Press J to jump to the feed. Press question mark to learn the rest of the keyboard shortcuts
52
Posted byMeow 馃悎馃悎Meow 馃惐馃惐 Meow Meow馃嵑馃悎馃惐Meow A+!1 year ago
Archived

The Other Side of the Coin

Cisco is great! But let's shake things up a bit by seeing how the other side of the fence does things. Today we'll be playing with some Juniper vMX routers and seeing how they work with a Cisco.

In the Beginning

When you first console into a Juniper router you'll have to sign in with root, you'll then be kicked to the FreeBSD shell until you type cli to get into Juniper land.

root@:~ # cli

root>

We'll end up in Juniper's version of the privileged exec mode, here you can run show commands and the like. To configure things we type configure

root> configure 
Entering configuration mode

[edit]

To make some changes we'll set the hostname, domain-name, and the set the root account password (that one is mandatory)

root# set system host-name VMX01 

root@VMX01# set system domain-name testlab.com          

[edit]


[edit]
root# set system root-authentication plain-text-password 
New password:
Retype new password:

[edit]

Commits

Unlike (most) Cisco devices, changes don't take affect until you commit the configuration, this lets you setup plenty of things on the router before they kick in which can be handy if you are doing destructive things like changing WAN IP addresses or making a ACL.

root# commit 
commit complete


root@VMX01# set system host-name CAT 

[edit]
root@VMX01# commit 
commit complete

[edit]
root@CAT# 

We can also undo the change we did by using the rollback command. We can also abort our existing changes by doing rollback 0. Juniper will allow you to revert to plenty of saved configurations if needed.

[edit]
root@CAT# rollback 1 
load complete

[edit]
root@CAT# commit 
commit complete

[edit]
root@VMX01# 

If you forget what is in a particular change you can see the differences.

root@VMX01# show | compare rollback 1 
[edit system]
-  host-name MEOWCAT;
+  host-name VMX01;

[edit]

Juniper also allows you to revert a change after a period of time in case your ACL ends up kicking you out of the router.

[edit]
root@VMX01# set system host-name MEOWCAT 

[edit]
root@VMX01# commit confirmed 1 
commit confirmed will be automatically rolled back in 1 minutes unless confirmed
commit complete

# commit confirmed will be rolled back in 1 minute
[edit]
                                                                               
Broadcast Message from root@VMX01                                              
        (no tty) at 2:20 UTC...                                                
                                                                               
Commit was not confirmed; automatic rollback complete.                                                                               


[edit]
root@VMX01# 

Interfaces

The Cisco equivalent of show ip int br is show interfaces terse, we can use the pipe command to filter output just like we can in Cisco. One thing you might notice is that Juniper doesn't support shortened commands, instead it automatically tries to expand the full command for you, also the Juniper version of the do command is run

root@VMX01# run show interfaces terse | match ge 
ge-0/0/0                up    up
ge-0/0/1                up    up
ge-0/0/2                up    up
ge-0/0/3                up    up
ge-0/0/4                up    up
ge-0/0/5                up    up
ge-0/0/6                up    up
ge-0/0/7                up    up
ge-0/0/8                up    up
ge-0/0/9                up    up

Unlike in Cisco where you would only use a subinterface if you are trying to do something like router on a stick...In Juniper Land every interface is a subinterface called a unit. If we are not trying to use vlans then we would use unit 0 which we can shorten to .0 after the interface. We also have to tell Juniper the interface what family it is in so for now it would be inet for ipv4 and inet6 for ipv6. It also supports prefix lengths for masks!

root@VMX01# set interfaces ge-0/0/0 unit 0 family inet address 10.0.101.254/24    

[edit]
root@VMX01# set interfaces ge-0/0/1.0 family inet address 10.0.102.254/24    

[edit]
root@VMX01# set interfaces ge-0/0/2.0 family inet address 10.0.103.254/24    

[edit]
root@VMX01# set interfaces ge-0/0/3.0 family inet address 10.1.2.1/24 

[edit]
root@VMX01# commit 
commit complete

Now we can see the IPs on the interface, note the pipe supports regex like Cisco.

