/r/JNCIE
A place to talk about the JNCIE level certifications.
A place to talk about the JNCIE level certifications.
/r/JNCIE
340 Subscribers
JNCIE-Ent Study Guide?
Anyone up for working together to create a thorough solutions guide based on the JNCIE-ENT Self-Study Bundle?
22:25 UTC
How to apply tracking condition to static route definition EX switch
Hi guys,
I have an EX4600 and I would need to apply a tracking condition to some static routes configured on it, based on the status of 1 EX physical interface, like another manufacturers can do...
Do you know if is this possible with an EX? I am looking in the command guide but I cannot see similar function
Kind Regards
Juan
14:27 UTC
Anyone going for JNCIE-Sp ?
18:33 UTC
JNCIE-SP Prep
starting my JNCIE-SP prep. what resources do you recommend? is the all access pass workbook good enough? The self-study guide.
any good resources or medium reads will be helpful.
23:40 UTC
juniper self study guide worth it
Hi,
I have just passed my JNCIP-SP and want to make a start towards the LAB. I have been looking for materials, Juniper's self study guide is obviously the first thing that comes up. $600 seems pretty steep if it just basically a book. or is the mock exams that come with it that make it worth it?
I guess what I am asking whats in it? :-)
PS. i mean worth it if you decide that you want to do the exam, I have already decided on that, as I have been working in ISP networking for a long time and just want to get this accreditation for my own satisfaction
16:04 UTC
Lecture 3 RELEASED!! - Programming Fundamentals & Practice Problems
Lecture 3: https://youtu.be/RlvbqZbTYj0
Register Here: http://sudoupgrade.com/PythonForNetworkEngineers/registration.html
FREE OpenStack lab access: sudoupgrade.com/openstack
06:03 UTC
FREE Network Management & Automation Software Development with Python for Network and Systems Engineers!!
Register here to download LAB files for FREE: http://sudoupgrade.com/PythonForNetworkEngineers/registration.html
First Lecture Released for Python for Network & System Engineers:
Video posted on YouTube: https://youtu.be/mk7qVdu5udQ
Happy Learning!!
06:24 UTC
JNCIE-SP/VPNs/Layer 3 VPNs/6PE
My vMX version: 17.4R1.16
Greetings, I have configured the example above exactly as given, except I used ge interfaces specific to my home lab. I am unable to ping CE2 @ ::192.0.1.5 from CE1 ::192.0.1.1. Can somebody please answer the following questions?
- Is there an error in the example where I would not be able to ping without corrective configuration?
- Is this example useful as prep for the 6PE topic on the JNICE-SP exam?
- What show commands on what devices would be best for me to post in order to troubleshoot this issue?
Thanks.
20:39 UTC
Anyone Currently Studying for the IE-ENT?
Wanted to see if anyone had any good study tips! I've been using EVE-NG to build labs and it's really helpful.
19:26 UTC
JNCIE-ENT- What's going on with it? Is it getting updated?
Anyone know what's going on with JNCIE-ENT? The existing lab JPR-943 is on Junos 11.4. Is this going to be updated soon?
22:53 UTC
New badge for multiple JNCIE certifications
04:56 UTC
Don't Label Me Bro - Juniper Edition
My MPLS post the other week was pretty well received so I figured might as well show the other side of the coin and do it again with Juniper boxes.
#Topology
Today's Topology is similar to last time but Juniperified, we have:
- 4 x PE routers that are vMX
- 4 x P are vSRX
- 4 x CE routers are VSRX boxes as well.
There are again two customers, CUST-A and CUST-B because originality is hard.
To save on some config space I'll just focus on a single router at a time unless there is differences that are worth seeing.
#Provider Routers
###Disable Flow Mode
I'm using SRX routers for my core so we need to disable the default flow based mode and reboot the boxes before we can use them with MPLS.
root@P01# set security forwarding-options family inet6 mode packet-based
[edit]
root@P01# set security forwarding-options family mpls mode packet-based
[edit]
root@P01# set security forwarding-options family iso mode packet-based
root@P01# commit
commit complete
[edit]
root@P01# run request system reboot
Reboot the system ? [yes,no] (no) yesOnce this is done we will no longer need to use security zones for everything.
###Basic Setup
To keep things clean I'm using a virtual-router instance to move the first interface into another routing table for management.
set routing-instances MGMT instance-type virtual-router
set routing-instances MGMT interface ge-0/0/0.0
set routing-instances MGMT routing-options static route 0.0.0.0/0 next-hop 10.20.2.1
set interfaces ge-0/0/0 unit 0 family inet address 10.20.2.211/24Most of my interfaces are connecting to trunk ports to make life easier so I'm going to enable vlan tagging and use subinterfaces to connect to everything.
set interfaces ge-0/0/1 vlan-tagging
set interfaces ge-0/0/1 unit 3011 vlan-id 3011
set interfaces ge-0/0/1 unit 3011 family inet address 10.1.11.1/24
set interfaces ge-0/0/1 unit 3012 vlan-id 3012
set interfaces ge-0/0/1 unit 3012 family inet address 10.1.2.1/24
set interfaces ge-0/0/1 unit 3013 vlan-id 3013
set interfaces ge-0/0/1 unit 3013 family inet address 10.1.3.1/24
set interfaces ge-0/0/1 unit 3014 vlan-id 3014
set interfaces ge-0/0/1 unit 3014 family inet address 10.1.4.1/24
set interfaces lo0 unit 0 family inet address 192.168.255.1/32Then I'll just turn on OSPF on all active interfaces in the routing instance.
root@P01# set protocols ospf area 0.0.0.0 interface all Once we are done we should see a neighbor with every other P router and a PE router (once we get that far)
root@P01# run show ospf neighbor
Address Interface State ID Pri Dead
10.1.11.254 ge-0/0/1.3011 Full 192.168.255.11 128 39
10.1.2.2 ge-0/0/1.3012 Full 192.168.255.2 128 32
10.1.3.3 ge-0/0/1.3013 Full 192.168.255.3 128 39
10.1.4.4 ge-0/0/1.3014 Full 192.168.255.4 128 34###Enabling MPLS
While Cisco put effort into making sure MPLS is turned on right away, Juniper takes a bit more effort.
First we need to enable MPLS and LDP in the control plane under protocols, we can conveniently use the interface all keyword to enable it on all interfaces.
root@P01# set protocols mpls interface all
root@P01# set protocols ldp interface all Next we need to turn it on for the forwarding plane by adding the mpls family to each interface on the router that will be in the MPLS path. This can be a bit annoying so you might want to look into things like config groups to ease the admin burden.
set interfaces ge-0/0/1 unit 3011 family mpls
set interfaces ge-0/0/1 unit 3012 family mpls
set interfaces ge-0/0/1 unit 3013 family mpls
set interfaces ge-0/0/1 unit 3014 family mpls
set interfaces lo0 unit 0 family mpls#Route Reflector
We'll use a route reflector again but this time I'm just take advantage of the logical-system feature to carve PE01 and PE02 into two new Route Reflector boxes.
###RR01
First we'll turn on vlan-tagging for the interface I want to use since we still need to configure physical stuff at the interface level in logical-systems.
root@PE11# set interfaces ge-0/0/2 vlan-tagging Next we configure the interfaces like above under the logical-system.
root@PE11# set logical-systems RR01 interfaces ge-0/0/2 unit 3123 vlan-id 3123
root@PE11# set logical-systems RR01 interfaces ge-0/0/2 unit 3123 family inet address 10.0.123.254/24
root@PE11# set logical-systems RR01 interfaces ge-0/0/2 unit 3123 family mpls
root@PE11# set logical-systems RR01 interfaces lo0 unit 1 family inet address 192.168.255.154/32
root@PE11# set logical-systems RR01 protocols ospf area 0.0.0.0 interface all
root@PE11# set logical-systems RR01 protocols mpls interface all
root@PE11# set logical-systems RR01 protocols ldp interface all BGP is configured with the inet-vpn family which is the same as Cisco's VPNv4 family, the route reflector will have all for PEs as a peer, will use 65123 as the AS for iBGP and will set a cluster-id so Juniper knows it is a Route Reflector.
