Press J to jump to the feed. Press question mark to learn the rest of the keyboard shortcuts
2

My MPLS post the other week was pretty well received so I figured might as well show the other side of the coin and do it again with Juniper boxes.

Topology

Today's Topology is similar to last time but Juniperified, we have:

  • 4 x PE routers that are vMX
  • 4 x P are vSRX
  • 4 x CE routers are VSRX boxes as well.

There are again two customers, CUST-A and CUST-B because originality is hard.

To save on some config space I'll just focus on a single router at a time unless there is differences that are worth seeing.

Provider Routers

Disable Flow Mode

I'm using SRX routers for my core so we need to disable the default flow based mode and reboot the boxes before we can use them with MPLS.

root@P01# set security forwarding-options family inet6 mode packet-based 

[edit]
root@P01# set security forwarding-options family mpls mode packet-based 

[edit]
root@P01# set security forwarding-options family iso mode packet-based 

root@P01# commit 
commit complete

[edit]

root@P01# run request system reboot 
Reboot the system ? [yes,no] (no) yes

Once this is done we will no longer need to use security zones for everything.

Basic Setup

To keep things clean I'm using a virtual-router instance to move the first interface into another routing table for management.

set routing-instances MGMT instance-type virtual-router
set routing-instances MGMT interface ge-0/0/0.0
set routing-instances MGMT routing-options static route 0.0.0.0/0 next-hop 10.20.2.1
set interfaces ge-0/0/0 unit 0 family inet address 10.20.2.211/24

Most of my interfaces are connecting to trunk ports to make life easier so I'm going to enable vlan tagging and use subinterfaces to connect to everything.

set interfaces ge-0/0/1 vlan-tagging
set interfaces ge-0/0/1 unit 3011 vlan-id 3011
set interfaces ge-0/0/1 unit 3011 family inet address 10.1.11.1/24
set interfaces ge-0/0/1 unit 3012 vlan-id 3012
set interfaces ge-0/0/1 unit 3012 family inet address 10.1.2.1/24
set interfaces ge-0/0/1 unit 3013 vlan-id 3013
set interfaces ge-0/0/1 unit 3013 family inet address 10.1.3.1/24
set interfaces ge-0/0/1 unit 3014 vlan-id 3014
set interfaces ge-0/0/1 unit 3014 family inet address 10.1.4.1/24
set interfaces lo0 unit 0 family inet address 192.168.255.1/32

Then I'll just turn on OSPF on all active interfaces in the routing instance.

root@P01# set protocols ospf area 0.0.0.0 interface all 

Once we are done we should see a neighbor with every other P router and a PE router (once we get that far)

root@P01# run show ospf neighbor 
Address          Interface              State     ID               Pri  Dead
10.1.11.254      ge-0/0/1.3011          Full      192.168.255.11   128    39
10.1.2.2         ge-0/0/1.3012          Full      192.168.255.2    128    32
10.1.3.3         ge-0/0/1.3013          Full      192.168.255.3    128    39
10.1.4.4         ge-0/0/1.3014          Full      192.168.255.4    128    34

Enabling MPLS

While Cisco put effort into making sure MPLS is turned on right away, Juniper takes a bit more effort.

First we need to enable MPLS and LDP in the control plane under protocols, we can conveniently use the interface all keyword to enable it on all interfaces.

root@P01# set protocols mpls interface all 

root@P01# set protocols ldp interface all   

Next we need to turn it on for the forwarding plane by adding the mpls family to each interface on the router that will be in the MPLS path. This can be a bit annoying so you might want to look into things like config groups to ease the admin burden.

set interfaces ge-0/0/1 unit 3011 family mpls

set interfaces ge-0/0/1 unit 3012 family mpls

set interfaces ge-0/0/1 unit 3013 family mpls

set interfaces ge-0/0/1 unit 3014 family mpls

set interfaces lo0 unit 0 family mpls

Route Reflector

We'll use a route reflector again but this time I'm just take advantage of the logical-system feature to carve PE01 and PE02 into two new Route Reflector boxes.

RR01

First we'll turn on vlan-tagging for the interface I want to use since we still need to configure physical stuff at the interface level in logical-systems.

root@PE11# set interfaces ge-0/0/2 vlan-tagging 

Next we configure the interfaces like above under the logical-system.

root@PE11# set logical-systems RR01 interfaces ge-0/0/2 unit 3123 vlan-id 3123 
root@PE11# set logical-systems RR01 interfaces ge-0/0/2 unit 3123 family inet address 10.0.123.254/24 
root@PE11# set logical-systems RR01 interfaces ge-0/0/2 unit 3123 family mpls 
root@PE11# set logical-systems RR01 interfaces lo0 unit 1 family inet address 192.168.255.154/32 

root@PE11# set logical-systems RR01 protocols ospf area 0.0.0.0 interface all 
root@PE11# set logical-systems RR01 protocols mpls interface all 
root@PE11# set logical-systems RR01 protocols ldp interface all 

BGP is configured with the inet-vpn family which is the same as Cisco's VPNv4 family, the route reflector will have all for PEs as a peer, will use 65123 as the AS for iBGP and will set a cluster-id so Juniper knows it is a Route Reflector.

root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL type internal 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL local-address 192.168.255.154 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL family inet-vpn unicast 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL cluster 192.168.255.254 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.11 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.22 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.33 
root@PE11# set logical-systems RR01 protocols bgp group PE-INTERNAL neighbor 192.168.255.44 
root@PE11# set logical-systems RR01 routing-options autonomous-system 65123 

RR02

root@PE22# set logical-systems RR02 interfaces ge-0/0/2 unit 3123 vlan-id 3123 
root@PE22# set logical-systems RR02 interfaces ge-0/0/2 unit 3123 family inet address 10.1.123.254/24 
root@PE22# set logical-systems RR02 interfaces ge-0/0/2 unit 3123 family mpls 
root@PE22# set logical-systems RR02 interfaces lo0 unit 1 family inet address 192.168.255.254/32 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL type internal 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL local-address 192.168.255.254 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL family inet-vpn unicast 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL cluster 192.168.255.254 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.11 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.22 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.33 
root@PE22# set logical-systems RR02 protocols bgp group PE-INTERNAL neighbor 192.168.255.44 
root@PE22# set logical-systems RR02 protocols ospf area 0.0.0.0 interface all 
root@PE22# set logical-systems RR02 protocols mpls interface all 
root@PE22# set logical-systems RR02 protocols ldp interface all 
root@PE22# set logical-systems RR02 routing-options autonomous-system 65123 

Provider Edge

The PE will be similar to the Route-Reflector minus the logical system stuff, we'll setup the interfaces enable OSPF and MPLS, then peer with each of the RRs.

root@PE11# set routing-instances MGMT instance-type virtual-router 
root@PE11# set routing-instances MGMT interface ge-0/0/0.0 
root@PE11# set routing-instances MGMT routing-options static route 0.0.0.0/0 next-hop 10.20.2.1 
root@PE11# set interfaces ge-0/0/0 unit 0 family inet address 10.20.2.201/24 

root@PE11# set interfaces ge-0/0/1 vlan-tagging 
root@PE11# set interfaces ge-0/0/1 unit 3011 vlan-id 3011 
root@PE11# set interfaces ge-0/0/1 unit 3011 family inet address 10.1.11.254/24 
root@PE11# set interfaces ge-0/0/1 unit 3011 family mpls 
root@PE11# set interfaces ge-0/0/1 unit 3123 vlan-id 3123 
root@PE11# set interfaces ge-0/0/1 unit 3123 family inet address 10.0.123.11/24 
root@PE11# set interfaces ge-0/0/1 unit 3123 family mpls 
root@PE11# set interfaces ge-0/0/2 vlan-tagging 
root@PE11# set interfaces ge-0/0/5 unit 0 family inet address 192.168.1.254/24 

root@PE11# set interfaces lo0 unit 0 family inet address 192.168.255.11/32 
root@PE11# set interfaces lo0 unit 0 family inet6 address 2001:1234::1/128 
root@PE11# set interfaces lo0 unit 0 family mpls 

root@PE11# set routing-options autonomous-system 65123 
root@PE11# set protocols bgp group RR type internal 
root@PE11# set protocols bgp group RR local-address 192.168.255.11 
root@PE11# set protocols bgp group RR family inet-vpn unicast 
root@PE11# set protocols bgp group RR neighbor 192.168.255.154 
root@PE11# set protocols bgp group RR neighbor 192.168.255.254 

VRF / Policies

Now our BGP is up it is time to create the last piece of the L3VPN and which is making the policies as well as the VRF the CE goes into.

Policies

In Cisco land we controlled what route we imported and exported under the VRF configuration, Juniper does that too but for more granular control we will make a more elaborate policy.