root@VMX01# run show interfaces terse | match ge.*inet   
ge-0/0/0.0              up    up   inet     10.0.101.254/24 
ge-0/0/1.0              up    up   inet     10.0.102.254/24 
ge-0/0/2.0              up    up   inet     10.0.103.254/24 
ge-0/0/3.0              up    up   inet     10.1.2.1/24     

[edit]

Juniper takes a lot of IPv6 philosophy to heart, one of the consequences of that is you can add as many IP addresses on an interface as you want though only the first address it the primary one.

root@VMX01# set interfaces ge-0/0/0.0 family inet address 10.2.101.254/24 

[edit]
root@VMX01# set interfaces ge-0/0/0.0 family inet address 10.3.101.254/24    

[edit]
root@VMX01# set interfaces ge-0/0/0.0 family inet address 10.4.101.254/24    

[edit]
root@VMX01# set interfaces ge-0/0/0.0 family inet address 10.5.101.254/24    

[edit]
root@VMX01# set interfaces ge-0/0/0.0 family inet address 10.6.101.254/24    

[edit]
root@VMX01# commit 
commit complete

                                        
[edit]
root@VMX01# run show interfaces ge-0/0/0.0 terse 
Interface               Admin Link Proto    Local                 Remote
ge-0/0/0.0              up    up   inet     10.0.101.254/24 
                                            10.2.101.254/24 
                                            10.3.101.254/24 
                                            10.4.101.254/24 
                                            10.5.101.254/24 
                                            10.6.101.254/24

Hierarchy

Juniper tries to organize its configuration sections in a logical manner so all interface configuration will tend to be under the interface section or all your route-map stuff will be under policy-options.

root@VMX01# set ?   
Possible completions:
> access               Network access configuration
> access-profile       Access profile for this instance
> accounting-options   Accounting data configuration
> applications         Define applications by protocol characteristics
+ apply-groups         Groups from which to inherit configuration data
> bridge-domains       Bridge domain configuration
> chassis              Chassis configuration
> class-of-service     Class-of-service configuration
> diameter             Diameter protocol layer
> dynamic-profiles     Dynamic profiles configuration
> event-options        Event processing configuration
> fabric               Fabric configuration
> firewall             Define a firewall configuration
> forwarding-options   Configure options to control packet forwarding
> groups               Configuration groups
> interfaces           Interface configuration
> jsrc                 JSRC partition configuration
> jsrc-partition       JSRC partition configuration
> logical-systems      Logical systems
> multi-chassis        
> multicast-snooping-options  Multicast snooping option configuration
> poe                  Power over Ethernet options
> policy-options       Policy option configuration
> protocols            Routing protocol configuration
> routing-instances    Routing instance configuration
> routing-options      Protocol-independent routing option configuration
> security             Security configuration
> services             Service PIC applications settings
> session-limit-group  
> snmp                 Simple Network Management Protocol configuration
> switch-options       Options for default routing-instance of type virtual-switch
> system               System parameters
> unified-edge         Unified edge configuration
> virtual-chassis      Virtual chassis configuration
> vmhost               VM Host configurations

The protocol section will hold all the well....protocols that the box can run including routing protocols or the FHRPs.

