link-local addresses will be used for any Neighbour Discovery including RA messages. Source: https://www.rfc-editor.org/rfc/rfc4861#section-4.2 PacketLife has a good blog post that clearly explains Neighbour Discovery. http://packetlife.net/blog/2008/aug/28/ipv6-neighbor-discovery/


7

set replaces the current communities on a route with the specified community, while add adds the specified community to any communities already present on that route.


6

X indicates that it is a aggressive feature train per KB27144 and TSB16034. The NN is a normal incremental version number.


6

Per port, not aggregate. Schedulers are not global, rather per interface queue.


6

Interface jsrv.1 is always associated to IP address 128.0.0.127. jsrv up up jsrv.1 up up inet 128.0.0.127/2 An archive at SourceForge has the below command output snippet that shows a connection between 128.0.0.127 and port 6343 (sFlow port)1: tcpdump -v udp port 6343 -s 1500: 11:52:07.624977 IP (tos 0x0, ...


6

Just to provide an answer for anyone else experiencing similar issues, this was a cosmetic bug that was fixed from JUNOS 12.3 onwards. Actual update from TAC "There is an issue with the stats collection command where the HW counter was not getting cleared. Thus the stats reporting was continuously incrementing it's counter even though no actual EOPE ...


6

Because it's entirely unnecessary. In JunOS you can have multiple addresses on a single logical interface. > show configuration interfaces lo0.0 family inet { address 127.0.0.1/32; address 127.0.0.2/32; }


6

You can add an individual lo0.x to each routing-instance present. So if you configure multiple routing-instances, you can configure multiple, separate loopback interfaces. And this is 'the proper way to do it', instead of multiple loopbacks per single routing-instance. The purpose of the loopback interface is to act as both an anchor interface for ...


6

I solved this problem finally. By capturing and comparing DHCP Discover packets sent from JunOS and Cisco, I found Cisco sends Option 64 Client Identifier and Option 12 Host Name by default. However, JunOS will not send them without explicit instructions. I think my ISP sets up a filter or something on their side. The above two options are mandatory. When I ...


6

Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly. The biggest practical example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have ...


6

TCNs are only generated from non-edge ports when they receive a BPDU. Verify that your access ports are configured as edge ports under your spanning-tree config. set protocols rstp interface ge-0/0/0 edge


6

This is actually default behavior. The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS). So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests. If you attempt to login, but TACACS rejects your password, the ...


6

It's just slightly different syntax, if you're trying to match lines containing specific strings, you'd use: show configuration | match "abc|xyz" Also, here's the documentation in case you want to get fancier: JUNOS Command Regex


6

You can use show ethernet switching table. The following is taken from, Configuring MAC Limiting (Official Juniper Documentation). Configure: [edit ethernet-switching-options secure-access-port] user@host# set interface all allowed-mac 00:05:85:3A:82:80 user@host# set interface all allowed-mac 00:05:85:3A:82:81 user@host# set interface all allowed-mac 00:...


6

For some reason the Juniper documentation (http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html) doesn't mention it, but it is possible. The command is: ssh <username>@<hostname>


6

Sadly the EX4200 (or any EX) is not able to do this. You would need a separate logical unit for the VLAN which has its own VLAN counters. This works for example on Junipers MX routers but not on EX. What you can do however is count the packets and bytes with a firewall filter. I have an working example here, for VLANS 14, 571, 572. You can of course use ...


6

I'll try to help where I can. I know next to nothing about Juniper, but the theory should be the same. Implementation should be the only difference. So let's start with RD's. Each tenant has one VRF. Each VRF has a single Route Distinguisher. If you're not familiar with RD's, they are a way to mark routes in the BGP database, to keep them unique. More ...


Only top voted, non community-wiki answers of a minimum length are eligible