Hot answers tagged

30

I think, you can use show | compare from configuration mode.


23

The MX platform does not have the general concept of a "VLAN" that is present on the whole platform. The MX only "sees" VLAN tags on incoming packets and can then act on these tags. What you want is to bridge packets from two ports that have the same VLAN-ID in the L2 header and then add a L3 interface to that bridge. On the MX platform you have two ways of ...


18

I am only directly aware of one issue with BFD, which is CPU demand. I am currently investigating an issues with a Cisco 7301 which when pushing more traffic during our peak hours, compared to the rest of the day, BFD is sometimes timing out and routing trips over to the next link. It seems that under high traffic volumes the router CPU usage is rising (...


17

There might be some helpful information for you at the Juniper Knowledge Center. If RPD is consuming high CPU, then perform the following checks and verify the following parameters: Check the interfaces: Check if any interfaces are flapping on the router. This can be verified by looking at the output of the show log messages and show interfaces ge-x/y/z ...


16

You can check the Amsterdam Internet Exchange's Config Guide for hints on how to silence switches from a variety of vendors. In my experience there are vendors whose software is so bad that their equipment is never silent, for example they ARP out every interface when they boot, or send out some upon a link up event on a port. Juniper, Cisco, Brocade can be ...


13

Yes, this data is populated in the Firewall MIB .1.3.6.1.4.1.2636.3.5.2.1.5 contains your counters .1.3.6.1.4.1.2636.3.5.2.1.6 contains your filter names .1.3.6.1.4.1.2636.3.5.2.1.7 contains your counter names show firewall filter RE-FILTER | match mgmt_ntp mgmt_ntp 199728 2628 % snmpbulkwalk jnpr .1.3.6.1.4.1.2636.3.5.2.1.7|grep ...


13

No it's not possible today, because neither CSCO or JNPR have implemented LDP to distribute labels for IPV6 prefixes. In my opinion people have too sentimental view on this matter, thinking IPV6-only is value in itself, it's not. You should differentiate services you offer from your control-plane used to offer those. There is no particular reason to have ...


13

You need to be looking under the show chassis hardware stanza. That gives you all the inner-workings of the devices plugged into the chassis, including VC members. On an MX platform, this is along the lines of what you'd expect: user@host> show chassis hardware Hardware inventory: Item Version Part number Serial number Description ...


11

Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches: Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure. set interface x mtu 9216 ...


10

you can copy the configuration from the 'source' switch like this (assuming you've got a domestic software release supporting SSH): show configuration | save user@otherswitch:myconfig And then on 'otherswitch' in edit-mode: load replace myconfig


9

I opened a case with HP concerning this issue. After escalating past the useless Level 1 tech, the Level 2 tech very alertly spotted something that I had not. The SRX is sending its DHCPDISCOVER packet with a TTL of 1. The Procurve's apparently will decrement the TTL and use the resulting TTL in the relay'ed packet to the DHCP server. In this case, the ...


9

This is definitely an issue with your DH key size. Try this: cisco886va(config)#ip ssh dh min size 4096


9

FPC's are similar to Linecards. When dealing with Juniper you will hear FPC more often. FPC's (Flexible PIC Concentrator) houses multiple PICs (Physical Interface Cards) which connect to the physical medium. Linecards are similar in that both FPCs and Linecards are inserted into a chassis device. In Cisco, Linecards are just that. It's a card that's slotted ...


8

Short answer, just use Resource ReSerVation Protocol (RSVP). Long answer, you could use multi-topology-routing and have multiple metrics in each interface and force some packets to different topology than another packets. But I would not really venture there. You might want to talk to your account team that you want segment routing implemented: http://...


8

In cases where common configure mode is unavailable, like when the chassis are clustered, you can use the following method. After executing a commit at, JunOS checks the config and creates the file /config/juniper.conf+.gz. The running config database is locked until the commit at time, so other users won't be able to commit interim changes. Other users ...


8

You are looking for the "Logical Interface (Aggregate) Policer": http://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/policer-logical-interface-aggregate-overview.html Unfortunately they are only available on EX9200 (which is a castrated MX) if the information on the EX feature page is correct: http://www.juniper.net/techpubs/en_US/release-...


8

This is where switches such as the Metro-E series from Cisco come in, by default all the downstream ports run in UNI mode which means that they dont send out CDP, STP or any frames at all from other UNI ports. Another thing you could look at is private VLAN's and then disabling things like CDP.


8

To name a few things: development, maintenance testing and support of software and hardware and of course: marketing and profit. Also, these vendors use dedicated ASICs so packet forwarding (amongst other things) are done in hardware instead of software. Basically, you buy a box which is optimized for one task: routing, which means all code and hardware has ...


8

There is no reason to limit customer to blackhole only /32, allow them to blackhole anything from them. Something like this: policy-statement AS42-IN { term blackhole { from { community BLACKHOLE; prefix-list-filter AS42 orlonger; } then { community add NO-EXPORT; next-hop 192.0.2....


8

Junos's /etc/ssh/primes file had an off by 8 bug. That is, moduli in that file advertized to be 2048bits, were in fact 2056 bits long. Cisco SSH client is very strict in this regard, and hence refuses to proceed. As a work around, delete /etc/ssh/primes file from your Junos device. This will cause Junos to use Group14 moduli. Thanks


8

The SSG-20 only runs ScreenOS, not JunOS. Juniper switches run JunOS, so this won't help you test your scripts and test configs. Personally, I'd look for a cheap 2nd hand low end model Juniper, but it all depends a bit on your budget.


8

Smallest switch would be an EX-2200c. I bought one for my home lab. It has 12 ports and most of the important features. You can even use virtual chassis functionality (with up to 2 or 4 devices). Junosphere might also be worth a look. And I guess you already know about the Junos Fasttrack program where you can get the training materials for the "lower" ...


8

* UPDATED Dec 2017 * Juniper renamed this product to the vSRX (virtual SRX). You can still download a trial copy - https://www.juniper.net/uk/en/products-services/security/srx-series/vsrx/ You can also download Juniper Firefly which is a virtual SRX device (not the same as an Olive). It has a trial 60 day license so you can test out configuring ports and ...


8

The Cisco command completion uses the <TAB> key (one of the Juniper options). Cisco commands also do not even need to be complete to work; they only need to be complete enough to be unambiguous. For example, most people type sh run rather than the full show running-config. You can also type ? to get the list of options.


7

The reference guide does state that configuring class of service on the main router will work for logical systems: Port mirroring, source class usage, destination class usage, unicast reverse-path forwarding, class of service, firewall filters, class-based forwarding, and policy-based accounting work with logical systems when you configure these features ...


7

Juniper KB explaining how to locate / interpret information in the Kmd log : How do I Find the VPN Entry in the Kmd Log on a J-Series or SRX-Series device? although for releases prior to 12 the following kmd log issues below are also relevant for the higher end firewalls. [SRX High End] request security ike debug-enable does not print any useful kmd debug ...


7

Your Juniper EX2200 console connections will use the same connection you use when logging in remotely. Getting root is completely dependent on your setup. The following syntax would prevent root login: root-authentication { encrypted-password ****disabled****; ## SECRET-DATA This makes it impossible to login via the root account. If you absolutely ...


7

So it seems the way to go is to use a logical tunnel interface on MX. Just put one end of the lt Interface in the VPLS instance and the other end in the L2VPN instance: lt-1/2/0 { mtu 1514; unit 0 { encapsulation ethernet-ccc; peer-unit 1; family ccc; } unit 1 { encapsulation ...


Only top voted, non community-wiki answers of a minimum length are eligible