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL type internal
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL local-address 192.168.255.154
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL family inet-vpn unicast
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL cluster 192.168.255.254
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.11
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.22
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.33
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.44
root@PE11# set logical-systems RR01 routing-options autonomous-system 65123 ###RR02
root@PE22# set logical-systems RR02 interfaces ge-0/0/2 unit 3123 vlan-id 3123
root@PE22# set logical-systems RR02 interfaces ge-0/0/2 unit 3123 family inet address 10.1.123.254/24
root@PE22# set logical-systems RR02 interfaces ge-0/0/2 unit 3123 family mpls
root@PE22# set logical-systems RR02 interfaces lo0 unit 1 family inet address 192.168.255.254/32
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL type internal
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL local-address 192.168.255.254
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL family inet-vpn unicast
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL cluster 192.168.255.254
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.11
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.22
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.33
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.44
root@PE22# set logical-systems RR02 protocols ospf area 0.0.0.0 interface all
root@PE22# set logical-systems RR02 protocols mpls interface all
root@PE22# set logical-systems RR02 protocols ldp interface all
root@PE22# set logical-systems RR02 routing-options autonomous-system 65123 #Provider Edge
The PE will be similar to the Route-Reflector minus the logical system stuff, we'll setup the interfaces enable OSPF and MPLS, then peer with each of the RRs.
root@PE11# set routing-instances MGMT instance-type virtual-router
root@PE11# set routing-instances MGMT interface ge-0/0/0.0
root@PE11# set routing-instances MGMT routing-options static route 0.0.0.0/0 next-hop 10.20.2.1
root@PE11# set interfaces ge-0/0/0 unit 0 family inet address 10.20.2.201/24
root@PE11# set interfaces ge-0/0/1 vlan-tagging
root@PE11# set interfaces ge-0/0/1 unit 3011 vlan-id 3011
root@PE11# set interfaces ge-0/0/1 unit 3011 family inet address 10.1.11.254/24
root@PE11# set interfaces ge-0/0/1 unit 3011 family mpls
root@PE11# set interfaces ge-0/0/1 unit 3123 vlan-id 3123
root@PE11# set interfaces ge-0/0/1 unit 3123 family inet address 10.0.123.11/24
root@PE11# set interfaces ge-0/0/1 unit 3123 family mpls
root@PE11# set interfaces ge-0/0/2 vlan-tagging
root@PE11# set interfaces ge-0/0/5 unit 0 family inet address 192.168.1.254/24
root@PE11# set interfaces lo0 unit 0 family inet address 192.168.255.11/32
root@PE11# set interfaces lo0 unit 0 family inet6 address 2001:1234::1/128
root@PE11# set interfaces lo0 unit 0 family mpls
root@PE11# set routing-options autonomous-system 65123
root@PE11# set protocols bgp group RR type internal
root@PE11# set protocols bgp group RR local-address 192.168.255.11
root@PE11# set protocols bgp group RR family inet-vpn unicast
root@PE11# set protocols bgp group RR neighbor 192.168.255.154
root@PE11# set protocols bgp group RR neighbor 192.168.255.254 #VRF / Policies
Now our BGP is up it is time to create the last piece of the L3VPN and which is making the policies as well as the VRF the CE goes into.
###Policies
In Cisco land we controlled what route we imported and exported under the VRF configuration, Juniper does that too but for more granular control we will make a more elaborate policy.
First we make an community policy that just exports the PE's RD on each router.
root@PE11# set policy-options community RT-EXPORT-CE01 members target:65123:101 Next we'll do the same for the import community where we will make one for each CE for flexibility's sake.
root@PE11# set policy-options community RT-IMPORT-CE01 members target:65123:101
root@PE11# set policy-options community RT-IMPORT-CE02 members target:65123:102
root@PE11# set policy-options community RT-IMPORT-CE03 members target:65123:103
root@PE11# set policy-options community RT-IMPORT-CE04 members target:65123:104With that in place we make a policy that will become our VRF-Export policy, we will say that if the protocol is directly connected or one of the routing protocols then we will add the export community and accept the route.
root@PE11# set policy-options policy-statement EXPORT-CE01 term EXPORT from protocol [ direct bgp rip ospf ]
root@PE11# set policy-options policy-statement EXPORT-CE01 term EXPORT then community add RT-EXPORT-CE01
root@PE11# set policy-options policy-statement EXPORT-CE01 term EXPORT then accept If it doesn't match that criteria then we will reject it.
root@PE11# set policy-options policy-statement EXPORT-CE01 term REJECT then reject The VRF-Import policy will always be from MBGP so we match on protocol BGP, then we select what communities we want to talk to each other.
In our topology Cust-A is CE01 and CE02 so we'll do that then reject the rest.
root@PE11# set policy-options policy-statement IMPORT-CE01 term IMPORT from protocol bgp
root@PE11# set policy-options policy-statement IMPORT-CE01 term IMPORT from community [ RT-IMPORT-CE01 RT-IMPORT-CE02 ]
root@PE11# set policy-options policy-statement IMPORT-CE01 term IMPORT then accept
root@PE11# set policy-options policy-statement IMPORT-CE01 term REJECT then reject###VRFs
With all that in place we need to make a VRF instance. In my case I'm using ge-0/0/5 on all the PEs as the CE interface so we add it to the VRF, we also set the PE's proper RD and apply the VRF policies we just made. We also use vrf-table-label to help make the L3VPN happy.
root@PE11# set routing-instances CE01 instance-type vrf
root@PE11# set routing-instances CE01 interface ge-0/0/5.0
root@PE11# set routing-instances CE01 route-distinguisher 65123:101
root@PE11# set routing-instances CE01 vrf-import IMPORT-CE01
root@PE11# set routing-instances CE01 vrf-export EXPORT-CE01
root@PE11# set routing-instances CE01 vrf-table-label We'll also set the router-id for the instance just to have a bit more control
root@PE11# set routing-instances CE01 routing-options router-id 192.168.255.11 #Customer Edge
###PE01
Finally we will start working on the CE routing!
We need an export policy so Juniper knows what to send so I'll make a simple one that just accepts any route, since PE01 is BGP we'll setup that too. The config is the same as you have seen though you may want to use the as-override option if you are using BGP.
root@PE11# set policy-options policy-statement EXPORT-BGP then accept
root@PE11# set routing-instances CE01 protocols bgp group CUST-A type external
root@PE11# set routing-instances CE01 protocols bgp group CUST-A export EXPORT-BGP
root@PE11# set routing-instances CE01 protocols bgp group CUST-A peer-as 65101
root@PE11# set routing-instances CE01 protocols bgp group CUST-A neighbor 192.168.1.1 as-override
root@PE11# set policy-options policy-statement EXPORT-BGP then accept
root@PE11# set policy-options policy-statement EXPORT-OSPF from protocol bgp
root@PE11# set policy-options policy-statement EXPORT-OSPF then accept
root@PE11# set policy-options policy-statement EXPORT-RIP then metric 5
root@PE11# set policy-options policy-statement EXPORT-RIP then accept ###CE01, CE02, CE03, CE04
Since the CE's are still in flow mode, we need to make sure the interfaces we use are trusted by the security zone, we could get more specific but we aren't really playing with the firewall today :)
root@CE01# set security zones security-zone trust host-inbound-traffic system-services all
root@CE01# set security zones security-zone trust host-inbound-traffic protocols all
root@CE01# set security zones security-zone trust interfaces ge-0/0/1.0
root@CE01# set security zones security-zone trust interfaces ge-0/0/2.0 ###CE01
For BGP we just do a normal peering and advertise everything directly connected.
root@CE01# set policy-options policy-statement EXPORT-BGP from protocol direct
root@CE01# set policy-options policy-statement EXPORT-BGP then accept
root@CE01# set protocols bgp group CUST-A type external
root@CE01# set protocols bgp group CUST-A export EXPORT-BGP
root@CE01# set protocols bgp group CUST-A peer-as 65123
root@CE01# set protocols bgp group CUST-A neighbor 192.168.1.254 ###CE02
Same with RIP for CE02
root@CE02# set policy-options policy-statement EXPORT-RIP from protocol direct
root@CE02# set policy-options policy-statement EXPORT-RIP then accept
root@CE02# set protocols rip group CUST-A export EXPORT-RIP
root@CE02# set protocols rip group CUST-A neighbor ge-0/0/1.0 ###CE03 and CE04
The OSPF CE is a bit unique because it is the only protocol we are looking at today that cares about external routes. Let's setup OSPF in two ways, one will simply add all interfaces to OSPF and the other will use the export method we have been doing
root@CE03# set protocols ospf area 0.0.0.0 interface all
root@CE03# set protocols ospf area 0.0.0.0 interface lo0.0 passive
root@CE04# set policy-options policy-statement EXPORT-OSPF from protocol direct
root@CE04# set policy-options policy-statement EXPORT-OSPF then accept
root@CE04# set protocols ospf export EXPORT-OSPF
root@CE04# set protocols ospf area 0.0.0.0 interface ge-0/0/1.0 Now we get the routes but routes from CE04 are external! We might talk about OSPF specific MPLS topics another day!
root@CE03# run show ospf route
Topology default Route Table:
Prefix Path Route NH Metric NextHop Nexthop
Type Type Type Interface Address/LSP
192.168.3.254 Intra Area/AS BR IP 1 ge-0/0/1.0 192.168.3.254
172.16.31.0/24 Intra Network IP 1 ge-0/0/2.0
172.16.32.0/24 Intra Network IP 1 ge-0/0/2.0
172.16.33.0/24 Intra Network IP 1 ge-0/0/2.0
172.16.34.0/24 Intra Network IP 1 ge-0/0/2.0
172.16.41.0/24 Ext2 Network IP 0 ge-0/0/1.0 192.168.3.254
172.16.42.0/24 Ext2 Network IP 0 ge-0/0/1.0 192.168.3.254
172.16.43.0/24 Ext2 Network IP 0 ge-0/0/1.0 192.168.3.254
172.16.44.0/24 Ext2 Network IP 0 ge-0/0/1.0 192.168.3.254
192.168.3.0/24 Intra Network IP 1 ge-0/0/1.0
192.168.4.0/24 Ext2 Network IP 0 ge-0/0/1.0 192.168.3.254#Verification
Now that everything is up we can make sure that BGP is working properly (probably should have done that sooner!)