First we make an community policy that just exports the PE's RD on each router.

root@PE11# set policy-options community RT-EXPORT-CE01 members target:65123:101 

Next we'll do the same for the import community where we will make one for each CE for flexibility's sake.

root@PE11# set policy-options community RT-IMPORT-CE01 members target:65123:101 
root@PE11# set policy-options community RT-IMPORT-CE02 members target:65123:102 
root@PE11# set policy-options community RT-IMPORT-CE03 members target:65123:103 
root@PE11# set policy-options community RT-IMPORT-CE04 members target:65123:104

With that in place we make a policy that will become our VRF-Export policy, we will say that if the protocol is directly connected or one of the routing protocols then we will add the export community and accept the route.

root@PE11# set policy-options policy-statement EXPORT-CE01 term EXPORT from protocol [ direct bgp rip ospf ]
root@PE11# set policy-options policy-statement EXPORT-CE01 term EXPORT then community add RT-EXPORT-CE01 
root@PE11# set policy-options policy-statement EXPORT-CE01 term EXPORT then accept 

If it doesn't match that criteria then we will reject it.

root@PE11# set policy-options policy-statement EXPORT-CE01 term REJECT then reject 

The VRF-Import policy will always be from MBGP so we match on protocol BGP, then we select what communities we want to talk to each other.

In our topology Cust-A is CE01 and CE02 so we'll do that then reject the rest.

root@PE11# set policy-options policy-statement IMPORT-CE01 term IMPORT from protocol bgp 
root@PE11# set policy-options policy-statement IMPORT-CE01 term IMPORT from community [ RT-IMPORT-CE01 RT-IMPORT-CE02 ] 
root@PE11# set policy-options policy-statement IMPORT-CE01 term IMPORT then accept 
root@PE11# set policy-options policy-statement IMPORT-CE01 term REJECT then reject

VRFs

With all that in place we need to make a VRF instance. In my case I'm using ge-0/0/5 on all the PEs as the CE interface so we add it to the VRF, we also set the PE's proper RD and apply the VRF policies we just made. We also use vrf-table-label to help make the L3VPN happy.

root@PE11# set routing-instances CE01 instance-type vrf 
root@PE11# set routing-instances CE01 interface ge-0/0/5.0 
root@PE11# set routing-instances CE01 route-distinguisher 65123:101 
root@PE11# set routing-instances CE01 vrf-import IMPORT-CE01 
root@PE11# set routing-instances CE01 vrf-export EXPORT-CE01 
root@PE11# set routing-instances CE01 vrf-table-label 

We'll also set the router-id for the instance just to have a bit more control

root@PE11# set routing-instances CE01 routing-options router-id 192.168.255.11 

Customer Edge

PE01

Finally we will start working on the CE routing!

We need an export policy so Juniper knows what to send so I'll make a simple one that just accepts any route, since PE01 is BGP we'll setup that too. The config is the same as you have seen though you may want to use the as-override option if you are using BGP.

root@PE11# set policy-options policy-statement EXPORT-BGP then accept
root@PE11# set routing-instances CE01 protocols bgp group CUST-A type external 
root@PE11# set routing-instances CE01 protocols bgp group CUST-A export EXPORT-BGP 
root@PE11# set routing-instances CE01 protocols bgp group CUST-A peer-as 65101 
root@PE11# set routing-instances CE01 protocols bgp group CUST-A neighbor 192.168.1.1 as-override 



root@PE11# set policy-options policy-statement EXPORT-BGP then accept 

root@PE11# set policy-options policy-statement EXPORT-OSPF from protocol bgp 
root@PE11# set policy-options policy-statement EXPORT-OSPF then accept
root@PE11# set policy-options policy-statement EXPORT-RIP then metric 5 
root@PE11# set policy-options policy-statement EXPORT-RIP then accept 

CE01, CE02, CE03, CE04

Since the CE's are still in flow mode, we need to make sure the interfaces we use are trusted by the security zone, we could get more specific but we aren't really playing with the firewall today :)

root@CE01# set security zones security-zone trust host-inbound-traffic system-services all 
root@CE01# set security zones security-zone trust host-inbound-traffic protocols all 
root@CE01# set security zones security-zone trust interfaces ge-0/0/1.0 
root@CE01# set security zones security-zone trust interfaces ge-0/0/2.0 

CE01

For BGP we just do a normal peering and advertise everything directly connected.

root@CE01# set policy-options policy-statement EXPORT-BGP from protocol direct 
root@CE01# set policy-options policy-statement EXPORT-BGP then accept

root@CE01# set protocols bgp group CUST-A type external 
root@CE01# set protocols bgp group CUST-A export EXPORT-BGP 
root@CE01# set protocols bgp group CUST-A peer-as 65123 
root@CE01# set protocols bgp group CUST-A neighbor 192.168.1.254 

CE02

Same with RIP for CE02

root@CE02# set policy-options policy-statement EXPORT-RIP from protocol direct 
root@CE02# set policy-options policy-statement EXPORT-RIP then accept

root@CE02# set protocols rip group CUST-A export EXPORT-RIP 
root@CE02# set protocols rip group CUST-A neighbor ge-0/0/1.0 

CE03 and CE04

The OSPF CE is a bit unique because it is the only protocol we are looking at today that cares about external routes. Let's setup OSPF in two ways, one will simply add all interfaces to OSPF and the other will use the export method we have been doing

root@CE03# set protocols ospf area 0.0.0.0 interface all 
root@CE03# set protocols ospf area 0.0.0.0 interface lo0.0 passive 


root@CE04# set policy-options policy-statement EXPORT-OSPF from protocol direct 
root@CE04# set policy-options policy-statement EXPORT-OSPF then accept 
root@CE04# set protocols ospf export EXPORT-OSPF    
root@CE04# set protocols ospf area 0.0.0.0 interface ge-0/0/1.0 

Now we get the routes but routes from CE04 are external! We might talk about OSPF specific MPLS topics another day!

root@CE03# run show ospf route    
Topology default Route Table:

Prefix             Path  Route      NH       Metric NextHop       Nexthop      
                   Type  Type       Type            Interface     Address/LSP
192.168.3.254      Intra Area/AS BR IP            1 ge-0/0/1.0    192.168.3.254
172.16.31.0/24     Intra Network    IP            1 ge-0/0/2.0
172.16.32.0/24     Intra Network    IP            1 ge-0/0/2.0
172.16.33.0/24     Intra Network    IP            1 ge-0/0/2.0
172.16.34.0/24     Intra Network    IP            1 ge-0/0/2.0
172.16.41.0/24     Ext2  Network    IP            0 ge-0/0/1.0    192.168.3.254
172.16.42.0/24     Ext2  Network    IP            0 ge-0/0/1.0    192.168.3.254
172.16.43.0/24     Ext2  Network    IP            0 ge-0/0/1.0    192.168.3.254
172.16.44.0/24     Ext2  Network    IP            0 ge-0/0/1.0    192.168.3.254
192.168.3.0/24     Intra Network    IP            1 ge-0/0/1.0
192.168.4.0/24     Ext2  Network    IP            0 ge-0/0/1.0    192.168.3.254

Verification

Now that everything is up we can make sure that BGP is working properly (probably should have done that sooner!)

root@PE11# run show bgp summary                                        
Groups: 2 Peers: 3 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
bgp.l3vpn.0          
                      12          6          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.168.1.1           65101       1803       1794       0       3    13:27:34 Establ
  CE01.inet.0: 5/6/6/0
192.168.255.154       65123       1594       1582       0       1    11:54:35 Establ
  bgp.l3vpn.0: 6/6/6/0
  CE01.inet.0: 6/6/6/0
192.168.255.254       65123       1591       1581       0       1    11:54:41 Establ
  bgp.l3vpn.0: 0/6/6/0
  CE01.inet.0: 0/6/6/0

We can also see the MPLS interfaces on the router

root@PE11# run show mpls interface 
Interface        State       Administrative groups (x: extended)
ge-0/0/1.3011    Up         <none>
ge-0/0/1.3123    Up         <none>

[edit]

As well as the LDP neighbors

root@PE11# run show ldp neighbor 
Address                             Interface       Label space ID     Hold time
10.1.11.1                           ge-0/0/1.3011   192.168.255.1:0      14
10.0.123.33                         ge-0/0/1.3123   192.168.255.33:0     13
10.0.123.44                         ge-0/0/1.3123   192.168.255.44:0     13
10.0.123.254                        ge-0/0/1.3123   192.168.255.154:0    11

PE01 Routing Table

Juniper groups everything into the routing table so we can see the main routing table, the MPLS labels, the VRF routes, and IPv6 routes all in one place! We can also see the INET-VPN routes so we can see if things are being learned properly.