root@VMX01# set protocols ?
Possible completions:
> amt                  AMT configuration
> ancp                 Access Node Control Protocol options
+ apply-groups         Groups from which to inherit configuration data
+ apply-groups-except  Don't inherit configuration data from these groups
> bfd                  Bidirectional Forwarding Detection (BFD) options
> bgp                  BGP options
> connections          Circuit cross-connect configuration
> dcbx                 
> dot1x                802.1X options
> esis                 End system-intermediate system options
> evpn                 Configuration EVPN default routing instance
> iccp                 ICCP options
> igmp                 IGMP options
> igmp-snooping        IGMP snooping configuration
> ilmi                 Interim Local Management Interface Protocol configuration
> isis                 IS-IS options
> l2-learning          Layer 2 forwarding configuration
> l2circuit            Configuration for Layer 2 circuits over MPLS
> l2iw                 Configuration for Layer 2 interworking
> lacp                 Link Aggregation Control Protocol configuration
> layer2-control       Global options for layer 2 protocols
> ldp                  LDP options
> link-management      LMP options      
> lldp                 Link Layer Detection Protocol
> lldp-med             LLDP Media Endpoint Discovery
> loop-detect          Layer2 Loop Detect on interface with non-IP L2 Multicast mac as destination mac
> mld                  MLD options
> mld-snooping         MLD snooping configuration
> mpls                 Multiprotocol Label Switching options
> msdp                 MSDP configuration
> mstp                 Multiple Spanning Tree Protocol options
> mvpn                 BGP-MVPN configuration
> mvrp                 MVRP configuration
> neighbor-discovery   IPv6 neighbor discovery
> oam                  Operation, Administration, and Management configuration
> openflow             OpenFlow protocol
> ospf                 OSPF configuration
> ospf3                OSPFv3 configuration
> overlay              Overlay protocol
> ovsdb                OVSDB protocol
> pcep                 Path computation client configuration
> pim                  PIM configuration
> ppp                  Configure PPP process
> ppp-service          Configure PPP service
> pppoe                Configure PPPoE process
> protection-group     Protection group
> rip                  RIP options
> ripng                RIPng options
> router-advertisement  IPv6 router advertisement options
> router-discovery     ICMP router discovery options
> rstp                 Rapid Spanning Tree Protocol options
> rsvp                 RSVP options
> sap                  Session Advertisement Protocol options
> vpls                 Configuration for global vpls module
> vrrp                 VRRP options
> vstp                 VLAN Spanning Tree Protocol options
[edit]

To shorten how much typing we need to do we can use the edit command to move down the hierarchy

root@VMX01# edit interfaces ge-0/0/0.0 family inet   

[edit interfaces ge-0/0/0 unit 0 family inet]
root@VMX01# show 
address 10.0.101.254/24;
address 10.2.101.254/24;
address 10.3.101.254/24;
address 10.4.101.254/24;
address 10.5.101.254/24;
address 10.6.101.254/24;

[edit interfaces ge-0/0/0 unit 0 family inet]

If we want to change a particular entry we can use the rename command.

root@VMX01# rename address 10.6.101.254/24 to address 10.7.101.254/24

[edit interfaces ge-0/0/0 unit 0 family inet]
root@VMX01# commit 
commit complete

[edit interfaces ge-0/0/0 unit 0 family inet]
root@VMX01# show 
address 10.0.101.254/24;
address 10.2.101.254/24;
address 10.3.101.254/24;
address 10.4.101.254/24;
address 10.5.101.254/24;
address 10.7.101.254/24;

[edit interfaces ge-0/0/0 unit 0 family inet]

To remove some config we can use the delete command.

root@VMX01# delete address 10.7.101.254/24 

Junos also supports some handy wildcards so we can change text with the replace pattern command

root@VMX01# replace pattern 254 with 253 

[edit interfaces ge-0/0/0 unit 0 family inet]
root@VMX01# show 
address 10.0.101.253/24;
address 10.1.101.253/24;
address 10.2.101.253/24;
address 10.3.101.253/24;
address 10.4.101.253/24;
address 10.5.101.253/24;
address 10.6.101.253/24;

Or delete some config with a wildcard regex.

root@VMX01# wildcard delete address 10\.[2-7]+    
  matched: 10.2.101.254/24
  matched: 10.3.101.254/24
  matched: 10.4.101.254/24
  matched: 10.5.101.254/24
  matched: 10.7.101.254/24
Delete 5 objects? [yes,no] (no) yes 