root@PE11# run show bgp summary
Groups: 2 Peers: 3 Down peers: 0
Table Tot Paths Act Paths Suppressed History Damp State Pending
bgp.l3vpn.0
12 6 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.168.1.1 65101 1803 1794 0 3 13:27:34 Establ
CE01.inet.0: 5/6/6/0
192.168.255.154 65123 1594 1582 0 1 11:54:35 Establ
bgp.l3vpn.0: 6/6/6/0
CE01.inet.0: 6/6/6/0
192.168.255.254 65123 1591 1581 0 1 11:54:41 Establ
bgp.l3vpn.0: 0/6/6/0
CE01.inet.0: 0/6/6/0We can also see the MPLS interfaces on the router
root@PE11# run show mpls interface
Interface State Administrative groups (x: extended)
ge-0/0/1.3011 Up <none>
ge-0/0/1.3123 Up <none>
[edit]As well as the LDP neighbors
root@PE11# run show ldp neighbor
Address Interface Label space ID Hold time
10.1.11.1 ge-0/0/1.3011 192.168.255.1:0 14
10.0.123.33 ge-0/0/1.3123 192.168.255.33:0 13
10.0.123.44 ge-0/0/1.3123 192.168.255.44:0 13
10.0.123.254 ge-0/0/1.3123 192.168.255.154:0 11###PE01 Routing Table
Juniper groups everything into the routing table so we can see the main routing table, the MPLS labels, the VRF routes, and IPv6 routes all in one place! We can also see the INET-VPN routes so we can see if things are being learned properly.
root@PE11# run show route
inet.0: 26 destinations, 26 routes (26 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
10.0.123.0/24 *[Direct/0] 12:09:45
> via ge-0/0/1.3123
10.0.123.11/32 *[Local/0] 12:09:45
Local via ge-0/0/1.3123
10.1.2.0/24 *[OSPF/10] 14:45:03, metric 2
> to 10.1.11.1 via ge-0/0/1.3011
10.1.3.0/24 *[OSPF/10] 14:45:03, metric 2
> to 10.1.11.1 via ge-0/0/1.3011
10.1.4.0/24 *[OSPF/10] 14:45:03, metric 2
> to 10.1.11.1 via ge-0/0/1.3011
10.1.11.0/24 *[Direct/0] 14:45:09
> via ge-0/0/1.3011
10.1.11.254/32 *[Local/0] 14:45:09
Local via ge-0/0/1.3011
10.1.123.0/24 *[OSPF/10] 11:41:39, metric 2
> to 10.0.123.33 via ge-0/0/1.3123
to 10.0.123.44 via ge-0/0/1.3123
10.2.3.0/24 *[OSPF/10] 11:42:39, metric 3
to 10.1.11.1 via ge-0/0/1.3011
> to 10.0.123.33 via ge-0/0/1.3123
10.2.4.0/24 *[OSPF/10] 11:41:48, metric 3
to 10.1.11.1 via ge-0/0/1.3011
> to 10.0.123.44 via ge-0/0/1.3123
10.2.22.0/24 *[OSPF/10] 11:41:39, metric 3
to 10.1.11.1 via ge-0/0/1.3011
to 10.0.123.33 via ge-0/0/1.3123
> to 10.0.123.44 via ge-0/0/1.3123
10.3.4.0/24 *[OSPF/10] 11:41:48, metric 3
to 10.1.11.1 via ge-0/0/1.3011
to 10.0.123.33 via ge-0/0/1.3123
> to 10.0.123.44 via ge-0/0/1.3123
10.3.33.0/24 *[OSPF/10] 11:42:39, metric 2
> to 10.0.123.33 via ge-0/0/1.3123
10.4.44.0/24 *[OSPF/10] 11:41:48, metric 2
> to 10.0.123.44 via ge-0/0/1.3123
192.168.255.1/32 *[OSPF/10] 14:45:03, metric 1
> to 10.1.11.1 via ge-0/0/1.3011
192.168.255.2/32 *[OSPF/10] 12:00:32, metric 2
> to 10.1.11.1 via ge-0/0/1.3011
192.168.255.3/32 *[OSPF/10] 11:42:39, metric 2
> to 10.1.11.1 via ge-0/0/1.3011
to 10.0.123.33 via ge-0/0/1.3123
192.168.255.4/32 *[OSPF/10] 11:41:48, metric 2
> to 10.1.11.1 via ge-0/0/1.3011
to 10.0.123.44 via ge-0/0/1.3123
192.168.255.11/32 *[Direct/0] 14:52:17
> via lo0.0
192.168.255.22/32 *[OSPF/10] 11:41:39, metric 2
> to 10.0.123.33 via ge-0/0/1.3123
to 10.0.123.44 via ge-0/0/1.3123
192.168.255.33/32 *[OSPF/10] 11:42:39, metric 1
> to 10.0.123.33 via ge-0/0/1.3123
192.168.255.44/32 *[OSPF/10] 11:41:48, metric 1
> to 10.0.123.44 via ge-0/0/1.3123
192.168.255.154/32 *[OSPF/10] 12:07:04, metric 1
> to 10.0.123.254 via ge-0/0/1.3123
192.168.255.254/32 *[OSPF/10] 11:41:39, metric 2
to 10.0.123.33 via ge-0/0/1.3123
> to 10.0.123.44 via ge-0/0/1.3123
224.0.0.2/32 *[LDP/9] 14:52:17, metric 1
MultiRecv
224.0.0.5/32 *[OSPF/10] 14:52:17, metric 1
MultiRecv
inet.3: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.255.1/32 *[LDP/9] 14:45:03, metric 1
> to 10.1.11.1 via ge-0/0/1.3011
192.168.255.2/32 *[LDP/9] 12:00:32, metric 1
> to 10.1.11.1 via ge-0/0/1.3011, Push 299840
192.168.255.3/32 *[LDP/9] 11:42:38, metric 1
> to 10.1.11.1 via ge-0/0/1.3011, Push 299808
to 10.0.123.33 via ge-0/0/1.3123, Push 299776
192.168.255.4/32 *[LDP/9] 11:41:47, metric 1
> to 10.1.11.1 via ge-0/0/1.3011, Push 299792
to 10.0.123.44 via ge-0/0/1.3123, Push 299776
192.168.255.22/32 *[LDP/9] 11:37:45, metric 1
> to 10.0.123.33 via ge-0/0/1.3123, Push 299952
to 10.0.123.44 via ge-0/0/1.3123, Push 299952
192.168.255.33/32 *[LDP/9] 11:42:38, metric 1
> to 10.0.123.33 via ge-0/0/1.3123
192.168.255.44/32 *[LDP/9] 11:41:47, metric 1
> to 10.0.123.44 via ge-0/0/1.3123
192.168.255.154/32 *[LDP/9] 11:44:55, metric 1
> to 10.0.123.254 via ge-0/0/1.3123
192.168.255.254/32 *[LDP/9] 11:37:45, metric 1
to 10.0.123.33 via ge-0/0/1.3123, Push 299936
> to 10.0.123.44 via ge-0/0/1.3123, Push 299936
CE01.inet.0: 13 destinations, 20 routes (13 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.11.0/24 *[BGP/170] 13:28:31, localpref 100
AS path: 65101 I, validation-state: unverified
> to 192.168.1.1 via ge-0/0/5.0
172.16.12.0/24 *[BGP/170] 13:28:31, localpref 100
AS path: 65101 I, validation-state: unverified
> to 192.168.1.1 via ge-0/0/5.0
172.16.13.0/24 *[BGP/170] 13:28:31, localpref 100
AS path: 65101 I, validation-state: unverified
> to 192.168.1.1 via ge-0/0/5.0
172.16.14.0/24 *[BGP/170] 13:28:31, localpref 100
AS path: 65101 I, validation-state: unverified
> to 192.168.1.1 via ge-0/0/5.0
172.16.21.0/24 *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
172.16.22.0/24 *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
172.16.23.0/24 *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
172.16.24.0/24 *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
192.168.1.0/24 *[Direct/0] 14:45:09
> via ge-0/0/5.0
[BGP/170] 13:28:31, localpref 100
AS path: 65101 I, validation-state: unverified
> to 192.168.1.1 via ge-0/0/5.0
192.168.1.254/32 *[Local/0] 14:45:09
Local via ge-0/0/5.0
192.168.2.0/24 *[BGP/170] 00:33:22, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:33:22, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
192.168.254.1/32 *[BGP/170] 13:28:31, localpref 100
AS path: 65101 I, validation-state: unverified
> to 192.168.1.1 via ge-0/0/5.0
192.168.254.2/32 *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
MGMT.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 *[Static/5] 14:45:09
> to 10.20.2.1 via ge-0/0/0.0
10.20.2.0/24 *[Direct/0] 14:45:09
> via ge-0/0/0.0
10.20.2.201/32 *[Local/0] 14:45:09
Local via ge-0/0/0.0
mpls.0: 20 destinations, 20 routes (20 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0 *[MPLS/0] 14:52:17, metric 1
to table inet.0
0(S=0) *[MPLS/0] 14:52:17, metric 1
to table mpls.0
1 *[MPLS/0] 14:52:17, metric 1
Receive
2 *[MPLS/0] 14:52:17, metric 1
to table inet6.0
2(S=0) *[MPLS/0] 14:52:17, metric 1
to table mpls.0
13 *[MPLS/0] 14:52:17, metric 1
Receive
16 *[VPN/0] 14:52:17
> via lsi.0 (CE01), Pop
299776 *[LDP/9] 14:45:03, metric 1
> to 10.1.11.1 via ge-0/0/1.3011, Pop
299776(S=0) *[LDP/9] 14:45:03, metric 1
> to 10.1.11.1 via ge-0/0/1.3011, Pop
299792 *[LDP/9] 11:41:47, metric 1
to 10.1.11.1 via ge-0/0/1.3011, Swap 299792
> to 10.0.123.44 via ge-0/0/1.3123, Swap 299776
299808 *[LDP/9] 11:42:38, metric 1
to 10.1.11.1 via ge-0/0/1.3011, Swap 299808
> to 10.0.123.33 via ge-0/0/1.3123, Swap 299776
299824 *[LDP/9] 12:00:32, metric 1
> to 10.1.11.1 via ge-0/0/1.3011, Swap 299840
299856 *[LDP/9] 11:42:38, metric 1
> to 10.0.123.33 via ge-0/0/1.3123, Pop
299856(S=0) *[LDP/9] 11:42:38, metric 1
> to 10.0.123.33 via ge-0/0/1.3123, Pop
299872 *[LDP/9] 11:41:47, metric 1
> to 10.0.123.44 via ge-0/0/1.3123, Pop
299872(S=0) *[LDP/9] 11:41:47, metric 1
> to 10.0.123.44 via ge-0/0/1.3123, Pop
299904 *[LDP/9] 11:44:55, metric 1
> to 10.0.123.254 via ge-0/0/1.3123, Pop
299904(S=0) *[LDP/9] 11:44:55, metric 1
> to 10.0.123.254 via ge-0/0/1.3123, Pop
299936 *[LDP/9] 11:37:45, metric 1
> to 10.0.123.33 via ge-0/0/1.3123, Swap 299936
to 10.0.123.44 via ge-0/0/1.3123, Swap 299936
299952 *[LDP/9] 11:37:45, metric 1
> to 10.0.123.33 via ge-0/0/1.3123, Swap 299952
to 10.0.123.44 via ge-0/0/1.3123, Swap 299952
bgp.l3vpn.0: 6 destinations, 12 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
65123:102:172.16.21.0/24
*[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:172.16.22.0/24
*[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:172.16.23.0/24
*[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:172.16.24.0/24
*[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:192.168.2.0/24
*[BGP/170] 00:33:22, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:33:22, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
> to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:192.168.254.2/32
*[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
AS path: I, validation-state: unverified
to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
> to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
inet6.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2001:1234::1/128 *[Direct/0] 14:52:17
> via lo0.0
fe80::250:560f:fc9e:4cd1/128
*[Direct/0] 14:52:17
> via lo0.0
ff02::2/128 *[INET6/0] 14:52:17
MultiRecv#Pastebins
Here are the configs in pastebins for a bit more convenient looking at.
