Hot answers tagged

8

There's no real difference between iBGP and eBGP here since you can specify a local-address for both. If you do not specify a local-address, the router will pick the address itself, typically the IP of the interface used to reach the peer. If you want to use a different address as a BGP source address, you can specify a local-address. In iBGP, this can be ...


6

There are two labels, so as traffic ingresses the PE from the CE there is a double push. Inner Label Every interface gets a label from that L2VPNs label block. The inner label is based on this interface specific label for the remote L2VPN site. L2VPN's use the same NLRI as VPLS in that they contain: Route Distinguisher Edge ID (Site ID) Label Block Offset ...


5

This is one of those things that is a grey area and a bit of a personal preference. Generally speaking, it is safe, yes. However this command performs the same validation function that request system software add /var/tmp/image.tgz performs. In the most general sense, the validation component initializes instances of the daemons from the new version of ...


5

In almost all situations, iBGP sessions should be between loopback addresses. To achieve this, you must configure a local-address. In almost all situations, eBGP sessions should be between interface addresses. This is the default.


5

There's a generic rename command in JunOS. So something like this should work: edit protocols bgp rename group ebgp-AS1009 to group ebgp-AS23100


4

It helps to look at a different kind of Junos interface configuration and compare. The reason for unit <n> is to allow multiple, logical subinterfaces (IFLs) to exist within a given physical interface (IFD.) (The definition of physical interface has blurred over time.) The reason for family <f> is to separate configuration statements related to ...


4

The problem is lack of accept-remote-nexthop configuration on the BGP neighbor. Junos is applying your ingress policy-statement, then doing a validation check. This probably isn't how it should work but it's a Juniper-ism. The documentation of this "feature" is bad but here's the link. If you prefer not to configure accept-remote-nexthop an ...


4

I strongly recommend you look at upgrading your IOS to something a lot more recent as IOS XE 3.16 is no longer in support for Security Vulnerabilities as of August 2016. For your reference, I have an ASR1001 (non X) running IOS XE 16.06.08 and as seen below, this appears to support a much larger BFD interval than 3.16. <redacted>#conf t Enter ...


4

The neighbor statement implies the remote PE (which should be reachable via MPLS), so in short, inet.3. I'm leaving the config out, but you'd see Remote PE in the output of show l2circuit connections as 192.168.2.2 in your case. jhead@PE1> show l2circuit connections Layer-2 Circuit Connections: <...snip...> Legend for interface status Up -- ...


4

When upgrading a fabric e.g. from SCB to SCBE, there is a process to train the fabric links so they operate at higher speed. The require upgrade/training alarm is documented in the related upgrade processes (juniper doc link). It's confusing this alarm is raised following installation of a new FPC. However, it's not anything to worry about. I suspect this ...


4

It's right there above the diagram: Device D and Device E are considered to be nonclients because they have explicitly configured peer relationships with each other. To make them RRroute reflector clients, remove the neighbor 192.168.5.5 statement from the configuration on Device D, and remove the neighbor 192.168.0.1 statement from the configuration on ...


4

First, I think it helps to set the baseline for the general process of how BGP routes are processed, this is true for all vendors. There are 3 main components: ADJ-RIB-IN: This is the table where all received routes from a specific neighbor are stored prior to policy processing and BGP path selection. LOCAL-RIB: AKA the global routing table. Routes stored ...


4

You have a few options. First, you can simply output everything to the terminal and copy/paste into a text file. For this, you would run: show configuration | no-more for stanza formatted configuration. This is usually easier to read given you can see the hierarchy. and/or show configuration | display set | no-more for "set" format, which may be ...


3

The link Teun provided is a good resource, but not everything is covered there. Here is the difference: esi - Ethernet Segment Identifier, used for EVPN multihoming. pfe - PFE internal interface. pfh - FPC internal interface. cbp - Customer Backbone Port, used for Provider Bridging. jsrv - Juniper Services Interface, used for things like 802.1X and Captive ...


3

The document you reference isn't entirely accurate (anymore). The limitation isn't for physical space, but for fabric bandwidth, the redundancy/subscription capacity for that bandwidth, temperature, and power. In short, you can physically populate 6 MPCs, just make sure you plan other aspects of the chassis like high capacity power supplies, fan trays, etc. ...