root@PE11# run show route 

inet.0: 26 destinations, 26 routes (26 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.0.123.0/24      *[Direct/0] 12:09:45
                    > via ge-0/0/1.3123
10.0.123.11/32     *[Local/0] 12:09:45
                      Local via ge-0/0/1.3123
10.1.2.0/24        *[OSPF/10] 14:45:03, metric 2
                    > to 10.1.11.1 via ge-0/0/1.3011
10.1.3.0/24        *[OSPF/10] 14:45:03, metric 2
                    > to 10.1.11.1 via ge-0/0/1.3011
10.1.4.0/24        *[OSPF/10] 14:45:03, metric 2
                    > to 10.1.11.1 via ge-0/0/1.3011
10.1.11.0/24       *[Direct/0] 14:45:09
                    > via ge-0/0/1.3011
10.1.11.254/32     *[Local/0] 14:45:09
                      Local via ge-0/0/1.3011
10.1.123.0/24      *[OSPF/10] 11:41:39, metric 2
                    > to 10.0.123.33 via ge-0/0/1.3123
                      to 10.0.123.44 via ge-0/0/1.3123
10.2.3.0/24        *[OSPF/10] 11:42:39, metric 3
                      to 10.1.11.1 via ge-0/0/1.3011
                    > to 10.0.123.33 via ge-0/0/1.3123
10.2.4.0/24        *[OSPF/10] 11:41:48, metric 3
                      to 10.1.11.1 via ge-0/0/1.3011
                    > to 10.0.123.44 via ge-0/0/1.3123
10.2.22.0/24       *[OSPF/10] 11:41:39, metric 3
                      to 10.1.11.1 via ge-0/0/1.3011
                      to 10.0.123.33 via ge-0/0/1.3123
                    > to 10.0.123.44 via ge-0/0/1.3123
10.3.4.0/24        *[OSPF/10] 11:41:48, metric 3
                      to 10.1.11.1 via ge-0/0/1.3011
                      to 10.0.123.33 via ge-0/0/1.3123
                    > to 10.0.123.44 via ge-0/0/1.3123
10.3.33.0/24       *[OSPF/10] 11:42:39, metric 2
                    > to 10.0.123.33 via ge-0/0/1.3123
10.4.44.0/24       *[OSPF/10] 11:41:48, metric 2
                    > to 10.0.123.44 via ge-0/0/1.3123
192.168.255.1/32   *[OSPF/10] 14:45:03, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011
192.168.255.2/32   *[OSPF/10] 12:00:32, metric 2
                    > to 10.1.11.1 via ge-0/0/1.3011
192.168.255.3/32   *[OSPF/10] 11:42:39, metric 2
                    > to 10.1.11.1 via ge-0/0/1.3011
                      to 10.0.123.33 via ge-0/0/1.3123
192.168.255.4/32   *[OSPF/10] 11:41:48, metric 2
                    > to 10.1.11.1 via ge-0/0/1.3011
                      to 10.0.123.44 via ge-0/0/1.3123
192.168.255.11/32  *[Direct/0] 14:52:17
                    > via lo0.0
192.168.255.22/32  *[OSPF/10] 11:41:39, metric 2
                    > to 10.0.123.33 via ge-0/0/1.3123
                      to 10.0.123.44 via ge-0/0/1.3123
192.168.255.33/32  *[OSPF/10] 11:42:39, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123
192.168.255.44/32  *[OSPF/10] 11:41:48, metric 1
                    > to 10.0.123.44 via ge-0/0/1.3123
192.168.255.154/32 *[OSPF/10] 12:07:04, metric 1
                    > to 10.0.123.254 via ge-0/0/1.3123
192.168.255.254/32 *[OSPF/10] 11:41:39, metric 2
                      to 10.0.123.33 via ge-0/0/1.3123
                    > to 10.0.123.44 via ge-0/0/1.3123
224.0.0.2/32       *[LDP/9] 14:52:17, metric 1
                      MultiRecv
224.0.0.5/32       *[OSPF/10] 14:52:17, metric 1
                      MultiRecv

inet.3: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.255.1/32   *[LDP/9] 14:45:03, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011
192.168.255.2/32   *[LDP/9] 12:00:32, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011, Push 299840
192.168.255.3/32   *[LDP/9] 11:42:38, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011, Push 299808
                      to 10.0.123.33 via ge-0/0/1.3123, Push 299776
192.168.255.4/32   *[LDP/9] 11:41:47, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011, Push 299792
                      to 10.0.123.44 via ge-0/0/1.3123, Push 299776
192.168.255.22/32  *[LDP/9] 11:37:45, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 299952
                      to 10.0.123.44 via ge-0/0/1.3123, Push 299952
192.168.255.33/32  *[LDP/9] 11:42:38, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123
192.168.255.44/32  *[LDP/9] 11:41:47, metric 1
                    > to 10.0.123.44 via ge-0/0/1.3123
192.168.255.154/32 *[LDP/9] 11:44:55, metric 1
                    > to 10.0.123.254 via ge-0/0/1.3123
192.168.255.254/32 *[LDP/9] 11:37:45, metric 1
                      to 10.0.123.33 via ge-0/0/1.3123, Push 299936
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 299936

CE01.inet.0: 13 destinations, 20 routes (13 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.16.11.0/24     *[BGP/170] 13:28:31, localpref 100
                      AS path: 65101 I, validation-state: unverified
                    > to 192.168.1.1 via ge-0/0/5.0
172.16.12.0/24     *[BGP/170] 13:28:31, localpref 100
                      AS path: 65101 I, validation-state: unverified
                    > to 192.168.1.1 via ge-0/0/5.0
172.16.13.0/24     *[BGP/170] 13:28:31, localpref 100
                      AS path: 65101 I, validation-state: unverified
                    > to 192.168.1.1 via ge-0/0/5.0
172.16.14.0/24     *[BGP/170] 13:28:31, localpref 100
                      AS path: 65101 I, validation-state: unverified
                    > to 192.168.1.1 via ge-0/0/5.0
172.16.21.0/24     *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
172.16.22.0/24     *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
172.16.23.0/24     *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
172.16.24.0/24     *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
192.168.1.0/24     *[Direct/0] 14:45:09
                    > via ge-0/0/5.0
                    [BGP/170] 13:28:31, localpref 100
                      AS path: 65101 I, validation-state: unverified
                    > to 192.168.1.1 via ge-0/0/5.0
192.168.1.254/32   *[Local/0] 14:45:09
                      Local via ge-0/0/5.0
192.168.2.0/24     *[BGP/170] 00:33:22, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:33:22, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
192.168.254.1/32   *[BGP/170] 13:28:31, localpref 100
                      AS path: 65101 I, validation-state: unverified
                    > to 192.168.1.1 via ge-0/0/5.0
192.168.254.2/32   *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)

MGMT.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 14:45:09
                    > to 10.20.2.1 via ge-0/0/0.0
10.20.2.0/24       *[Direct/0] 14:45:09
                    > via ge-0/0/0.0
10.20.2.201/32     *[Local/0] 14:45:09
                      Local via ge-0/0/0.0

mpls.0: 20 destinations, 20 routes (20 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0                  *[MPLS/0] 14:52:17, metric 1
                      to table inet.0
0(S=0)             *[MPLS/0] 14:52:17, metric 1
                      to table mpls.0
1                  *[MPLS/0] 14:52:17, metric 1
                      Receive
2                  *[MPLS/0] 14:52:17, metric 1
                      to table inet6.0
2(S=0)             *[MPLS/0] 14:52:17, metric 1
                      to table mpls.0
13                 *[MPLS/0] 14:52:17, metric 1
                      Receive
16                 *[VPN/0] 14:52:17
                    > via lsi.0 (CE01), Pop      
299776             *[LDP/9] 14:45:03, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011, Pop      
299776(S=0)        *[LDP/9] 14:45:03, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011, Pop      
299792             *[LDP/9] 11:41:47, metric 1
                      to 10.1.11.1 via ge-0/0/1.3011, Swap 299792
                    > to 10.0.123.44 via ge-0/0/1.3123, Swap 299776
299808             *[LDP/9] 11:42:38, metric 1
                      to 10.1.11.1 via ge-0/0/1.3011, Swap 299808
                    > to 10.0.123.33 via ge-0/0/1.3123, Swap 299776
299824             *[LDP/9] 12:00:32, metric 1
                    > to 10.1.11.1 via ge-0/0/1.3011, Swap 299840
299856             *[LDP/9] 11:42:38, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123, Pop      
299856(S=0)        *[LDP/9] 11:42:38, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123, Pop      
299872             *[LDP/9] 11:41:47, metric 1
                    > to 10.0.123.44 via ge-0/0/1.3123, Pop      
299872(S=0)        *[LDP/9] 11:41:47, metric 1
                    > to 10.0.123.44 via ge-0/0/1.3123, Pop      
299904             *[LDP/9] 11:44:55, metric 1
                    > to 10.0.123.254 via ge-0/0/1.3123, Pop      
299904(S=0)        *[LDP/9] 11:44:55, metric 1
                    > to 10.0.123.254 via ge-0/0/1.3123, Pop      
299936             *[LDP/9] 11:37:45, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123, Swap 299936
                      to 10.0.123.44 via ge-0/0/1.3123, Swap 299936
299952             *[LDP/9] 11:37:45, metric 1
                    > to 10.0.123.33 via ge-0/0/1.3123, Swap 299952
                      to 10.0.123.44 via ge-0/0/1.3123, Swap 299952

bgp.l3vpn.0: 6 destinations, 12 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

65123:102:172.16.21.0/24                
                   *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:172.16.22.0/24                
                   *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:172.16.23.0/24                
                   *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:172.16.24.0/24                
                   *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:192.168.2.0/24                
                   *[BGP/170] 00:33:22, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:33:22, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                    > to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                      to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
65123:102:192.168.254.2/32                
                   *[BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.154
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    [BGP/170] 00:31:09, MED 2, localpref 100, from 192.168.255.254
                      AS path: I, validation-state: unverified
                      to 10.0.123.33 via ge-0/0/1.3123, Push 19, Push 299952(top)
                    > to 10.0.123.44 via ge-0/0/1.3123, Push 19, Push 299952(top)

inet6.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

2001:1234::1/128   *[Direct/0] 14:52:17
                    > via lo0.0
fe80::250:560f:fc9e:4cd1/128
                   *[Direct/0] 14:52:17
                    > via lo0.0
ff02::2/128        *[INET6/0] 14:52:17
                      MultiRecv

Pastebins

Here are the configs in pastebins for a bit more convenient looking at.