18:57 UTC
JNCIE Study
So, since we need to kick this subreddit to life again - who here is preparing for any JNCIE lab or even the JNCIP written exams?
There are few JNCIEs here that are very willing to help in any way we can.
Just trying to spread the Junos love.
15:35 UTC
JNCIE-SEC blueprint question
Starting to give it some more thought in persuing JNCIE-SEC, one thing I saw on the blueprint is BGP, OSPF and some other routing stuff. My question is do I need to learn this at a JNCIE level or is JNCIS/JNCIP level fine? I've done all the formal training for SRX but never came across any routing modules.
11:48 UTC
Aggregate
set (fastether-options | gigether-options) 802.3ad aex
set aggregated-devices ethernet device-count number
LACP link protection enables you to force active and standby links within an aggregated Ethernet.
interfaces interface-name aggregated-ether-options minimum-links number
set interfaces interface-name aggregated-ether-options lacp active
set interfaces interface-name aggregated-ether-options lacp periodic
set interfaces aeX aggregated-ether-options lacp system-priority
interfaces aex aggregated-ether-options load-balance adaptive
set forwarding-options hash-key faimly multisrvice source-mac destination-mac
02:54 UTC
BFD
OSPF
set protocols ospf area 0.0.0.0 interface fe-0/0/1 bfd-liveness-detection minimum-interval 300
set protocols ospf area 0.0.0.0 interface fe-0/0/1 bfd-liveness-detection multiplier 4
set protocols ospf area 0.0.0.0 interface fe-0/0/1 bfd-liveness-detection full-neighbors-only
BGP
set logical-systems B protocols bgp group internal-peers bfd-liveness-detection minimum-interval 1000
ISIS
set protocols isis interface so-0/0/0 bfd-liveness-detection detection-time threshold 5
set protocols isis interface so-0/0/0 bfd-liveness-detection minimum-interval 2
set protocols isis interface so-0/0/0 bfd-liveness-detection minimum-receive-interval 1
set protocols isis interface so-0/0/0 bfd-liveness-detection no-adaptation
set protocols isis interface so-0/0/0 bfd-liveness-detection transmit-interval threshold 3
set protocols isis interface so-0/0/0 bfd-liveness-detection transmit-interval minimum-interval 1
set protocols isis interface so-0/0/0 bfd-liveness-detection multiplier 2
set protocols isis interface so-0/0/0 bfd-liveness-detection version automatic
00:15 UTC
HA
Routing Engine Redundancy:
set chassis redundancy failover on-disk-failure
set chassis redundancy failover on-loss-of-keepalives
To change the keepalive time period:
Set chassis redundancy keepalive-time
For a process failire failover:
set system processes process-name failover other-routing-engine
set system processes routing failover other-routing-engine
GRES:
Set chassis redundancy graceful-switchover
Set system commit synchronize
show system switchover
Nonstop bridging
set protocols layer2-control nonstop-bridging
Nonstop Routing
set routing-options nonstop-routing
Nonstop routing and graceful restart can not be configured at the same time.
Graceful Restart:
Gaceful restart is disabled by default.
set routing-options hierarchy graceful-restart
configure the duration of the graceful restart period:
set routing-options graceful-restart restart-duration
Helper mode is enabled by default. You can disable helper mode on a per-protocol basis.
set the length of time the router waits to receive messages from restarting neighbors:
set protocols bgp graceful-restart stale-routes-time
Restrict OSPF link-state advertisement (LSA) checking:
set protocols ospf graceful-restart no-strict-lsa-checking
To configure the delay between when the router discovers that a neighboring router has gone down:
set protocols rsvp graceful-restart maximum-helper-restart-time
For Layer 3 VPNs only, you must also configure graceful restart for all routing and MPLS:
set routing-instances instance-name routing-options graceful-restart
VRRP
To configure the startup period for VRRP operations, include the startup-silent-period
statement at the [edit protocols vrrp] hierarchy level:
To configure basic VRRP for IPv6 support, configure VRRP group support on interfaces
by including the vrrp-inet6-group statement:
vrrp-inet6-group group-id {
priority number;
virtual-inet6-address [ addresses ];
virtual-link-local-address ipv6-address;
}
authentication can be simple or md5.
To modify the time, in seconds, between the sending of VRRP advertisement packets,
include the advertise-interval statement
Passive ARP learning enables the ARP cache in the backup router to hold approximately
the same contents as the ARP cache in the master router, thus preventing the problem
of learning ARP entries in a burst. To enable passive ARP learning, include the
passive-learning statement at the [edit system arp] hierarchy level
23:53 UTC
OAM theory and config
Fault detection and notification (provided by continuity check messages)
The target MAC address is learned by the
continuity check protocol or linktrace protocol
Each maintenance domain is associated with a maintenance domain level from 0 through 7.
where outermost domains are assigned a higher level than the innermost domains.
maintenance domain, each service instance is called a maintenance association.
A maintenance association ca nbe thought as a full mesh o fmaintenance endpoints (MEPs)
(MIPsonly respondto CFM messages
The continuity check protocol packets use the ethertype value 0x8902 and the multicast destination MAC address 01:80:c2:00:00:32.
show oam ethernet connectivity-fault-management
For AE interface
protocols {
oam {
ethernet {
link-fault-management {
interface ae0;
}
}
}
}
CCM handled by PPM/
[edit protocols oam]
ethernet {
connectivity-fault-management {
maintenance-domain customer {
level 7;
maintenance-association customer-site1 {
continuity-check {
interval 1s;
}
mep 800 {
interface ge-5/2/3.0;
direction down;
auto-discovery;
}
}
}
}
}
up—An UP MEP CCM is transmitted out of every logical interface which is part of the same bridging or vpls instance except for the interface configured on this MEP.
down—Down MEP CCMs are transmitted only out the interface configured on this MEP.
21:59 UTC
ISIS Review
Hello PDU
PSNP ack lsps and request missing LSP
CSNP send periodically
TLV inside PDU
DIS is highes mac, no backup DIS. Defaulty priority 64.
Default isis metric is 10.
Level 1 summarized and sent to level 2.
Level 1 routers use attached bit to get out of level 1.
ignore-attached-bit
wide-metric-onlu leaks l2 routes in to l1.
From level 2 to level 1 policy.
Level 1 external routes blocked from going to level 2
up/down bit to prevent loops.
lsp=lifetime
isis sfp-options
level authentication affects all PDUs
link authentication affects hello only
no-authentication-check
protocols isis interface xxx mesh-group 1
protocols isis interface xxx mesh-group to stop flooding of LSPs.
protocols isis csnp-interfal default 10
import policy not allowed.
prefix-export-limit.
14:19 UTC
Multicast Configuration
PIM-SM
Enable tunneling:
set chassis fpc 0 pic 0 tunnel-services bandwidth 1g # Or 10g.