[edit interfaces ge-0/0/0 unit 0 family inet]
root@VMX01# commit 
commit complete

[edit interfaces ge-0/0/0 unit 0 family inet]
root@VMX01# show 
address 10.0.101.254/24;

LLDP

Juniper doesn't support CDP since that is Cisco only (for the most part) but it can do LLDP!

root@VMX01# set protocols lldp interface all 

[edit]
root@VMX01# commit


root@VMX01# run show lldp neighbors    
Local Interface    Parent Interface    Chassis Id          Port info          System Name
ge-0/0/3           -                   00:05:86:b1:87:c0   521                VMX02               
ge-0/0/0           -                   aa:bb:cc:00:01:00   Et0/0              R01.testlab.com     
ge-0/0/1           -                   aa:bb:cc:00:02:00   Et0/0              R02.testlab.com     
ge-0/0/2           -                   aa:bb:cc:00:03:00   Et0/0              R03.testlab.com 

The detailed view gives us more info on the neighbors.

root@VMX01# run show lldp neighbors interface ge-0/0/0
LLDP Neighbor Information: Local Information: Index: 4 Time to live: 120 Time mark: Thu Aug 3 01:41:42 2017 Age: 11 secs Local Interface : ge-0/0/0 Parent Interface : - Local Port ID : 518 Ageout Count : 0

Neighbour Information:
Chassis type       : Mac address
Chassis ID         : aa:bb:cc:00:01:00
Port type          : Interface name
Port ID            : Et0/0
Port description   : Ethernet0/0
System name        : R01.testlab.com
  
System Description : Cisco IOS Software, Linux Software (I86BI_LINUX-ADVENTERPRISEK9-M), Version 15.4(1)T, DEVELOPMENT TEST SOFTWARE
                     Technical Support: http://www.cisco.com/techsupport
                     Copyright (c) 1986-2013 by Cisco Systems, Inc.
                     Compiled Sat 23-Nov-13 03:28 by prod_rel_tea

                                        
System capabilities 
        Supported: Bridge Router 
        Enabled  : Router 

Management address 
        Address Type      : IPv4(1)
        Address           : 10.0.101.1
        Interface Number  : 1
        Interface Subtype : ifIndex(2)

[edit]

Static Routes

Things like static routes are considered routing-options, static routes work more or less the same as in Cisco Land.

root@VMX01# set routing-options static route 0.0.0.0/0 next-hop 10.1.2.2 

[edit]
root@VMX01# commit

RIP

Let's step it up a bit and enable RIP routing.

On the Cisco routers I'll enable RIP and also add a couple loopbacks to each.

R01(config)#router rip
R01(config-router)#ver 2
R01(config-router)#no auto
R01(config-router)#network 10.0.0.0
R01(config-router)#network 192.168.254.0

The Juniper side differs in two ways, one is we have to give RIP a group name like we do in RIPng in Cisco devices, and the other is that we specify the interface instead of using a network statement (also like RIPng)

root@VMX01# set protocols rip group MEOWCAT neighbor ge-0/0/0.0 

[edit]
root@VMX01# set protocols rip group MEOWCAT neighbor ge-0/0/1.0    

[edit]
root@VMX01# set protocols rip group MEOWCAT neighbor ge-0/0/2.0    

[edit]
root@VMX01# set protocols rip group MEOWCAT neighbor ge-0/0/3.0    

[edit]
root@VMX01# commit

Once we are done the router will get RIP routes from the Cisco routers, just like in Cisco we can filter routes by protocol. Notice the Juniper version of AD for RIP is 100 instead of 120.