PE01

PE02

PE03

PE04

P01

P02

P03

P04

CE01

CE02

CE03

CE04

2
1 comment
5
Archived

So, since we need to kick this subreddit to life again - who here is preparing for any JNCIE lab or even the JNCIP written exams?

There are few JNCIEs here that are very willing to help in any way we can.

Just trying to spread the Junos love.

5
5 comments
1
Archived

Starting to give it some more thought in persuing JNCIE-SEC, one thing I saw on the blueprint is BGP, OSPF and some other routing stuff. My question is do I need to learn this at a JNCIE level or is JNCIS/JNCIP level fine? I've done all the formal training for SRX but never came across any routing modules.

1
5 comments
1
Archived

set (fastether-options | gigether-options) 802.3ad aex
set aggregated-devices ethernet device-count number

LACP link protection enables you to force active and standby links within an aggregated Ethernet.

interfaces interface-name aggregated-ether-options minimum-links number

set interfaces interface-name aggregated-ether-options lacp active
set interfaces interface-name aggregated-ether-options lacp periodic
set interfaces aeX aggregated-ether-options lacp system-priority

interfaces aex aggregated-ether-options load-balance adaptive

set forwarding-options hash-key faimly multisrvice source-mac destination-mac

1
comment
1
Archived

OSPF
set protocols ospf area 0.0.0.0 interface fe-0/0/1 bfd-liveness-detection minimum-interval 300
set protocols ospf area 0.0.0.0 interface fe-0/0/1 bfd-liveness-detection multiplier 4
set protocols ospf area 0.0.0.0 interface fe-0/0/1 bfd-liveness-detection full-neighbors-only

BGP
set logical-systems B protocols bgp group internal-peers bfd-liveness-detection minimum-interval 1000

ISIS
set protocols isis interface so-0/0/0 bfd-liveness-detection detection-time threshold 5
set protocols isis interface so-0/0/0 bfd-liveness-detection minimum-interval 2
set protocols isis interface so-0/0/0 bfd-liveness-detection minimum-receive-interval 1
set protocols isis interface so-0/0/0 bfd-liveness-detection no-adaptation
set protocols isis interface so-0/0/0 bfd-liveness-detection transmit-interval threshold 3
set protocols isis interface so-0/0/0 bfd-liveness-detection transmit-interval minimum-interval 1
set protocols isis interface so-0/0/0 bfd-liveness-detection multiplier 2
set protocols isis interface so-0/0/0 bfd-liveness-detection version automatic

1
comment
1
Archived

Routing Engine Redundancy:
set chassis redundancy failover on-disk-failure
set chassis redundancy failover on-loss-of-keepalives
To change the keepalive time period:
Set chassis redundancy keepalive-time
For a process failire failover:
set system processes process-name failover other-routing-engine
set system processes routing failover other-routing-engine

GRES:
Set chassis redundancy graceful-switchover
Set system commit synchronize
show system switchover

Nonstop bridging
set protocols layer2-control nonstop-bridging

Nonstop Routing
set routing-options nonstop-routing
Nonstop routing and graceful restart can not be configured at the same time.

Graceful Restart:
Gaceful restart is disabled by default.
set routing-options hierarchy graceful-restart

configure the duration of the graceful restart period:
set routing-options graceful-restart restart-duration

Helper mode is enabled by default. You can disable helper mode on a per-protocol basis.

set the length of time the router waits to receive messages from restarting neighbors:
set protocols bgp graceful-restart stale-routes-time

Restrict OSPF link-state advertisement (LSA) checking:
set protocols ospf graceful-restart no-strict-lsa-checking

To configure the delay between when the router discovers that a neighboring router has gone down:
set protocols rsvp graceful-restart maximum-helper-restart-time

For Layer 3 VPNs only, you must also configure graceful restart for all routing and MPLS:
set routing-instances instance-name routing-options graceful-restart

VRRP
To configure the startup period for VRRP operations, include the startup-silent-period
statement at the [edit protocols vrrp] hierarchy level:

To configure basic VRRP for IPv6 support, configure VRRP group support on interfaces
by including the vrrp-inet6-group statement:
vrrp-inet6-group group-id {
priority number;
virtual-inet6-address [ addresses ];
virtual-link-local-address ipv6-address;
}
authentication can be simple or md5.
To modify the time, in seconds, between the sending of VRRP advertisement packets,
include the advertise-interval statement

Passive ARP learning enables the ARP cache in the backup router to hold approximately
the same contents as the ARP cache in the master router, thus preventing the problem
of learning ARP entries in a burst. To enable passive ARP learning, include the
passive-learning statement at the [edit system arp] hierarchy level

1
comment
1
Archived

Fault detection and notification (provided by continuity check messages)
The target MAC address is learned by the continuity check protocol or linktrace protocol
Each maintenance domain is associated with a maintenance domain level from 0 through 7.
where outermost domains are assigned a higher level than the innermost domains.

maintenance domain, each service instance is called a maintenance association. A maintenance association ca nbe thought as a full mesh o fmaintenance endpoints (MEPs)
(MIPsonly respondto CFM messages

The continuity check protocol packets use the ethertype value 0x8902 and the multicast destination MAC address 01:80:c2:00:00:32.

show oam ethernet connectivity-fault-management

For AE interface

protocols {
oam {
ethernet {
link-fault-management {
interface ae0;
}
}
}
}

CCM handled by PPM/

[edit protocols oam]
ethernet {
connectivity-fault-management {
maintenance-domain customer {
level 7;
maintenance-association customer-site1 {
continuity-check {
interval 1s;
}
mep 800 {
interface ge-5/2/3.0;
direction down;
auto-discovery;
}
}
}
}
}

up—An UP MEP CCM is transmitted out of every logical interface which is part of the same bridging or vpls instance except for the interface configured on this MEP.

down—Down MEP CCMs are transmitted only out the interface configured on this MEP.

1
comment
2
Archived

Hello PDU
PSNP ack lsps and request missing LSP
CSNP send periodically
TLV inside PDU
DIS is highes mac, no backup DIS. Defaulty priority 64.
Default isis metric is 10.
Level 1 summarized and sent to level 2.
Level 1 routers use attached bit to get out of level 1.
ignore-attached-bit
wide-metric-onlu leaks l2 routes in to l1.
From level 2 to level 1 policy.
Level 1 external routes blocked from going to level 2
up/down bit to prevent loops.
lsp=lifetime
isis sfp-options
level authentication affects all PDUs
link authentication affects hello only
no-authentication-check
protocols isis interface xxx mesh-group 1
protocols isis interface xxx mesh-group to stop flooding of LSPs.
protocols isis csnp-interfal default 10
import policy not allowed.
prefix-export-limit.

2
comment
1
Archived

PIM-SM

Enable tunneling:
set chassis fpc 0 pic 0 tunnel-services bandwidth 1g # Or 10g.

Minimum setup:
set protocols pim interface all mode sparse
set protocols pim interface fxp0.0 disable
set protocols pim interface ge-0/0/0.0 neighbor-policy Allow-PIM-Neighbors
set policy-options policy-statement Allow-PIM-Neighbors term 10 from route-filter 10.0.20.0/24 orlonger
set policy-options policy-statement Allow-PIM-Neighbors term 10 then accept
set policy-options policy-statement Allow-PIM-Neighbors term 20 then reject

Static RP:
set protocols pim rp local address 30.0.10.1 # If this is the RP.
OR
set protocols pim rp static address 30.0.10.1 # If RP is remote.

Auto RP:
set protocols pim interface all mode sparse-dense
set protocols pim dense-groups 224.0.1.39/32
set protocols pim dense-groups 224.0.1.40/32
For the mapping agent and RP:
set protocols pim rp local address 30.0.10.1
For other PIM routers:
set protocols pim rp auto-rp discovery

BSR: Bootstrap router.
set protocols pim rp bootstrap-priority 150 # For BSRs.
set protocols pim rp local address 30.0.10.1 # For the RPs.
# Don't need any RP or BSR config anywhere else! It's all automatic in PIM.