Minimum setup:
set protocols pim interface all mode sparse
set protocols pim interface fxp0.0 disable
set protocols pim interface ge-0/0/0.0 neighbor-policy Allow-PIM-Neighbors
set policy-options policy-statement Allow-PIM-Neighbors term 10 from route-filter 10.0.20.0/24 orlonger
set policy-options policy-statement Allow-PIM-Neighbors term 10 then accept
set policy-options policy-statement Allow-PIM-Neighbors term 20 then reject
Static RP:
set protocols pim rp local address 30.0.10.1 # If this is the RP.
OR
set protocols pim rp static address 30.0.10.1 # If RP is remote.
Auto RP:
set protocols pim interface all mode sparse-dense
set protocols pim dense-groups 224.0.1.39/32
set protocols pim dense-groups 224.0.1.40/32
For the mapping agent and RP:
set protocols pim rp local address 30.0.10.1
For other PIM routers:
set protocols pim rp auto-rp discovery
BSR: Bootstrap router.
set protocols pim rp bootstrap-priority 150 # For BSRs.
set protocols pim rp local address 30.0.10.1 # For the RPs.
Don't need any RP or BSR config anywhere else! It's all automatic in PIM.
IGMP:
set protocols igmp interface ge-0/0/0.0 version 3
set protocols igmp interface ge-0/0/0.0 group-policy Block-Premium-Channels
set policy-options policy-statement Block-Premium-Channels term 10 from route-filter 232.7.8.0/24 orlonger
set policy-options policy-statement Block-Premium-Channels term 10 from source-address-filter 10.0.75.1 exact
set policy-options policy-statement Block-Premium-Channels term 10 then reject
set policy-options policy-statement Block-Premium-Channels term 20 then accept
PIM policies:
set protocols pim import Good-Source-Groups
set protocols pim export Good-Source-Groups
set policy-options policy-statement Good-Source-Groups term Star-Group-Pairs from route-filter 227.7.0.0/16 orlonger
set policy-options policy-statement Good-Source-Groups term Star-Group-Pairs then accept
set policy-options policy-statement Good-Source-Groups term Source-Group-Pairs from route-filter 232.5.0.0/16 orlonger
set policy-options policy-statement Good-Source-Groups term Source-Group-Pairs from source-address-filter 10.0.20.2 exact
set policy-options policy-statement Good-Source-Groups term Source-Group-Pairs then accept
set policy-options policy-statement Good-Source-Groups term Reject-Other-Groups then reject
Anycast RP for PIM: Supports IPv4 and IPv6.
RP #1:
set interfaces lo0.0 family inet address 30.0.10.1 primary # Unique. Router-id.
set interfaces lo0.0 family inet address 35.0.10.50 # Anycast address.
set protocols pim rp local family inet address 35.0.10.50
set protocols pim rp local family inet anycast-pim rp-set address 30.0.10.2 # Peer's lo0 primary address.
set protocols pim rp local family inet anycast-pim local-address 30.0.10.1
RP #2:
set interfaces lo0.0 family inet address 30.0.10.2 primary
set interfaces lo0.0 family inet address 35.0.10.50
set protocols pim rp local family inet address 35.0.10.50
set protocols pim rp local family inet anycast-pim rp-set address 30.0.10.1
set protocols pim rp local family inet anycast-pim local-address 30.0.10.2
OR "family inet6" for IPv6.
Alternate multicast routing table:
If asked to change how multicast is forwarded or its knowledge of the shortest path, and if you can't create a static route, then you must use inet.2. Put your routes into inet.2, and then tell PIM to use inet.2.
Create a rib-group to copy ALL inet.0 routes to inet.2:
set routing-options rib-groups Copy-inet0-to-inet2 import-rib [ inet.0 inet.2 ]
set routing-options interface-routes rib-group inet Copy-inet0-to-inet2
set protocols (isis|ospf) rib-group Copy-inet0-to-inet2
set protocols bgp group Group-Name family inet rib-group Copy-inet0-to-inet2
Create a different rib-group pointing to inet.2 for reference by PIM:
set routing-options rib-groups Point-to-inet2 import-rib inet.2
set protocols pim rib-group inet Point-to-inet2
Multicast scoping
Named scoping:
set routing-options multicast scope FisherCo-MCast-Boundary prefix 239.0.0.0/10 # ONE prefix per boundary.
set routing-options multicast scope FisherCo-MCast-Boundary interface ge-0/0/0.0
Policy scoping:
set routing-options multicast scope-policy FisherCo-MCast-Boundary-Pol
set policy-options policy-statement FisherCo-MCast-Boundary-Pol term 10 from interface ge-0/0/0.0
set policy-options policy-statement FisherCo-MCast-Boundary-Pol term 10 from route-filter 239.0.0.0/10 orlonger
set policy-options policy-statement FisherCo-MCast-Boundary-Pol term 10 then reject
MSDP (IPv4 only)
set protocols msdp local-address 30.0.0.1
set protocols msdp group AS-1234 mode mesh-group
set protocols msdp group AS-1234 peer 40.0.0.1
set protocols msdp group AS-1234 peer 50.0.0.1 default-peer # Only do this on the closest RP to the default peer.
Policy:
set protocols msdp import MSDP-Protect # Or export. Can be on group or peer level instead.
set policy-options policy-statement MSDP-Protect term 10 from neighbor 40.0.0.1
set policy-options policy-statement MSDP-Protect term 10 from interface ge-0/0/0.0
set policy-options policy-statement MSDP-Protect term 10 from route-filter 224.7.6.5/32 exact
set policy-options policy-statement MSDP-Protect term 10 from source-address-filter 40.0.20.1 exact
set policy-options policy-statement MSDP-Protect term 10 then reject
set policy-options policy-statement MSDP-Protect term 20 then accept # Explicit acceptance required for MSDP policies.
Anycast RP for MSDP:
set interfaces lo0.0 family inet address 30.0.0.1 primary # Unique. Router-id.
set interfaces lo0.0 family inet address 35.0.0.1 # Anycast address.
set protocols pim rp local address 35.0.0.1
set protocols msdp group Anycast-Peers mode mesh-group
set protocols msdp group Anycast-Peers local-address 30.0.0.1
set protocols msdp group Anycast-Peers peer 30.0.0.2
20:06 UTC
BGP configuration
outing Policy
A neighbor policy cancels all group and global policies, and a group policy cancels all global policies.
IPv4: Import policies: Next-hop peer: set policy-options policy-statement Next-Hop-Peer then next-hop peer-address (helps if next hops are unreachable) Local preference: set policy-options policy-statement Local-Pref-200 term 1 from route-filter 1.2.3.0/24 exact set policy-options policy-statement Local-Pref-200 term 1 then local-preference 200 set policy-options policy-statement Local-Pref-200 term 1 then accept Export policies: Next-hop-self: set policy-options policy-statement Next-Hop-Self from protocol bgp set policy-options policy-statement Next-Hop-Self then next-hop self Import or export policies: AS-path prepend: set policy-options policy-statement Prepend-3x term 1 then as-path-prepend "1234 1234 1234" AS-path matching: set policy-options as-path Traversed-AS65432 ".* 65432 ." set policy-options policy-statement Filter-FisherCo-Private term 1 from as-path Traversed-AS65432 set policy-options policy-statement Filter-FisherCo-Private term 1 then reject AS-group matching: set policy-options as-path-group Long-List-of-Lameness as-path From-Invalid ". 56320-64511 ." set policy-options as-path-group Long-List-of-Lameness as-path WhateverCo ". 9999 ." set policy-options policy-statement Filter-Lame-Stuff term 1 from as-path-group Long-List-of-Lameness set policy-options policy-statement Filter-Lame-Stuff term 1 then reject set policy-options policy-statement Filter-Lame-Stuff term 1 then accept Communities: set policy-options community AS65432 members 65432:100 set policy-options community AS123xx members "123[0-9][0-9]:(10|15|20)" set policy-options community No-Export members no-export set policy-options community Wildcard members ":*" (all communities) (Master the character-based community regex operators.) set policy-options policy-statement AS65432-Replace term 1 then community set AS65432 set policy-options policy-statement AS65432-Import term 1 from protocol bgp set policy-options policy-statement AS65432-Import term 1 from as-path From-AS65432 set policy-options policy-statement AS65432-Import term 1 then community delete AS123xx set policy-options policy-statement AS65432-Import term 1 then community add AS65432 set policy-options policy-statement AS65432-Import term 1 then community add No-Export set policy-options policy-statement AS65432-Import term 1 then next policy set policy-options policy-statement AS65432-Import term 2 then community delete Wildcard Route manipulation without policies: set routing-instances L3VPN-Cust protocols bgp group AS65432-Peers neighbor 6.5.4.3 as-override set routing-instances L3VPN-Cust protocols bgp group AS65432-Peers neighbor 6.5.4.3 remove-private set protocols bgp group AS65432-Peers neighbor 6.5.4.3 metric-out set protocols bgp group AS65432-Peers neighbor 6.5.4.3 local-preference If IGP routes make BGP routes inactive: set protocols bgp group EBGP-Peers neighbor 1.2.3.4 advertise-inactive (or on a group or globally)
IPv6: Same as IPv4, but use IPv6 route-filters?
