Hot answers tagged

23

The MX platform does not have the general concept of a "VLAN" that is present on the whole platform. The MX only "sees" VLAN tags on incoming packets and can then act on these tags. What you want is to bridge packets from two ports that have the same VLAN-ID in the L2 header and then add a L3 interface to that bridge. On the MX platform you have two ways of ...


13

No it's not possible today, because neither CSCO or JNPR have implemented LDP to distribute labels for IPV6 prefixes. In my opinion people have too sentimental view on this matter, thinking IPV6-only is value in itself, it's not. You should differentiate services you offer from your control-plane used to offer those. There is no particular reason to have ...


13

You need to be looking under the show chassis hardware stanza. That gives you all the inner-workings of the devices plugged into the chassis, including VC members. On an MX platform, this is along the lines of what you'd expect: user@host> show chassis hardware Hardware inventory: Item Version Part number Serial number Description ...


11

Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches: Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure. set interface x mtu 9216 ...


10

you can copy the configuration from the 'source' switch like this (assuming you've got a domestic software release supporting SSH): show configuration | save user@otherswitch:myconfig And then on 'otherswitch' in edit-mode: load replace myconfig


10

FPC's are similar to Linecards. When dealing with Juniper you will hear FPC more often. FPC's (Flexible PIC Concentrator) houses multiple PICs (Physical Interface Cards) which connect to the physical medium. Linecards are similar in that both FPCs and Linecards are inserted into a chassis device. In Cisco, Linecards are just that. It's a card that's slotted ...


9

This is definitely an issue with your DH key size. Try this: cisco886va(config)#ip ssh dh min size 4096


8

Junos's /etc/ssh/primes file had an off by 8 bug. That is, moduli in that file advertized to be 2048bits, were in fact 2056 bits long. Cisco SSH client is very strict in this regard, and hence refuses to proceed. As a work around, delete /etc/ssh/primes file from your Junos device. This will cause Junos to use Group14 moduli. Thanks


8

The SSG-20 only runs ScreenOS, not JunOS. Juniper switches run JunOS, so this won't help you test your scripts and test configs. Personally, I'd look for a cheap 2nd hand low end model Juniper, but it all depends a bit on your budget.


8

* UPDATED Dec 2017 * Juniper renamed this product to the vSRX (virtual SRX). You can still download a trial copy - https://www.juniper.net/uk/en/products-services/security/srx-series/vsrx/ You can also download Juniper Firefly which is a virtual SRX device (not the same as an Olive). It has a trial 60 day license so you can test out configuring ports and ...


8

UPDATE: As of 16.1 this is possible with the following configuration: set system login idle-timeout n Where n is the number of minutes. https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/idle-timeout--edit-system-login.html For versions of code prior to 16.1, the following answer still works. Setting idle-timeout for ...


8

Preventing Unmanaged Switches and Loops: The best solution would be to block unmanaged switches entirely, except those that you explicitly allow. This can be done by enabling bpduguard on access ports, which would disable any port that receives a bpdu packet. Example: CISCO: Switch(config-if)#spanning-tree bpduguard enable JUNIPER: user@switch# set ...


8

The Cisco command completion uses the <TAB> key (one of the Juniper options). Cisco commands also do not even need to be complete to work; they only need to be complete enough to be unambiguous. For example, most people type sh run rather than the full show running-config. You can also type ? to get the list of options.


8

There's no real difference between iBGP and eBGP here since you can specify a local-address for both. If you do not specify a local-address, the router will pick the address itself, typically the IP of the interface used to reach the peer. If you want to use a different address as a BGP source address, you can specify a local-address. In iBGP, this can be ...


7

ASA crypto map ACLs do not support protocol traffic matching (yeah, I know). The crypto map ACL should match on network, and then either use the global no sysopt connection permit-vpn to apply the interface ACL to tunneled traffic (not recommended) or use a vpn-filter in your tunnel group policy to restrict traffic by protocol. Even if the ASA did allow the ...


7

Your Juniper EX2200 console connections will use the same connection you use when logging in remotely. Getting root is completely dependent on your setup. The following syntax would prevent root login: root-authentication { encrypted-password ****disabled****; ## SECRET-DATA This makes it impossible to login via the root account. If you absolutely ...


7

So it seems the way to go is to use a logical tunnel interface on MX. Just put one end of the lt Interface in the VPLS instance and the other end in the L2VPN instance: lt-1/2/0 { mtu 1514; unit 0 { encapsulation ethernet-ccc; peer-unit 1; family ccc; } unit 1 { encapsulation ...


7

There are 3 real ways to fix this, all of which are fairly simple. Automated Storage Cleanup Juniper has a system cleanup tool for handling this automatically. It operates almost exclusively under the /var/* directory structure; meaning it isn’t all that critical, unless you care about your log files (which you should!). Below is a system storage cleanup ...


7

I don't think that will work, Juniper will just refuse the login since there's no valid authentication mechanism configured. The only way to do this properly is by actually setting a password: user@juniper# set system login user teun authentication plain-text-password and/or a SSH key: user@juniper# set system login user teun authentication ssh-rsa "<...


7

set replaces the current communities on a route with the specified community, while add adds the specified community to any communities already present on that route.


7

You can apply a filter to an interface in the interface: irb { unit 9 { family inet { address 40.224.224.14/29; filter input my-filter; } } } And then define that filter under firewall family inet: firewall { family inet { filter my-filter { term one { # filter ...


6

X indicates that it is a aggressive feature train per KB27144 and TSB16034. The NN is a normal incremental version number.


6

Interface jsrv.1 is always associated to IP address 128.0.0.127. jsrv up up jsrv.1 up up inet 128.0.0.127/2 An archive at SourceForge has the below command output snippet that shows a connection between 128.0.0.127 and port 6343 (sFlow port)1: tcpdump -v udp port 6343 -s 1500: 11:52:07.624977 IP (tos 0x0, ...


6

Just to provide an answer for anyone else experiencing similar issues, this was a cosmetic bug that was fixed from JUNOS 12.3 onwards. Actual update from TAC "There is an issue with the stats collection command where the HW counter was not getting cleared. Thus the stats reporting was continuously incrementing it's counter even though no actual EOPE ...


6

The way eBGP works is that it will always set the next-hop to the directly connected address of the sending router (except for multihop sessions or when the original next-hop is in the same subnet). As you can see in your output the router is sending the route with Nexthop: Self, not with the nexthop you have configured. You can find the decision tree for ...


6

Because it's entirely unnecessary. In JunOS you can have multiple addresses on a single logical interface. > show configuration interfaces lo0.0 family inet { address 127.0.0.1/32; address 127.0.0.2/32; }


6

You can add an individual lo0.x to each routing-instance present. So if you configure multiple routing-instances, you can configure multiple, separate loopback interfaces. And this is 'the proper way to do it', instead of multiple loopbacks per single routing-instance. The purpose of the loopback interface is to act as both an anchor interface for ...


6

I think you're looking for traceoptions for BGP. From the documentation on Juniper's site: Configuring Traceoptions [edit protocols bgp traceoptions] user@router# set file bgp.log size 10m files 10 world-readable [edit protocols bgp traceoptions] user@router# set flag ? Possible completions: 4byte-as Trace 4 byte AS events add-path ...


Only top voted, non community-wiki answers of a minimum length are eligible