IGMP:
set protocols igmp interface ge-0/0/0.0 version 3
set protocols igmp interface ge-0/0/0.0 group-policy Block-Premium-Channels
set policy-options policy-statement Block-Premium-Channels term 10 from route-filter 232.7.8.0/24 orlonger
set policy-options policy-statement Block-Premium-Channels term 10 from source-address-filter 10.0.75.1 exact
set policy-options policy-statement Block-Premium-Channels term 10 then reject
set policy-options policy-statement Block-Premium-Channels term 20 then accept

PIM policies:
set protocols pim import Good-Source-Groups
set protocols pim export Good-Source-Groups
set policy-options policy-statement Good-Source-Groups term Star-Group-Pairs from route-filter 227.7.0.0/16 orlonger
set policy-options policy-statement Good-Source-Groups term Star-Group-Pairs then accept
set policy-options policy-statement Good-Source-Groups term Source-Group-Pairs from route-filter 232.5.0.0/16 orlonger
set policy-options policy-statement Good-Source-Groups term Source-Group-Pairs from source-address-filter 10.0.20.2 exact
set policy-options policy-statement Good-Source-Groups term Source-Group-Pairs then accept
set policy-options policy-statement Good-Source-Groups term Reject-Other-Groups then reject

Anycast RP for PIM: Supports IPv4 and IPv6.
RP #1:
set interfaces lo0.0 family inet address 30.0.10.1 primary # Unique. Router-id.
set interfaces lo0.0 family inet address 35.0.10.50 # Anycast address.
set protocols pim rp local family inet address 35.0.10.50
set protocols pim rp local family inet anycast-pim rp-set address 30.0.10.2 # Peer's lo0 primary address.
set protocols pim rp local family inet anycast-pim local-address 30.0.10.1
RP #2:
set interfaces lo0.0 family inet address 30.0.10.2 primary
set interfaces lo0.0 family inet address 35.0.10.50
set protocols pim rp local family inet address 35.0.10.50
set protocols pim rp local family inet anycast-pim rp-set address 30.0.10.1
set protocols pim rp local family inet anycast-pim local-address 30.0.10.2
OR "family inet6" for IPv6.

Alternate multicast routing table:
If asked to change how multicast is forwarded or its knowledge of the shortest path, and if you can't create a static route, then you must use inet.2. Put your routes into inet.2, and then tell PIM to use inet.2.
Create a rib-group to copy ALL inet.0 routes to inet.2:
set routing-options rib-groups Copy-inet0-to-inet2 import-rib [ inet.0 inet.2 ]
set routing-options interface-routes rib-group inet Copy-inet0-to-inet2
set protocols (isis|ospf) rib-group Copy-inet0-to-inet2
set protocols bgp group Group-Name family inet rib-group Copy-inet0-to-inet2
Create a different rib-group pointing to inet.2 for reference by PIM:
set routing-options rib-groups Point-to-inet2 import-rib inet.2
set protocols pim rib-group inet Point-to-inet2


Multicast scoping

Named scoping:
set routing-options multicast scope FisherCo-MCast-Boundary prefix 239.0.0.0/10 # ONE prefix per boundary.
set routing-options multicast scope FisherCo-MCast-Boundary interface ge-0/0/0.0

Policy scoping:
set routing-options multicast scope-policy FisherCo-MCast-Boundary-Pol
set policy-options policy-statement FisherCo-MCast-Boundary-Pol term 10 from interface ge-0/0/0.0 set policy-options policy-statement FisherCo-MCast-Boundary-Pol term 10 from route-filter 239.0.0.0/10 orlonger
set policy-options policy-statement FisherCo-MCast-Boundary-Pol term 10 then reject


MSDP (IPv4 only)

set protocols msdp local-address 30.0.0.1
set protocols msdp group AS-1234 mode mesh-group
set protocols msdp group AS-1234 peer 40.0.0.1
set protocols msdp group AS-1234 peer 50.0.0.1 default-peer # Only do this on the closest RP to the default peer.

Policy:
set protocols msdp import MSDP-Protect # Or export. Can be on group or peer level instead.
set policy-options policy-statement MSDP-Protect term 10 from neighbor 40.0.0.1
set policy-options policy-statement MSDP-Protect term 10 from interface ge-0/0/0.0
set policy-options policy-statement MSDP-Protect term 10 from route-filter 224.7.6.5/32 exact
set policy-options policy-statement MSDP-Protect term 10 from source-address-filter 40.0.20.1 exact
set policy-options policy-statement MSDP-Protect term 10 then reject
set policy-options policy-statement MSDP-Protect term 20 then accept # Explicit acceptance required for MSDP policies.

Anycast RP for MSDP:
set interfaces lo0.0 family inet address 30.0.0.1 primary # Unique. Router-id.
set interfaces lo0.0 family inet address 35.0.0.1 # Anycast address.
set protocols pim rp local address 35.0.0.1
set protocols msdp group Anycast-Peers mode mesh-group
set protocols msdp group Anycast-Peers local-address 30.0.0.1
set protocols msdp group Anycast-Peers peer 30.0.0.2

1
comment
1
Archived

outing Policy

A neighbor policy cancels all group and global policies, and a group policy cancels all global policies.

IPv4: Import policies: Next-hop peer: set policy-options policy-statement Next-Hop-Peer then next-hop peer-address (helps if next hops are unreachable) Local preference: set policy-options policy-statement Local-Pref-200 term 1 from route-filter 1.2.3.0/24 exact set policy-options policy-statement Local-Pref-200 term 1 then local-preference 200 set policy-options policy-statement Local-Pref-200 term 1 then accept Export policies: Next-hop-self: set policy-options policy-statement Next-Hop-Self from protocol bgp set policy-options policy-statement Next-Hop-Self then next-hop self Import or export policies: AS-path prepend: set policy-options policy-statement Prepend-3x term 1 then as-path-prepend "1234 1234 1234" AS-path matching: set policy-options as-path Traversed-AS65432 ".* 65432 ." set policy-options policy-statement Filter-FisherCo-Private term 1 from as-path Traversed-AS65432 set policy-options policy-statement Filter-FisherCo-Private term 1 then reject AS-group matching: set policy-options as-path-group Long-List-of-Lameness as-path From-Invalid ". 56320-64511 ." set policy-options as-path-group Long-List-of-Lameness as-path WhateverCo ". 9999 ." set policy-options policy-statement Filter-Lame-Stuff term 1 from as-path-group Long-List-of-Lameness set policy-options policy-statement Filter-Lame-Stuff term 1 then reject set policy-options policy-statement Filter-Lame-Stuff term 1 then accept Communities: set policy-options community AS65432 members 65432:100 set policy-options community AS123xx members "123[0-9][0-9]:(10|15|20)" set policy-options community No-Export members no-export set policy-options community Wildcard members ":*" (all communities) (Master the character-based community regex operators.) set policy-options policy-statement AS65432-Replace term 1 then community set AS65432 set policy-options policy-statement AS65432-Import term 1 from protocol bgp set policy-options policy-statement AS65432-Import term 1 from as-path From-AS65432 set policy-options policy-statement AS65432-Import term 1 then community delete AS123xx set policy-options policy-statement AS65432-Import term 1 then community add AS65432 set policy-options policy-statement AS65432-Import term 1 then community add No-Export set policy-options policy-statement AS65432-Import term 1 then next policy set policy-options policy-statement AS65432-Import term 2 then community delete Wildcard Route manipulation without policies: set routing-instances L3VPN-Cust protocols bgp group AS65432-Peers neighbor 6.5.4.3 as-override set routing-instances L3VPN-Cust protocols bgp group AS65432-Peers neighbor 6.5.4.3 remove-private set protocols bgp group AS65432-Peers neighbor 6.5.4.3 metric-out set protocols bgp group AS65432-Peers neighbor 6.5.4.3 local-preference If IGP routes make BGP routes inactive: set protocols bgp group EBGP-Peers neighbor 1.2.3.4 advertise-inactive (or on a group or globally)

IPv6: Same as IPv4, but use IPv6 route-filters?

4-byte ASN: Instances: set routing-instances FisherCo-4B-VR route-distinguisher 7654321L Extended communities: set policy-options community FisherCo-4B-Comm members [ target:7654321L:100 ]

Load-balancing: set routing-options forwarding-table export Load-Balance-All set policy-options policy-statement Load-Balance-All then load-balance per-packet set forwarding-options hash-key family inet layer-3 set forwarding-options hash-key family inet layer-4

Remotely-triggered black holes: Trigger router: set routing-options static route 10.20.30.1/32 reject tag 888 set protocols bgp group IBGP-Peers export RTBH-Trigger set policy-options community RTBH members 100:888 set policy-options community No-Export members no-export set policy-options policy-statment RTBH-Trigger term 1 from protocol static set policy-options policy-statment RTBH-Trigger term 1 from tag 888 set policy-options policy-statment RTBH-Trigger term 1 then local-preference 200 set policy-options policy-statment RTBH-Trigger term 1 then community set RTBH set policy-options policy-statment RTBH-Trigger term 1 then community add No-Export set policy-options policy-statment RTBH-Trigger term 1 then accept Filtering routers (usually all ASBRs): set routing-options forwarding-table unicast-reverse-path feasible-paths set interfaces ge-0/0/0.0 family inet rpf-check set protocols bgp group IBGP-Peers import Black-Hole-Filter set policy-options as-path From-Our-AS "()" set policy-options community RTBH members 100:888 set policy-options policy-statement Black-Hole-Filter term 1 from protocol bgp set policy-options policy-statement Black-Hole-Filter term 1 from as-path From-Our-AS set policy-options policy-statement Black-Hole-Filter term 1 from community RTBH set policy-options policy-statement Black-Hole-Filter term 1 then next-hop discard