4-byte ASN: Instances: set routing-instances FisherCo-4B-VR route-distinguisher 7654321L Extended communities: set policy-options community FisherCo-4B-Comm members [ target:7654321L:100 ]
Load-balancing: set routing-options forwarding-table export Load-Balance-All set policy-options policy-statement Load-Balance-All then load-balance per-packet set forwarding-options hash-key family inet layer-3 set forwarding-options hash-key family inet layer-4
Remotely-triggered black holes: Trigger router: set routing-options static route 10.20.30.1/32 reject tag 888 set protocols bgp group IBGP-Peers export RTBH-Trigger set policy-options community RTBH members 100:888 set policy-options community No-Export members no-export set policy-options policy-statment RTBH-Trigger term 1 from protocol static set policy-options policy-statment RTBH-Trigger term 1 from tag 888 set policy-options policy-statment RTBH-Trigger term 1 then local-preference 200 set policy-options policy-statment RTBH-Trigger term 1 then community set RTBH set policy-options policy-statment RTBH-Trigger term 1 then community add No-Export set policy-options policy-statment RTBH-Trigger term 1 then accept Filtering routers (usually all ASBRs): set routing-options forwarding-table unicast-reverse-path feasible-paths set interfaces ge-0/0/0.0 family inet rpf-check set protocols bgp group IBGP-Peers import Black-Hole-Filter set policy-options as-path From-Our-AS "()" set policy-options community RTBH members 100:888 set policy-options policy-statement Black-Hole-Filter term 1 from protocol bgp set policy-options policy-statement Black-Hole-Filter term 1 from as-path From-Our-AS set policy-options policy-statement Black-Hole-Filter term 1 from community RTBH set policy-options policy-statement Black-Hole-Filter term 1 then next-hop discard
Implementation
IBGP: set routing-options autonomous-system 5678 set protocols bgp group IBGP-Peers type internal set protocols bgp group IBGP-Peers family inet unicast set protocols bgp group IBGP-Peers local-address 5.6.7.1 set protocols bgp group IBGP-Peers neighbor 5.6.7.8 set protocols bgp group IBGP-Peers-V6 type internal set protocols bgp group IBGP-Peers-V6 family inet6 unicast set protocols bgp group IBGP-Peers local-address 2005:6:7::1 set protocols bgp group IBGP-Peers-V6 neighbor 2005:6:7::8 or: set protocols bgp group IBGP-Peers-V4-Plus-V6 type internal set protocols bgp group IBGP-Peers-V4-Plus-V6 family inet unicast set protocols bgp group IBGP-Peers-V4-Plus-V6 family inet6 unicast set protocols bgp group IBGP-Peers-V4-Plus-V6 neighbor 5.6.7.8
EBGP: set routing-options autonomous-system 5678 set protocols bgp group EBGP-Peers type external set protocols bgp group EBGP-Peers family inet unicast set protocols bgp group EBGP-Peers neighbor 1.2.3.4 peer-as 1234 set protocols bgp group EBGP-Peers-V6 type external set protocols bgp group EBGP-Peers-V6 family inet6 unicast set protocols bgp group EBGP-Peers-V6 neighbor 2001:2:3::4 peer-as 1234 or: set protocols bgp group EBGP-Peers-V4-V6 type external set protocols bgp group EBGP-Peers-V4-V6 peer-as 1234 set protocols bgp group EBGP-Peers-V4-V6 family inet unicast set protocols bgp group EBGP-Peers-V4-V6 family inet6 unicast set protocols bgp group EBGP-Peers-V4-V6 neighbor 1.2.3.4 Be careful. This config changes the IPv6 next-hop to a v4-compatible v6 address. If you aren't using v4-compatible v6 addresses, then the workarounds include:
- set protocols bgp group EBGP-Peers-V4-V6 accept-remote-nexthop (now the routes are accepted but are "hidden")
To make the routes active and not hidden: (b is preferred) a. set protocols bgp group EBGP-Peers-V4-V6 multipath set routing-options rib inet6.0 static route ::ffff:1.2.3.4 next-hop 2002::5 (the peer's interface v6 address) b. set protocols bgp group EBGP-Peers-V4-V6 import FixNextHop set policy-options policy-statement FixNextHop from protocol bgp set policy-options policy-statement FixNextHop from rib inet6.0 set policy-options policy-statement FixNextHop from next-hop ::ffff:1.2.3.4 set policy-options policy-statement FixNextHop then next-hop 2002::5
IPv4 peering communities: ???
IPv6 peering communities: ???
IPv6 tunneling: See VPNs - Layer-3 VPNs - 6PE.
Authentication: set protocols bgp authentication-algorithm md5 set protocols bgp authentication-key-chain My-BGP-Keys set security authentication-key-chains key-chain My-BGP-Keys key 1 secret Blah # Doesn't exist in Junosphere? set security authentication-key-chains key-chain My-BGP-Keys key 1 start-time 2012-09-21.10:11:00 or: set protocols bgp authentication-key Blah (or under group or neighbor)
4-byte ASN: set routing-options autonomous-system 1234.5678 set protocols bgp group EBGP-Peers neighbor 12.34.56.78 peer-as 1234.5678
BFD: set protocols bgp group EBGP-Peers neighbor 1.2.3.4 bfd-liveness-detection minimum-interval 300 or set it on a group. or set it globally.
Per-prefix load-balancing: set protocols bgp group EBGP-Peers neighbor 1.2.3.4 multipath (IBGP does load-balancing by default if 2+ prefixes from same peer, and if IGP ECMP exists to that peer.) (Also see per-flow load-balancing under routing policy.)
Scaling
IPv4 route reflection: set protocols bgp group Cluster-9876 cluster 9.8.7.6 (any 4-octet number)
IPv6 route reflection: set protocols bgp group Cluster-9876 cluster 9.8.7.6 (any 4-octet number)
VPN route reflection: set protocols bgp group Cluster-9876 family inet-vpn unicast set protocols bgp group Cluster-9876 cluster 9.8.7.6 (any 4-octet number)
Route resolution in inet.3: The most specific BGP route is chosen, whether it's in inet.0 or inet.3, and inet.3 wins in a tie. To reflect a route that requires inet.3 resolution, you have several options:
- Create LSPs from the RRs to each PE router; OR
- Create a static default route in inet.3 on the RRs:
set routing-options rib inet.3 static route 0.0.0.0/0 discard
Route resolution in inet6.3: The most specific BGP route is chosen, whether it's in inet.0 or inet.3, and inet.3 wins in a tie. To reflect a route that requires inet.3 resolution, you have several options:
- Create LSPs from the RRs to each PE router; OR
- Create a static default route in inet6.3 on the RRs:
set routing-options rib inet6.3 static route ::/0 discard
Confederations: (NOT listed in the exam topics on the website.) All routers: set routing-options autonomous-system 65001 set routing-options confederation 1234 members [ 65001 65002 65003 ] Confederation border routers: set protocols bgp groups EBGP-Confed-Peers type external set protocols bgp groups EBGP-Confed-Peers export Next-Hop-Self set protocols bgp groups EBGP-Confed-Peers multihop set protocols bgp groups EBGP-Confed-Peers peer-as 65002 set protocols bgp groups EBGP-Confed-Peers local-address 10.0.0.1 set protocols bgp groups EBGP-Confed-Peers neighbor 10.0.20.1
22:52 UTC
BGP Tips
show route aspath-regex (regex)
Practice using SecureCRT, not Putty.
BGP default policies: Import: Accept all routes if BGP can resolve their BGP next-hops. Export: Advertise the best active BGP routes. (If an IGP shadows the BGP route, it will be inactive and not advertised.)
For hidden BGP routes: Routes are hidden because their next hops can't be resolved or due to policy filtering. show route hidden show route resolution unresolved (unresolvable routes only)
Remember to set next-hop self when importing routes from EBGP neighbors. Don't do this for any other reason, not even at route reflectors.
set protocols bgp traceoptions file BGP-Trace.log set protocols bgp traceoptions flag update detail
BGP troubleshooting: Avoid troubleshooting if at all possible. Make sure BGP sessions are established. Ensure needed protocol families are configured under BGP AND negotiated. Check if routes are advertised and received. Look for unresolved routes. Verify routes are in the routing tables. Use specific show commands with filters. Use traceoptions only for difficult problems. If you get stuck on something unfamiliar, consider moving on and coming back to it later.
22:51 UTC
BGP Notes
Idle Connect ACtive OpenSent OpenCOnfirm Established
Open Message used to negotiate parameters. Update message used to send withdraw routing inforamation. Notification message send when there is an error. Keepaliv message.
Adjacency-RIB-In, Local-RIB, Adjacency-RIB-Out.
Next hop, local preference, as path, origin, MED, EBGP over IBGP, IGP, Cluster, Router ID, Peer address.
Well known mandatory next hop. Only changed across EBGP. AS path. Origin. (IGP, EGP, ?).
Well known discretionary: local preference, highest wins and is local to AS. Not adv to ebgp. Atomic aggregate. A agregate route was selected over a more specfic route. Attribs might be missing.
Optional non-transitive: MED, only compared on routes from the same AS. Lower MED preferred. Stays in the AS not advertised via EBGP. Originator ID. Local to the AS. COntains the RID of the router that addouned the route to the first route reflector. Cluster list. Local to the AS. RR assign 32 bit value and prepends to cluster list. Multiprotocol NLRI.
Optional transative: Community. Associate routes together. No-export, no-advertise, no-export-subconfed. Agregrator. Must traverse al AS boundarys. Alert other rotuers where route aggregation occured. Extended community.
Local address of loopback for IBGP.