3

j-web is not available for the MX platform, as the page you refer to explicitly states: Supported Platforms SRX Series vSRX


3

Neither way policy based routing can applyed for both inbound and outbound traffic in cisco and juniper firewalls For outbound traffic When user want to access resources in internet and wants to use specific ISPs connectivity when two or more ISP or connected for firewall. This policy based routing will ensure traffic is diverted to selected ISP when ...


3

It looks like you're configuring EVPN Pure Type-5 routes (i.e. https://datatracker.ietf.org/doc/html/draft-ietf-bess-evpn-prefix-advertisement-11#section-4.4.1) with VXLAN transport, this is not supported on MX80/104 until 18.2R1 (see the related feature explorer entry). MPLS transport, however, is supported as of 17.1R1.


3

The Control Plane DDOS Protection feature is a sophisticated set of control-plane classifiers & policers. It's a great feature and you absolutely should be using it in addition to an ordinary control-plane filter for security. Traffic can be admitted (or not) on a per-IFL basis so malicious traffic from one interface (port/VLAN/subscriber) doesn't have ...


3

If you are only talking about traditional Virtual Chassis (VC) (ring topology) then yes you can mix dedicated VCP and uplink ports converted into VCP (10G/1G). Please refer to the EX4200 section of the documentation. If you are looking at using Virtual Chassis Fabric (VCF) (Clos topology), it should still work, but I didn't confirm this. You'd probably run ...


3

Solved! I checked the /var/log/httpd.log log and I found the required interface (not the one I thought to): httpd: 0: GET IFNAME WORKED st0.6 httpd: 0: GET ALLOWED FAILED st0.6 now I can reach the Web Gui. Thanks to all.


3

In edit mode you can use the load set <filename> statement for that. Alternatively, if you have a Juniper configuration file, you can import it using load merge <filename> or load replace <filename>, depending on if you want to update or replace the existing configuration.


3

The route you're testing against is not in the routing table. Here's an example using your exact policy: jhead@R1> show route 1.1.1.1/32 inet.0: 14 destinations, 14 routes (14 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 1.1.1.1/32 *[Local/0] 6d 20:17:36 Local via ge-0/0/0.0 jhead@R1> test ...


3

I'm not aware of an official way using the CLI/API, unless you want to populate a table of routing-engine part numbers and map those to CPU architecture. Another method likely to work is run uname -a and match on ppc or amd64: jsw@mx240> start shell % uname -a FreeBSD mx240 JNPR-11.0-20180730.2cd3a6e_buil FreeBSD JNPR-11.0-20180730....


2

EX4300s have four QSFP+ ports (rear panel) which may be used for stacking or as 40GbE. They also don't require an uplink module (EX-UM-xxx) and therefore have four SFP+ 1/10G ports (front panel) in the base model. The newer software on EX4300 makes one shocking choice you need to be aware of. STP may be disabled in a factory-default configuration. That ...


2

If you're looking at purchasing new hardware, EX4300s are generally recommended. It's not that there's anything wrong with the EX4200, it's simply that the EX4300 is the next generation with new features, longer term support, etc. Technically speaking, without getting into all of the finite variations on each model within both platforms, the main ...


2

It helps to explain the problems that targeted distribution is solving, so let's take a look at that. Basically, without targeted distribution, you have 2 ways to allocate shaping resources to a subscriber. For the sake of example, let's say you have a 4x1G LAG with a 100M subscriber connected. Split the 100M shaper over the 4 LAG members (25M each). ...


2

When we run the command 'show chassis hardware' , there is no such mentioning that its a NON-JNPR XFP. Based on this , can we say confidently that it must be XFP from Juniper side? The thing you're looking for isn't the absence of NON-JNPR necessarily, but the presence of a valid Part Number, i.e. 740-031832, which is valid. So, unless someone reprogrammed ...


2

There isn't a show command that shows this information. Invalidated sessions are sessions that are due for cleanup/deletion, holding them in memory so that they could be viewed may present other issues. The behavior can change slightly depending on some configuration settings (i.e. set security flow tcp-session rst-invalidate-session). If your issue is a ...


2

Whats the main reason behind using DDOS protection in addition to protect RE filter You already mentioned one of the key points regarding the lo0 filter and DDoS protection, that is that the lo0 filter is checked first. The goal of the lo0 filter is reject control plane traffic that you know isn't ever needed your device, but what about traffic that is ...


Only top voted, non community-wiki answers of a minimum length are eligible