Implementation

IBGP: set routing-options autonomous-system 5678 set protocols bgp group IBGP-Peers type internal set protocols bgp group IBGP-Peers family inet unicast set protocols bgp group IBGP-Peers local-address 5.6.7.1 set protocols bgp group IBGP-Peers neighbor 5.6.7.8 set protocols bgp group IBGP-Peers-V6 type internal set protocols bgp group IBGP-Peers-V6 family inet6 unicast set protocols bgp group IBGP-Peers local-address 2005:6:7::1 set protocols bgp group IBGP-Peers-V6 neighbor 2005:6:7::8 or: set protocols bgp group IBGP-Peers-V4-Plus-V6 type internal set protocols bgp group IBGP-Peers-V4-Plus-V6 family inet unicast set protocols bgp group IBGP-Peers-V4-Plus-V6 family inet6 unicast set protocols bgp group IBGP-Peers-V4-Plus-V6 neighbor 5.6.7.8

EBGP: set routing-options autonomous-system 5678 set protocols bgp group EBGP-Peers type external set protocols bgp group EBGP-Peers family inet unicast set protocols bgp group EBGP-Peers neighbor 1.2.3.4 peer-as 1234 set protocols bgp group EBGP-Peers-V6 type external set protocols bgp group EBGP-Peers-V6 family inet6 unicast set protocols bgp group EBGP-Peers-V6 neighbor 2001:2:3::4 peer-as 1234 or: set protocols bgp group EBGP-Peers-V4-V6 type external set protocols bgp group EBGP-Peers-V4-V6 peer-as 1234 set protocols bgp group EBGP-Peers-V4-V6 family inet unicast set protocols bgp group EBGP-Peers-V4-V6 family inet6 unicast set protocols bgp group EBGP-Peers-V4-V6 neighbor 1.2.3.4 Be careful. This config changes the IPv6 next-hop to a v4-compatible v6 address. If you aren't using v4-compatible v6 addresses, then the workarounds include: 1. set protocols bgp group EBGP-Peers-V4-V6 accept-remote-nexthop (now the routes are accepted but are "hidden") To make the routes active and not hidden: (b is preferred) a. set protocols bgp group EBGP-Peers-V4-V6 multipath set routing-options rib inet6.0 static route ::ffff:1.2.3.4 next-hop 2002::5 (the peer's interface v6 address) b. set protocols bgp group EBGP-Peers-V4-V6 import FixNextHop set policy-options policy-statement FixNextHop from protocol bgp set policy-options policy-statement FixNextHop from rib inet6.0 set policy-options policy-statement FixNextHop from next-hop ::ffff:1.2.3.4 set policy-options policy-statement FixNextHop then next-hop 2002::5

IPv4 peering communities: ???

IPv6 peering communities: ???

IPv6 tunneling: See VPNs - Layer-3 VPNs - 6PE.

Authentication: set protocols bgp authentication-algorithm md5 set protocols bgp authentication-key-chain My-BGP-Keys set security authentication-key-chains key-chain My-BGP-Keys key 1 secret Blah # Doesn't exist in Junosphere? set security authentication-key-chains key-chain My-BGP-Keys key 1 start-time 2012-09-21.10:11:00 or: set protocols bgp authentication-key Blah (or under group or neighbor)

4-byte ASN: set routing-options autonomous-system 1234.5678 set protocols bgp group EBGP-Peers neighbor 12.34.56.78 peer-as 1234.5678

BFD: set protocols bgp group EBGP-Peers neighbor 1.2.3.4 bfd-liveness-detection minimum-interval 300 or set it on a group. or set it globally.

Per-prefix load-balancing: set protocols bgp group EBGP-Peers neighbor 1.2.3.4 multipath (IBGP does load-balancing by default if 2+ prefixes from same peer, and if IGP ECMP exists to that peer.) (Also see per-flow load-balancing under routing policy.)


Scaling

IPv4 route reflection: set protocols bgp group Cluster-9876 cluster 9.8.7.6 (any 4-octet number)

IPv6 route reflection: set protocols bgp group Cluster-9876 cluster 9.8.7.6 (any 4-octet number)

VPN route reflection: set protocols bgp group Cluster-9876 family inet-vpn unicast set protocols bgp group Cluster-9876 cluster 9.8.7.6 (any 4-octet number)

Route resolution in inet.3: The most specific BGP route is chosen, whether it's in inet.0 or inet.3, and inet.3 wins in a tie. To reflect a route that requires inet.3 resolution, you have several options: 1. Create LSPs from the RRs to each PE router; OR 2. Create a static default route in inet.3 on the RRs: set routing-options rib inet.3 static route 0.0.0.0/0 discard

Route resolution in inet6.3: The most specific BGP route is chosen, whether it's in inet.0 or inet.3, and inet.3 wins in a tie. To reflect a route that requires inet.3 resolution, you have several options: 1. Create LSPs from the RRs to each PE router; OR 2. Create a static default route in inet6.3 on the RRs: set routing-options rib inet6.3 static route ::/0 discard

Confederations: (NOT listed in the exam topics on the website.) All routers: set routing-options autonomous-system 65001 set routing-options confederation 1234 members [ 65001 65002 65003 ] Confederation border routers: set protocols bgp groups EBGP-Confed-Peers type external set protocols bgp groups EBGP-Confed-Peers export Next-Hop-Self set protocols bgp groups EBGP-Confed-Peers multihop set protocols bgp groups EBGP-Confed-Peers peer-as 65002 set protocols bgp groups EBGP-Confed-Peers local-address 10.0.0.1 set protocols bgp groups EBGP-Confed-Peers neighbor 10.0.20.1

1
comment
1
Archived

show route aspath-regex (regex)

Practice using SecureCRT, not Putty.

BGP default policies: Import: Accept all routes if BGP can resolve their BGP next-hops. Export: Advertise the best active BGP routes. (If an IGP shadows the BGP route, it will be inactive and not advertised.)

For hidden BGP routes: Routes are hidden because their next hops can't be resolved or due to policy filtering. show route hidden show route resolution unresolved (unresolvable routes only)

Remember to set next-hop self when importing routes from EBGP neighbors. Don't do this for any other reason, not even at route reflectors.

set protocols bgp traceoptions file BGP-Trace.log set protocols bgp traceoptions flag update detail

BGP troubleshooting: Avoid troubleshooting if at all possible. Make sure BGP sessions are established. Ensure needed protocol families are configured under BGP AND negotiated. Check if routes are advertised and received. Look for unresolved routes. Verify routes are in the routing tables. Use specific show commands with filters. Use traceoptions only for difficult problems. If you get stuck on something unfamiliar, consider moving on and coming back to it later.

1
comment
1
Archived

Idle Connect ACtive OpenSent OpenCOnfirm Established

Open Message used to negotiate parameters. Update message used to send withdraw routing inforamation. Notification message send when there is an error. Keepaliv message.

Adjacency-RIB-In, Local-RIB, Adjacency-RIB-Out.

Next hop, local preference, as path, origin, MED, EBGP over IBGP, IGP, Cluster, Router ID, Peer address.

Well known mandatory next hop. Only changed across EBGP. AS path. Origin. (IGP, EGP, ?).

Well known discretionary: local preference, highest wins and is local to AS. Not adv to ebgp. Atomic aggregate. A agregate route was selected over a more specfic route. Attribs might be missing.

Optional non-transitive: MED, only compared on routes from the same AS. Lower MED preferred. Stays in the AS not advertised via EBGP. Originator ID. Local to the AS. COntains the RID of the router that addouned the route to the first route reflector. Cluster list. Local to the AS. RR assign 32 bit value and prepends to cluster list. Multiprotocol NLRI.

Optional transative: Community. Associate routes together. No-export, no-advertise, no-export-subconfed. Agregrator. Must traverse al AS boundarys. Alert other rotuers where route aggregation occured. Extended community.

Local address of loopback for IBGP.

NExt-hop self.

Multipath command. Multihop. Passive. Allow. Prefix-limit teardown idle-timeout.

Route damping: show route daming decayed detail

Policy options damping as import.

Policy the orgin egp

protocols bgp group x remove-private\ protocols bgp group x local-as 1111 protocols bgp group x local-as 1111 private to removed old as info from path atrrib. protocols bgp group x as-override set routing-options autonomous-system 65010 loops 2

policy-options as-path-prepend policy-options from as-path 6500 then as-path-expand last-as count 3 as-path 6500 ".* 6500 .*"

protocols bgp path-selection always-compare-med protocols bgp path-selection cisco-non-determenistic

groups external metric-out 20 metric-out igp assigns the igp cost of route as MED cost. Changes cost when metric changes. metric-out minimum-igp only changes cost when RPD restarts. policy-options then metric 20 policy-options then metric igp policy-options then metric minimum-igp

neighbor local-preference 50 policy-options then local-preference 50

RR and clients is a cluster. Cluster ID used to identify each cluster. Cluster lists each sequential cluster id that a route has transited. originator id identifies the router that first advertised the route to the RR.