root@VMX01# run show route protocol rip    

inet.0: 15 destinations, 15 routes (15 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.254.1/32   *[RIP/100] 00:02:02, metric 2, tag 0
                    > to 10.0.101.1 via ge-0/0/0.0
192.168.254.2/32   *[RIP/100] 00:02:19, metric 2, tag 0
                    > to 10.0.102.1 via ge-0/0/1.0
192.168.254.3/32   *[RIP/100] 00:01:53, metric 2, tag 0
                    > to 10.0.103.1 via ge-0/0/2.0
192.168.254.11/32  *[RIP/100] 00:02:02, metric 2, tag 0
                    > to 10.0.101.1 via ge-0/0/0.0
192.168.254.12/32  *[RIP/100] 00:02:19, metric 2, tag 0
                    > to 10.0.102.1 via ge-0/0/1.0
192.168.254.13/32  *[RIP/100] 00:01:53, metric 2, tag 0
                    > to 10.0.103.1 via ge-0/0/2.0
224.0.0.9/32       *[RIP/100] 00:02:19, metric 1
                      MultiRecv

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

[edit]

But if we look at R01 we can see we are not learning anything!

R01(config-if)#do sh ip route | be Gateway
Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.101.0/24 is directly connected, Ethernet0/0
L        10.0.101.1/32 is directly connected, Ethernet0/0
      192.168.254.0/32 is subnetted, 2 subnets
C        192.168.254.1 is directly connected, Loopback0
C        192.168.254.11 is directly connected, Loopback1

What's the deal? Well Juniper is a restrictive platform by default so it will not export routes unless you tell it too. We do this by making a export policy, for fun I'll make a policy that just exports the loopbacks but not the transit interfaces.

root@VMX01# set policy-options prefix-list PL_LOOPBACKS 192.168.254.0/24                                                   

[edit]
root@VMX01# set policy-options policy-statement EXPORT_RIP term LOOPBACKS from prefix-list-filter PL_LOOPBACKS orlonger    

[edit]
root@VMX01# set policy-options policy-statement EXPORT_RIP term LOOPBACKS then accept                                      

[edit]

The basic logic is that I make a prefix list that matches the loopback subnet and then allowing the routes if they match the list or if they are longer. Then we need to tell RIP to use the export policy.

root@VMX01# set protocols rip group MEOWCAT export EXPORT_RIP 

[edit]
root@VMX01# commit 
commit complete

[edit]

After a bit we'll see the routes on our Cisco's but not the transit subnets.

R01(config-if)#do sh ip route rip | be Gateway Gateway of last resort is not set

  192.168.254.0/32 is subnetted, 6 subnets

R 192.168.254.2 [120/2] via 10.0.101.254, 00:00:30, Ethernet0/0 R 192.168.254.3 [120/2] via 10.0.101.254, 00:00:30, Ethernet0/0 R 192.168.254.12 [120/2] via 10.0.101.254, 00:00:30, Ethernet0/0 R 192.168.254.13 [120/2] via 10.0.101.254, 00:00:30, Ethernet0/0

This means we can only ping the other loopbacks if we source the ping from the loopback interface.

R01(config)#do ping 192.168.254.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.254.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R01(config)#do ping 192.168.254.2 source l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.254.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.254.1 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 ms

I think I'll leave it here for now. Time to find a drink!

OK one more thing!

Templates

Juniper is very template friendly since its focus is large ISP deployments with plenty of configuration. One useful feature is Apply-Groups, these are templates we can apply to make our life a bit easier, for example if I needed to ensure that all interfaces will have their MTU raised to 1600 then I could use wildcards to pick all interfaces and then set the MTU. I can then either apply the group at the root level or under the interface level depending on what makes sense to me.

root@VMX01# set groups all-interfaces interfaces <*> mtu 1600 

root@VMX01# set interfaces apply-groups INTERFACE-MTU 

[edit]

The downside to this is that like Cisco we need to use a special command to see the actual configuration being applied.

root@VMX01# show interfaces | display inheritance 
ge-0/0/0 {
    vlan-tagging;
    ##
    ## '1600' was inherited from group 'INTERFACE-MTU'
    ##
    mtu 1600;
    unit 0 {
        vlan-id 0;
        family inet {
            address 10.0.101.253/24 {
                vrrp-group 111 {
                    virtual-address 10.0.101.200;
                }
            }
            address 10.1.101.253/24;
            address 10.2.101.253/24;
            address 10.3.101.253/24;
            address 10.4.101.253/24;
            address 10.5.101.253/24;
            address 10.6.101.253/24;
        }
        family iso;
    }

The other neat template feature I wanted to mention was Apply-Path, this allows the router to automatically build a prefix list using the configured networks on the router. This can be handy for routing advertisements like for BGP or for security features.