NExt-hop self.
Multipath command. Multihop. Passive. Allow. Prefix-limit teardown idle-timeout.
Route damping: show route daming decayed detail
Policy options damping as import.
Policy the orgin egp
protocols bgp group x remove-private
protocols bgp group x local-as 1111
protocols bgp group x local-as 1111 private to removed old as info from path atrrib.
protocols bgp group x as-override
set routing-options autonomous-system 65010 loops 2
policy-options as-path-prepend policy-options from as-path 6500 then as-path-expand last-as count 3 as-path 6500 ".* 6500 .*"
protocols bgp path-selection always-compare-med protocols bgp path-selection cisco-non-determenistic
groups external metric-out 20 metric-out igp assigns the igp cost of route as MED cost. Changes cost when metric changes. metric-out minimum-igp only changes cost when RPD restarts. policy-options then metric 20 policy-options then metric igp policy-options then metric minimum-igp
neighbor local-preference 50 policy-options then local-preference 50
RR and clients is a cluster. Cluster ID used to identify each cluster. Cluster lists each sequential cluster id that a route has transited. originator id identifies the router that first advertised the route to the RR.
Group c cluster 1.1.1.1
Confederation-bgp peering routing-options confederation 1111 memebers 64555 6477 group cbgp type external local-addres
protocols bgp log-updown
hold-time
22:50 UTC
IS-IS Troubleshooting
Neighbor establishment:
Mismatched area IDs for a level-1 adjacency.
Incorrect IP addresses.
One in broadcast mode, one in point-to-point mode.
Family ISO missing from interfaces.
Interfaces down.
Interface is passive, has wrong level, or is disabled.
Family ISO MTU must be >1492.
So physical MTU must be 1506 or higher?
MTU mismatch:
Not really a problem for IS-IS?
Physical - 14 = inet or inet6 MTU.
1514 is default GE MTU.
Router IDs:
Duplicate system IDs.
Authentication:
Bad hello authentication config.
Routing loops:
Use traceroute to diagnose.
Usually happens at redistribution points.
Summarization:
Incorrect criteria: from protocol, from level, to level
Incorrect actions: reject instead of accept
23:46 UTC
IS-IS Implementation
Configuration:
set interfaces lo0.0 family iso address 49.0001.1921.6801.2001.00
set protocols isis reference-bandwidth 100g
set protocols isis interface ge-0/1/2.0
set protocols isis interface ge-1/2/3.0 level 2 disable
set interfaces ge-0/1/2.0 family iso
or: set groups Family-ISO interfaces <ge-> unit 0 family iso
set groups Family-ISO interfaces <ae> unit 0 family iso
set interfaces apply-groups Family-ISO
Router advertisement:
set protocols isis interface ge-0/1/2.0 priority 0 (don't become DIS)
or: set protocols isis interface ge-0/1/2.0 point-to-point (removes DIS)
Routing policy:
set protocols isis export [ Level2-Leak Level1-Leak-Aggr-20 Level1-Leak-Exact-20 Export-Direct Export-Static ]
set policy-options policy-statement Level2-Leak term 1 from route-filter 1.2.3.4/32 exact
set policy-options policy-statement Level2-Leak term 1 from level 2
set policy-options policy-statement Level2-Leak term 1 to level 1
set policy-options policy-statement Level2-Leak term 1 then tag 1234
set policy-options policy-statement Level2-Leak term 1 then accept
set policy-options policy-statement Level1-Leak-Primary-20 term 1 from route-filter 20.20.20.0/24 exact
set policy-options policy-statement Level1-Leak-Primary-20 term 1 from level 1
set policy-options policy-statement Level1-Leak-Primary-20 term 1 to level 2
set policy-options policy-statement Level1-Leak-Primary-20 term 1 then tag 20
set policy-options policy-statement Level1-Leak-Primary-20 term 1 then accept
set policy-options policy-statement Level1-Leak-Backup-20 term 1 from route-filter 20.20.20.1/32 exact
set policy-options policy-statement Level1-Leak-Backup-20 term 1 from level 1
set policy-options policy-statement Level1-Leak-Backup-20 term 1 to level 2
set policy-options policy-statement Level1-Leak-Backup-20 term 1 then tag 21
set policy-options policy-statement Level1-Leak-Backup-20 term 1 then accept
(By default, IS-IS doesn't leak level 1 external routes (20.20.20.0/24) into level 2 unless wide metrics are used.)
IPv4 and IPv6 support:
This is built in.
BFD:
set protocols isis interface ge-0/1/2.0 bfd-liveness-detection minimum-interval 300
Load balancing:
set routing-options forwarding-table export Load-Balance-All
set policy-options policy-statement Load-Balance-All then load-balance per-packet
Optimize timers:
set protocols isis interface ge-0/1/2.0 level 2 hello-interval 2
set protocols isis interface ge-0/1/2.0 level 2 hold-time 8
(DRs are set to one-third of these configured values.)
CSPF support:
This is built in.
Authentication:
set protocols isis level 2 authentication-type md5
set protocols isis level 2 authentication-key Blah
set protocols isis interface ge-0/1/2.0 level 2 hello-authentication-type md5
set protocols isis interface ge-0/1/2.0 level 2 hello-authentication-key Blah
Metrics:
set protocols isis level 2 narrow-metrics-only (default)
set protocols isis level 2 wide-metrics-only
Overload:
set protocols isis overload timeout 60 (for 60m after a reboot)
23:43 UTC
Initial configuration
FXP0 does not provide routing capabilities.
FXP1 connects PFE to RE.
preferred address.
MTU does not include CRC.
if no mask then /32 assumed.
static route with remote IP using the resolve option.
default-static aggregate active if contributing route present.
interface-specific.
authentication-order
radius port 1812.
radius-server
rpf-check under interface.
reverse-path feasible-paths. under routing options
source-filtering for mac address.
system login announcement.
allow-commands "(^ping) | (^traceroute)" system login retry-options system syslog file All_except_ntp ntp none system syslog source-address system syslog time-format
annotate system
commit script work on the config upon commit. file copy CS_Example.xls /var/db/scripts/commit/ set system scripts commit file CS_Example.xls
OP script file copy OP_Example.xls /var/db/scripts/op/ set system scripts op file OP_Example.xls
from operational do "op OP_Example"
Event Scripts file copy EV_Example.xls /var/db/scripts/event/ set event-options event-script file EV_Example.xls
groups for GRES. system backup-router
chassis redundancy graceful-switchover chassis redundancy failover on-loss-of-keep-alives system process routing failover alternate-media routing-options nonstop-routing routing-options graceful-restart
interfaces xxx vrrp-group 1 virtual-address vrrp-group 1 preempt vrrp-group 1 priority vrrp-group 1 virtual-address fast-interval track interface xxx priority-cost 250
[edit system ntp] server address <key key-number> <version value> <prefer>; authentication-key key-number type type value password; boot-server address; trusted-key [ key-numbers ];
set system archival configuration transfer-on-commit archive-sites "ftp://lab@10.10.1.100" password lab123
To configure the remote template account, include the user remote statement at the [edit system login] hierarchy level and specify the privileges you want to grant to remote users:
BFD port is UDP 3794, rip UDP, LDP both TCP and UDP port, msdp TCP port. NTP is UDP. SNMP is UDP. Radius UDP. DNS is UDP from port domain. FTP is TCP from port ftp and ftp-data. Traceroute UDP ports 33434 and 33534.
set policy-options prefix-list bgp apply-path "protocols bgp group <> neighbor <>"
file copy ftp://lab:lab123@ip server address/path/file /destination/var/db/scripts/commit/
16:58 UTC
OSPF notes
OSPF notes Day 1
24 octect header version, type, checksum, authentication, auth type, Router ID, Area ID, packet length.
Hello Packet mask, hello interval*, options*, router priority, dead interval*, DR, BDR, neighbours
Database Description MTU, options, flags, Bit 2, The I bit determines the first packet. Bit 1, The M bit determines the last packet. Bit 0, The M/S bit. Master is bit 1. Slave is bit 0. DD sequence number, LSA headers.
Link State Request LSA type, link state ID, Advertising router.
Link state update number of LSAs, LSA advertisements.
Link state ack LSA headers.
Down - no ospf Init - received hello Attempt - only for NBMA, router will send hello 2 way - hello received with own router ID Exstart - Master/Slave chosen Exchange - DD are sent Loading - if missing LSA then LSR sent Full - OSPF adj up
Designated Router 224.0.0.6, type 2 LSA Router Priority then Router ID
Wait time 40 seconds before the DR is elected so all routers have a chance. Non deterministic(if DR goes down it does not necessarily become DR again).
Summary LSA, Type 3 Matches a single router LSA.
External LSA, Type 5 Domain wide flooding ABR creates a type 4 LSA for each type 5.
Stub Area ABR enforces stub type 3 summary LSA injected to stub
Totally stubby only one default type 3 LSA injected.
Not So Stubby Type 7 LSA for external routes ABR converts to typr 5 LSA and floods.
"clear ospf database purge" set all LSA to 3600 MaxAge timer and flood.
Intra-area then inter-area then external
Junos allows to restrict type 3 LSAs in NSSA using no-summaries
prefix-export-limit to limit number external prfixes allowed
set reference bandwidth
Common LSA header: Link state age, LSA type, Link state ID, Advertising router, Link state, Checksum, lenght
Router LSA: V, E, B, # of links, metric,
show ospf database router area 0 external asterisk is for LSA sent by local router
The act of turning the type 7 to a type 5 makes it a ASBR.