Group c cluster 1.1.1.1

Confederation-bgp peering routing-options confederation 1111 memebers 64555 6477 group cbgp type external local-addres

protocols bgp log-updown

hold-time

1
comment
1
Archived

Neighbor establishment:
Mismatched area IDs for a level-1 adjacency.
Incorrect IP addresses.
One in broadcast mode, one in point-to-point mode.
Family ISO missing from interfaces.
Interfaces down.
Interface is passive, has wrong level, or is disabled.
Family ISO MTU must be >1492.
So physical MTU must be 1506 or higher?
MTU mismatch:
Not really a problem for IS-IS?
Physical - 14 = inet or inet6 MTU.
1514 is default GE MTU.
Router IDs:
Duplicate system IDs.
Authentication:
Bad hello authentication config.

Routing loops:
Use traceroute to diagnose.
Usually happens at redistribution points.

Summarization:
Incorrect criteria: from protocol, from level, to level
Incorrect actions: reject instead of accept

1
comment
1
Archived

Configuration:
set interfaces lo0.0 family iso address 49.0001.1921.6801.2001.00
set protocols isis reference-bandwidth 100g
set protocols isis interface ge-0/1/2.0
set protocols isis interface ge-1/2/3.0 level 2 disable
set interfaces ge-0/1/2.0 family iso
or: set groups Family-ISO interfaces <ge-*> unit 0 family iso
set groups Family-ISO interfaces <ae*> unit 0 family iso
set interfaces apply-groups Family-ISO

Router advertisement:
set protocols isis interface ge-0/1/2.0 priority 0 (don't become DIS)
or: set protocols isis interface ge-0/1/2.0 point-to-point (removes DIS)

Routing policy:
set protocols isis export [ Level2-Leak Level1-Leak-Aggr-20 Level1-Leak-Exact-20 Export-Direct Export-Static ]
set policy-options policy-statement Level2-Leak term 1 from route-filter 1.2.3.4/32 exact
set policy-options policy-statement Level2-Leak term 1 from level 2
set policy-options policy-statement Level2-Leak term 1 to level 1
set policy-options policy-statement Level2-Leak term 1 then tag 1234
set policy-options policy-statement Level2-Leak term 1 then accept
set policy-options policy-statement Level1-Leak-Primary-20 term 1 from route-filter 20.20.20.0/24 exact
set policy-options policy-statement Level1-Leak-Primary-20 term 1 from level 1
set policy-options policy-statement Level1-Leak-Primary-20 term 1 to level 2
set policy-options policy-statement Level1-Leak-Primary-20 term 1 then tag 20
set policy-options policy-statement Level1-Leak-Primary-20 term 1 then accept
set policy-options policy-statement Level1-Leak-Backup-20 term 1 from route-filter 20.20.20.1/32 exact
set policy-options policy-statement Level1-Leak-Backup-20 term 1 from level 1
set policy-options policy-statement Level1-Leak-Backup-20 term 1 to level 2
set policy-options policy-statement Level1-Leak-Backup-20 term 1 then tag 21
set policy-options policy-statement Level1-Leak-Backup-20 term 1 then accept
(By default, IS-IS doesn't leak level 1 external routes (20.20.20.0/24) into level 2 unless wide metrics are used.)

IPv4 and IPv6 support:
This is built in.

BFD:
set protocols isis interface ge-0/1/2.0 bfd-liveness-detection minimum-interval 300

Load balancing:
set routing-options forwarding-table export Load-Balance-All
set policy-options policy-statement Load-Balance-All then load-balance per-packet

Optimize timers:
set protocols isis interface ge-0/1/2.0 level 2 hello-interval 2
set protocols isis interface ge-0/1/2.0 level 2 hold-time 8
(DRs are set to one-third of these configured values.)

CSPF support:
This is built in.

Authentication:
set protocols isis level 2 authentication-type md5
set protocols isis level 2 authentication-key Blah
set protocols isis interface ge-0/1/2.0 level 2 hello-authentication-type md5
set protocols isis interface ge-0/1/2.0 level 2 hello-authentication-key Blah

Metrics:
set protocols isis level 2 narrow-metrics-only (default)
set protocols isis level 2 wide-metrics-only

Overload:
set protocols isis overload timeout 60 (for 60m after a reboot)

1
comment
1
Archived

FXP0 does not provide routing capabilities.

FXP1 connects PFE to RE.

preferred address.

MTU does not include CRC.

if no mask then /32 assumed.

static route with remote IP using the resolve option.

default-static aggregate active if contributing route present.

interface-specific.

authentication-order

radius port 1812.

radius-server

rpf-check under interface.

reverse-path feasible-paths. under routing options

source-filtering for mac address.

system login announcement.

allow-commands "(ping) | (traceroute)" system login retry-options system syslog file All_except_ntp ntp none system syslog source-address system syslog time-format

annotate system

commit script work on the config upon commit. file copy CS_Example.xls /var/db/scripts/commit/ set system scripts commit file CS_Example.xls

OP script file copy OP_Example.xls /var/db/scripts/op/ set system scripts op file OP_Example.xls

from operational do "op OP_Example"

Event Scripts file copy EV_Example.xls /var/db/scripts/event/ set event-options event-script file EV_Example.xls

groups for GRES. system backup-router

chassis redundancy graceful-switchover chassis redundancy failover on-loss-of-keep-alives system process routing failover alternate-media routing-options nonstop-routing routing-options graceful-restart

interfaces xxx vrrp-group 1 virtual-address vrrp-group 1 preempt vrrp-group 1 priority vrrp-group 1 virtual-address fast-interval track interface xxx priority-cost 250

[edit system ntp] server address <key key-number> <version value> <prefer>; authentication-key key-number type type value password; boot-server address; trusted-key [ key-numbers ];

set system archival configuration transfer-on-commit archive-sites "ftp://lab@10.10.1.100" password lab123

To configure the remote template account, include the user remote statement at the [edit system login] hierarchy level and specify the privileges you want to grant to remote users:

BFD port is UDP 3794, rip UDP, LDP both TCP and UDP port, msdp TCP port. NTP is UDP. SNMP is UDP. Radius UDP. DNS is UDP from port domain. FTP is TCP from port ftp and ftp-data. Traceroute UDP ports 33434 and 33534.

set policy-options prefix-list bgp apply-path "protocols bgp group <> neighbor <>"

file copy ftp://lab:lab123@ip server address/path/file /destination/var/db/scripts/commit/

1
1 comment
1
Archived

OSPF notes Day 1

24 octect header version, type, checksum, authentication, auth type, Router ID, Area ID, packet length.

Hello Packet mask, hello interval, options, router priority, dead interval*, DR, BDR, neighbours

Database Description MTU, options, flags, Bit 2, The I bit determines the first packet. Bit 1, The M bit determines the last packet. Bit 0, The M/S bit. Master is bit 1. Slave is bit 0. DD sequence number, LSA headers.

Link State Request LSA type, link state ID, Advertising router.

Link state update number of LSAs, LSA advertisements.

Link state ack LSA headers.

Down - no ospf Init - received hello Attempt - only for NBMA, router will send hello 2 way - hello received with own router ID Exstart - Master/Slave chosen Exchange - DD are sent Loading - if missing LSA then LSR sent Full - OSPF adj up

Designated Router 224.0.0.6, type 2 LSA Router Priority then Router ID

Wait time 40 seconds before the DR is elected so all routers have a chance. Non deterministic(if DR goes down it does not necessarily become DR again).

Summary LSA, Type 3 Matches a single router LSA.

External LSA, Type 5 Domain wide flooding ABR creates a type 4 LSA for each type 5.

Stub Area ABR enforces stub type 3 summary LSA injected to stub

Totally stubby only one default type 3 LSA injected.

Not So Stubby Type 7 LSA for external routes ABR converts to typr 5 LSA and floods.

"clear ospf database purge" set all LSA to 3600 MaxAge timer and flood.

Intra-area then inter-area then external

Junos allows to restrict type 3 LSAs in NSSA using no-summaries

prefix-export-limit to limit number external prfixes allowed

set reference bandwidth

Common LSA header: Link state age, LSA type, Link state ID, Advertising router, Link state, Checksum, lenght

Router LSA: V, E, B, # of links, metric,

show ospf database router area 0 external asterisk is for LSA sent by local router

The act of turning the type 7 to a type 5 makes it a ASBR.

Router build tuples for spf.

link state database: contains tuples candidate database:cost from root to neighbot tree database:contains shortest path

Restart candidate, possible helper, helper. Type 9 LSA. disable helper-disable.

An ABR does not make a type 3 LSA from another type 3 LSA.

no-summariesto convert to tottaly stubby area-range

refresh LSA every 50 minutes

Type 7 to type 5 dony by ABR with highest router ID.

database-protection warning only spf options delay overload restrict

type 1 increases the metic based on the cost to the adverting router type 2 default.