Again we use wildcards to build the list (see why I'm always going on about regex?)

root@VMX01# set policy-options prefix-list MEOWMEOW apply-path "interfaces <*> unit <*> family inet address <*>"    

[edit]
root@VMX01# show policy-options prefix-list | display inheritance                                                   
error: invalid input at 'display' in ip address: 'display': display

[edit]
root@VMX01# show policy-options prefix-list MEOWMEOW | display inheritance 
##
## apply-path was expanded to:
##     10.0.101.0/24; 
##     10.1.101.0/24; 
##     10.2.101.0/24; 
##     10.3.101.0/24; 
##     10.4.101.0/24; 
##     10.5.101.0/24; 
##     10.6.101.0/24; 
##     10.0.123.0/24; 
##     10.0.102.0/24; 
##     10.0.103.0/24; 
##     10.1.2.0/24; 
##     192.168.254.254/32; 
##
apply-path "interfaces <*> unit <*> family inet address <*>";
13 comments
93% Upvoted
This thread is archived
New comments cannot be posted and votes cannot be cast
level 1

This was very informative. Requesting something similar for Mirakki. or a link if it has already been done. You're beautiful.

level 2
Meow 馃悎馃悎Meow 馃惐馃惐 Meow Meow馃嵑馃悎馃惐Meow A+!Original Poster3 points1 year ago

Thanks!

Meraki you mean?

level 3

words, yes.

level 4
Meow 馃悎馃悎Meow 馃惐馃惐 Meow Meow馃嵑馃悎馃惐Meow A+!Original Poster2 points1 year ago

I've been toying with a Meraki post, just gotta make it interesting somehow

level 5
1 point1 year ago

click click click done.

level 6
3 points1 year ago

Oh no something broke! call tech support spend the next month fighting tech support. Eventually you figure out a work around and stop calling tech support.

level 1

How can we go about getting a copy (student/lab copy) of junOS?

level 2

I'm pretty sure they have an honor-based system where you can get it for free, but for commercial use, you're supposed to activate/get a support contract

level 2
Meow 馃悎馃悎Meow 馃惐馃惐 Meow Meow馃嵑馃悎馃惐Meow A+!Original Poster1 point1 year ago

You can get a trial of vSRX or vMX from Juniper.

level 1
2 points1 year ago

Dude, this couldn't have come at a better time. We just got two QFX 10002 and 5200s.

Got all of the management ports up and running and SSH access.

I just need to figure out all of these port labelings. The .0 part I did not know for the interfaces, that would have saved me time.

One issue I had was disabling the auto-image-upgrade. Once I turned that off (I also had to remove DHCP from the em0 interface) before the commit would take place.

level 1

Great write up. This is solid info and definitely shows Juniper can be just as easy as Cisco.

level 1
4 points1 year ago

Heresy! JunOS in this board! No sir, I won't have it!

Thanks as always /u/the-packet-thrower informative and useful for any mixed shops out there.

Now I have to go take a shower to cleanse myself of this Juniper smell.

level 1

Thanks for taking the time to share!

Community Details

34.0k

Subscribers

132

Online

Create Post
r/ccna Rules
1.
No posting of illegal materials
2.
No posting of braindumps
3.
Be courteous and helpful
4.
Don't ask others to complete your labs
Cookies help us deliver our Services. By using our Services or clicking I agree, you agree to our use of cookies.Learn More.