Router build tuples for spf.
link state database: contains tuples candidate database:cost from root to neighbot tree database:contains shortest path
Restart candidate, possible helper, helper. Type 9 LSA. disable helper-disable.
An ABR does not make a type 3 LSA from another type 3 LSA.
no-summariesto convert to tottaly stubby area-range
refresh LSA every 50 minutes
Type 7 to type 5 dony by ABR with highest router ID.
database-protection warning only spf options delay overload restrict
type 1 increases the metic based on the cost to the adverting router type 2 default.
23:55 UTC
JNCIP Case Study OSPF
set logical-systems r1 interfaces lt-1/2/0 unit 1 encapsulation ethernet
set logical-systems r1 interfaces lt-1/2/0 unit 1 peer-unit 2
set logical-systems r1 interfaces lt-1/2/0 unit 1 family inet address 10.0.5.1/24
set logical-systems r1 interfaces lt-1/2/0 unit 3 encapsulation ethernet
set logical-systems r1 interfaces lt-1/2/0 unit 3 peer-unit 4
set logical-systems r1 interfaces lt-1/2/0 unit 3 family inet address 10.0.4.5/30
set logical-systems r1 interfaces lt-1/2/0 unit 5 encapsulation ethernet
set logical-systems r1 interfaces lt-1/2/0 unit 5 peer-unit 6
set logical-systems r1 interfaces lt-1/2/0 unit 5 family inet address 10.0.4.14/30
set logical-systems r1 interfaces lo0 unit 1 family inet address 10.0.6.1/32
set logical-systems r2 interfaces lt-1/2/0 unit 2 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 2 peer-unit 1
set logical-systems r2 interfaces lt-1/2/0 unit 2 family inet address 10.0.5.2/24
set logical-systems r2 interfaces lt-1/2/0 unit 4 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 4 peer-unit 3
set logical-systems r2 interfaces lt-1/2/0 unit 4 family inet address 10.0.4.6/30
set logical-systems r2 interfaces lt-1/2/0 unit 9 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 9 peer-unit 10
set logical-systems r2 interfaces lt-1/2/0 unit 9 family inet address 10.0.4.2/30
set logical-systems r2 interfaces lt-1/2/0 unit 11 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 11 peer-unit 12
set logical-systems r2 interfaces lt-1/2/0 unit 11 family inet address 10.0.4.10/30
set logical-systems r2 interfaces lo0 unit 2 family inet address 10.0.6.2/32
set logical-systems r3 interfaces lt-1/2/0 unit 6 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 6 peer-unit 5
set logical-systems r3 interfaces lt-1/2/0 unit 6 family inet address 10.0.4.13/30
set logical-systems r3 interfaces lt-1/2/0 unit 10 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 10 peer-unit 9
set logical-systems r3 interfaces lt-1/2/0 unit 10 family inet address 10.0.4.1/30
set logical-systems r3 interfaces lt-1/2/0 unit 14 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 14 peer-unit 13
set logical-systems r3 interfaces lt-1/2/0 unit 14 family inet address 10.0.2.5/30
set logical-systems r3 interfaces lt-1/2/0 unit 15 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 15 peer-unit 16
set logical-systems r3 interfaces lt-1/2/0 unit 15 family inet address 10.0.2.2/30
set logical-systems r3 interfaces lo0 unit 3 family inet address 10.0.3.3/32
set logical-systems r4 interfaces lt-1/2/0 unit 12 encapsulation ethernet
set logical-systems r4 interfaces lt-1/2/0 unit 12 peer-unit 11
set logical-systems r4 interfaces lt-1/2/0 unit 12 family inet address 10.0.4.9/30
set logical-systems r4 interfaces lt-1/2/0 unit 13 encapsulation ethernet
set logical-systems r4 interfaces lt-1/2/0 unit 13 peer-unit 14
set logical-systems r4 interfaces lt-1/2/0 unit 13 family inet address 10.0.2.6/30
set logical-systems r4 interfaces lt-1/2/0 unit 17 encapsulation ethernet
set logical-systems r4 interfaces lt-1/2/0 unit 17 peer-unit 18
set logical-systems r4 interfaces lt-1/2/0 unit 17 family inet address 10.0.2.10/30
set logical-systems r4 interfaces lo0 unit 4 family inet address 10.0.3.4/32
set logical-systems r5 interfaces lt-1/2/0 unit 16 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 16 peer-unit 15
set logical-systems r5 interfaces lt-1/2/0 unit 16 family inet address 10.0.2.1/30
set logical-systems r5 interfaces lt-1/2/0 unit 18 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 18 peer-unit 17
set logical-systems r5 interfaces lt-1/2/0 unit 18 family inet address 10.0.2.9/30
set logical-systems r5 interfaces lt-1/2/0 unit 19 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 19 peer-unit 20
set logical-systems r5 interfaces lt-1/2/0 unit 19 family inet address 10.0.8.6/30
set logical-systems r5 interfaces lt-1/2/0 unit 21 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 21 peer-unit 22
set logical-systems r5 interfaces lt-1/2/0 unit 21 family inet address 10.0.8.9/30
set logical-systems r5 interfaces lo0 unit 5 family inet address 10.0.3.5/32
set logical-systems r6 interfaces lt-1/2/0 unit 20 encapsulation ethernet
set logical-systems r6 interfaces lt-1/2/0 unit 20 peer-unit 19
set logical-systems r6 interfaces lt-1/2/0 unit 20 family inet address 10.0.8.5/30
set logical-systems r6 interfaces lt-1/2/0 unit 23 encapsulation ethernet
set logical-systems r6 interfaces lt-1/2/0 unit 23 peer-unit 24
set logical-systems r6 interfaces lt-1/2/0 unit 23 family inet address 10.0.8.1/30
set logical-systems r6 interfaces lt-1/2/0 unit 25 encapsulation ethernet
set logical-systems r6 interfaces lt-1/2/0 unit 25 peer-unit 26
set logical-systems r6 interfaces lt-1/2/0 unit 25 family inet address 172.16.40.2/30
set logical-systems r6 interfaces lo0 unit 6 family inet address 10.0.9.6/32
set logical-systems r7 interfaces lt-1/2/0 unit 22 encapsulation ethernet
set logical-systems r7 interfaces lt-1/2/0 unit 22 peer-unit 21
set logical-systems r7 interfaces lt-1/2/0 unit 22 family inet address 10.0.8.10/30
set logical-systems r7 interfaces lt-1/2/0 unit 24 encapsulation ethernet
set logical-systems r7 interfaces lt-1/2/0 unit 24 peer-unit 23
set logical-systems r7 interfaces lt-1/2/0 unit 24 family inet address 10.0.8.2/30
set logical-systems r7 interfaces lt-1/2/0 unit 27 encapsulation ethernet
set logical-systems r7 interfaces lt-1/2/0 unit 27 peer-unit 28
set logical-systems r7 interfaces lt-1/2/0 unit 27 family inet address 172.16.40.6/30
set logical-systems r7 interfaces lo0 unit 7 family inet address 10.0.9.7/32
set logical-systems rip interfaces lt-1/2/0 unit 26 encapsulation ethernet
set logical-systems rip interfaces lt-1/2/0 unit 26 peer-unit 25
set logical-systems rip interfaces lt-1/2/0 unit 26 family inet address 172.16.40.1/30
set logical-systems rip interfaces lt-1/2/0 unit 28 encapsulation ethernet
set logical-systems rip interfaces lt-1/2/0 unit 28 peer-unit 27
set logical-systems rip interfaces lt-1/2/0 unit 28 family inet address 172.16.40.5/30
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.0.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.1.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.2.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.3.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.4.1/32
set logical-systems rip policy-options policy-statement rip term 1 from protocol static
set logical-systems rip policy-options policy-statement rip term 1 from protocol rip
set logical-systems rip policy-options policy-statement rip term 1 then accept
set logical-systems rip routing-options static route 192.168.0.0/24 receive
set logical-systems rip routing-options static route 192.168.1.0/24 receive
set logical-systems rip routing-options static route 192.168.2.0/24 receive
set logical-systems rip routing-options static route 192.168.3.0/24 receive
set logical-systems rip routing-options static route 192.168.4.0/24 receive
01:08 UTC
OSPF Troubleshooting
Neighbor establishment:
Use: monitor traffic interface ge-??? detail no-resolve
If using traceoptions, activate "hello detail" and "error detail" flags.
Duplicate router IDs.
Incorrect IP addresses or mismatched subnets.
One in broadcast mode, one in point-to-point mode.
Priority 0 on both sides.
Interfaces are down.
MTU mismatch:
Watch for one neighbor in Exchange, one in ExStart.
Physical - 14 = inet or inet6 MTU.
1514 is default GE MTU.
Authentication:
Bad authentication config.
Router IDs:
Mismatched area types or IDs.
IGP timers:
Mismatched hello or dead intervals.
Overloaded:
Can be triggered by bouncing the protocol or prefix-export-limit being exceeded.
Routing loops:
Use traceroute to diagnose.
Usually happens at redistribution points.
Summarization:
Incorrect criteria: from protocol
Incorrect actions: reject instead of accept
area-range: Put under "area" for type-1 or -2 LSAs or under "nssa" for type-7 LSAs.
15:18 UTC