1
1 comment
1
Archived

set logical-systems r1 interfaces lt-1/2/0 unit 1 encapsulation ethernet
set logical-systems r1 interfaces lt-1/2/0 unit 1 peer-unit 2
set logical-systems r1 interfaces lt-1/2/0 unit 1 family inet address 10.0.5.1/24
set logical-systems r1 interfaces lt-1/2/0 unit 3 encapsulation ethernet
set logical-systems r1 interfaces lt-1/2/0 unit 3 peer-unit 4
set logical-systems r1 interfaces lt-1/2/0 unit 3 family inet address 10.0.4.5/30
set logical-systems r1 interfaces lt-1/2/0 unit 5 encapsulation ethernet
set logical-systems r1 interfaces lt-1/2/0 unit 5 peer-unit 6
set logical-systems r1 interfaces lt-1/2/0 unit 5 family inet address 10.0.4.14/30
set logical-systems r1 interfaces lo0 unit 1 family inet address 10.0.6.1/32
set logical-systems r2 interfaces lt-1/2/0 unit 2 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 2 peer-unit 1
set logical-systems r2 interfaces lt-1/2/0 unit 2 family inet address 10.0.5.2/24
set logical-systems r2 interfaces lt-1/2/0 unit 4 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 4 peer-unit 3
set logical-systems r2 interfaces lt-1/2/0 unit 4 family inet address 10.0.4.6/30
set logical-systems r2 interfaces lt-1/2/0 unit 9 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 9 peer-unit 10
set logical-systems r2 interfaces lt-1/2/0 unit 9 family inet address 10.0.4.2/30
set logical-systems r2 interfaces lt-1/2/0 unit 11 encapsulation ethernet
set logical-systems r2 interfaces lt-1/2/0 unit 11 peer-unit 12
set logical-systems r2 interfaces lt-1/2/0 unit 11 family inet address 10.0.4.10/30
set logical-systems r2 interfaces lo0 unit 2 family inet address 10.0.6.2/32
set logical-systems r3 interfaces lt-1/2/0 unit 6 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 6 peer-unit 5
set logical-systems r3 interfaces lt-1/2/0 unit 6 family inet address 10.0.4.13/30
set logical-systems r3 interfaces lt-1/2/0 unit 10 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 10 peer-unit 9
set logical-systems r3 interfaces lt-1/2/0 unit 10 family inet address 10.0.4.1/30
set logical-systems r3 interfaces lt-1/2/0 unit 14 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 14 peer-unit 13
set logical-systems r3 interfaces lt-1/2/0 unit 14 family inet address 10.0.2.5/30
set logical-systems r3 interfaces lt-1/2/0 unit 15 encapsulation ethernet
set logical-systems r3 interfaces lt-1/2/0 unit 15 peer-unit 16
set logical-systems r3 interfaces lt-1/2/0 unit 15 family inet address 10.0.2.2/30
set logical-systems r3 interfaces lo0 unit 3 family inet address 10.0.3.3/32
set logical-systems r4 interfaces lt-1/2/0 unit 12 encapsulation ethernet
set logical-systems r4 interfaces lt-1/2/0 unit 12 peer-unit 11
set logical-systems r4 interfaces lt-1/2/0 unit 12 family inet address 10.0.4.9/30
set logical-systems r4 interfaces lt-1/2/0 unit 13 encapsulation ethernet
set logical-systems r4 interfaces lt-1/2/0 unit 13 peer-unit 14
set logical-systems r4 interfaces lt-1/2/0 unit 13 family inet address 10.0.2.6/30
set logical-systems r4 interfaces lt-1/2/0 unit 17 encapsulation ethernet
set logical-systems r4 interfaces lt-1/2/0 unit 17 peer-unit 18
set logical-systems r4 interfaces lt-1/2/0 unit 17 family inet address 10.0.2.10/30
set logical-systems r4 interfaces lo0 unit 4 family inet address 10.0.3.4/32
set logical-systems r5 interfaces lt-1/2/0 unit 16 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 16 peer-unit 15
set logical-systems r5 interfaces lt-1/2/0 unit 16 family inet address 10.0.2.1/30
set logical-systems r5 interfaces lt-1/2/0 unit 18 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 18 peer-unit 17
set logical-systems r5 interfaces lt-1/2/0 unit 18 family inet address 10.0.2.9/30
set logical-systems r5 interfaces lt-1/2/0 unit 19 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 19 peer-unit 20
set logical-systems r5 interfaces lt-1/2/0 unit 19 family inet address 10.0.8.6/30
set logical-systems r5 interfaces lt-1/2/0 unit 21 encapsulation ethernet
set logical-systems r5 interfaces lt-1/2/0 unit 21 peer-unit 22
set logical-systems r5 interfaces lt-1/2/0 unit 21 family inet address 10.0.8.9/30
set logical-systems r5 interfaces lo0 unit 5 family inet address 10.0.3.5/32
set logical-systems r6 interfaces lt-1/2/0 unit 20 encapsulation ethernet
set logical-systems r6 interfaces lt-1/2/0 unit 20 peer-unit 19
set logical-systems r6 interfaces lt-1/2/0 unit 20 family inet address 10.0.8.5/30
set logical-systems r6 interfaces lt-1/2/0 unit 23 encapsulation ethernet
set logical-systems r6 interfaces lt-1/2/0 unit 23 peer-unit 24
set logical-systems r6 interfaces lt-1/2/0 unit 23 family inet address 10.0.8.1/30
set logical-systems r6 interfaces lt-1/2/0 unit 25 encapsulation ethernet
set logical-systems r6 interfaces lt-1/2/0 unit 25 peer-unit 26
set logical-systems r6 interfaces lt-1/2/0 unit 25 family inet address 172.16.40.2/30
set logical-systems r6 interfaces lo0 unit 6 family inet address 10.0.9.6/32
set logical-systems r7 interfaces lt-1/2/0 unit 22 encapsulation ethernet
set logical-systems r7 interfaces lt-1/2/0 unit 22 peer-unit 21
set logical-systems r7 interfaces lt-1/2/0 unit 22 family inet address 10.0.8.10/30
set logical-systems r7 interfaces lt-1/2/0 unit 24 encapsulation ethernet
set logical-systems r7 interfaces lt-1/2/0 unit 24 peer-unit 23
set logical-systems r7 interfaces lt-1/2/0 unit 24 family inet address 10.0.8.2/30
set logical-systems r7 interfaces lt-1/2/0 unit 27 encapsulation ethernet
set logical-systems r7 interfaces lt-1/2/0 unit 27 peer-unit 28
set logical-systems r7 interfaces lt-1/2/0 unit 27 family inet address 172.16.40.6/30
set logical-systems r7 interfaces lo0 unit 7 family inet address 10.0.9.7/32
set logical-systems rip interfaces lt-1/2/0 unit 26 encapsulation ethernet
set logical-systems rip interfaces lt-1/2/0 unit 26 peer-unit 25
set logical-systems rip interfaces lt-1/2/0 unit 26 family inet address 172.16.40.1/30
set logical-systems rip interfaces lt-1/2/0 unit 28 encapsulation ethernet
set logical-systems rip interfaces lt-1/2/0 unit 28 peer-unit 27
set logical-systems rip interfaces lt-1/2/0 unit 28 family inet address 172.16.40.5/30
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.0.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.1.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.2.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.3.1/32
set logical-systems rip interfaces lo0 unit 8 family inet address 192.168.4.1/32
set logical-systems rip policy-options policy-statement rip term 1 from protocol static
set logical-systems rip policy-options policy-statement rip term 1 from protocol rip
set logical-systems rip policy-options policy-statement rip term 1 then accept
set logical-systems rip routing-options static route 192.168.0.0/24 receive
set logical-systems rip routing-options static route 192.168.1.0/24 receive
set logical-systems rip routing-options static route 192.168.2.0/24 receive
set logical-systems rip routing-options static route 192.168.3.0/24 receive
set logical-systems rip routing-options static route 192.168.4.0/24 receive

1
comment
1
Archived

Neighbor establishment:
Use: monitor traffic interface ge-??? detail no-resolve
If using traceoptions, activate "hello detail" and "error detail" flags.
Duplicate router IDs.
Incorrect IP addresses or mismatched subnets.
One in broadcast mode, one in point-to-point mode.
Priority 0 on both sides.
Interfaces are down.
MTU mismatch:
Watch for one neighbor in Exchange, one in ExStart.
Physical - 14 = inet or inet6 MTU.
1514 is default GE MTU.
Authentication:
Bad authentication config.
Router IDs:
Mismatched area types or IDs.
IGP timers:
Mismatched hello or dead intervals.
Overloaded:
Can be triggered by bouncing the protocol or prefix-export-limit being exceeded.

Routing loops:
Use traceroute to diagnose.
Usually happens at redistribution points.

Summarization:
Incorrect criteria: from protocol
Incorrect actions: reject instead of accept
area-range: Put under "area" for type-1 or -2 LSAs or under "nssa" for type-7 LSAs.

1
2 comments
1
Archived

Here is to a great start on the JNCIE and may we complete it together. Please use this sub for questions, notes, lab suggestions any anything else related to the JNCIE-SP.

Have a good 2015 Luis, Gerald. We will soon travel to Netherlands to complete this.

1
comment
Community Details

154

Subscribers

4

Online

A place to talk about the JNCIE level certifications.

Create Post
r/JNCIE Rules
1.
Rule #1: No Home Networking.
2.
Rule #2: No Certification Brain Dumps / Cheating.
3.
Rule #3: No BlogSpam / Traffic re-direction.
4.
Rule #4: No Low Quality Posts.
Cookies help us deliver our Services. By using our Services or clicking I agree, you agree to our use of cookies. Learn More.