*************************** Juniper Virtualized Environments for Training *************************** ✅ Top Juniper Network Simulators --------------- 1️⃣ Juniper vSRX (Recommended) --------------- A virtual version of Juniper’s SRX firewall that also supports routing (Junos). Features Full Junos OS Routing protocols: OSPF, BGP, IS-IS, RIP Security features (firewall, NAT, IPSec) Great for JNCIA/JNCIS/JNCIP labs Where it runs: EVE-NG GNS3 VMware/VirtualBox ✔ Best overall Juniper virtual router/firewall. --------------- 2️⃣ Juniper vMX (Professional-grade MX router emulation) --------------- A virtualized MX Series router used in real ISPs. Features: Full routing stack (MPLS, L3VPN, L2VPN, VPLS, EVPN) Carrier-grade performance JUNOS identical to hardware Where it runs: EVE-NG Pro / Community VMware ESXi ✔ Best for service provider labs, MPLS, EVPN, BGP. --------------- 3️⃣ Juniper Olive (Old, unofficial Junos simulator) --------------- Runs JunOS on FreeBSD (NO forwarding engine). Limitations: Many features don’t work Not supported No forwarding traffic Old Junos versions only ✔ Only useful for basic CLI learning. --------------- 4️⃣ EVE-NG (Best platform for Juniper labs) --------------- EVE-NG is not Juniper itself, but it runs vMX, vSRX, and many other vendors. Why it’s perfect for Juniper Fully supports vSRX + vMX Multi-vendor labs (Cisco/Huawei/Arista) Ready-made topologies Very stable networking emulator ✔ Industry standard for network engineers. --------------- 5️⃣ GNS3 --------------- Supports Juniper vSRX but NOT vMX (unless using a Linux VM workaround). ✔ Good for basic Juniper labs. --------------- 6️⃣ Juniper vLabs (Free, cloud-based by Juniper) --------------- Official FREE online labs by Juniper. Features Real Junos devices No installation Multiple scenarios: OSPF, BGP, MPLS, EVPN, Security 🔗 Search “Juniper vLabs” in Google (free access). ✔ Best for beginners who want real devices without installing anything. --------------- 7️⃣ Juniper vQFX vLabs --------------- In the lab list, look for: 🔹 vQFX – VXLAN EVPN Fabric 🔹 vQFX – Basic Switching 🔹 vQFX – LAG / MC-LAG 🔹 vQFX – Data Center Leaf-Spine --------------- ⭐ Recommended Setup (Best Choice) --------------- If you want the best Juniper simulator: Install EVE-NG → Import vSRX → Build your topology This gives you: Real Junos Full routing Perfect for JNCIA / JNCIS / JNCIP practice Multi-vendor labs (Cisco + Huawei + Mikrotik + FortiGate) ************************* Cisco vs Juniper ************************* Juniper Cisco -------------------------------------------------------------- configure, edit, configure private config t IRB SVI commit write show configuration show run show interfaces ge0/0/5 terse show interface fe0/1 *terse brief show interfaces show interface show interfaces terse show interface brief run show do show up up2 top exit Active configuration Running Configs & startup configs these are operational & and load from FLASH at startup Candidate configuration - Temporary Configs stored in buffer, activated after commit rollback <<<<<<<<<<<<<< Routing software Operating systems & network operating systems >>>>>>>>>>>>> -------------------1. Linux-based ------------------- ````````` Entirely free ````````` Endian Floppyfw IPFire LEDE libreCMC OpenWrt VyOS Zeroshell ````````` Partly proprietary ````````` AirOS & EdgeOS Alliedware Plus DD-WRT ExtremeXOS FRITZ!Box RouterOS SmoothWall Tomato Vyatta ------------------- 2. FreeBSD-based ------------------- ````````` Entirely free ````````` m0n0wall OPNsense pfSense ````````` Partly proprietary ````````` Junos OS Juniper -------------------3. Proprietary ------------------- Cisco IOS cisco NX-OS cisco Cisco IOS XE cisco Cisco IOS XR cisco ExtremeWare TiMOS Alcatel-Lucent VRP Huawei ******************* Juniper CLI or JUNOS BASIC Details ******************* UNIX base OS called JUNOS unos OS (also known as Juniper Junos, Junos and JUNOS) is a FreeBSD-based network operating system used in Juniper Networks routing, switching and security devices. -------------- ELS Enhanced Layer 2 Software -------------- most newer devices run ELS software, old switches (non-ELS) Enhanced Layer 2 Software (ELS) provides a uniform CLI for configuring and monitoring Layer 2 features on QFX Series switches, EX Series switches, and other Juniper Networks devices, such as MX Series routers. With ELS, you configure Layer 2 features in the same way on all these Juniper Networks devices. Default User: root Default Pass: NULL Modes: 1. SWITCH (ttyd0) 0 means, device running on default facctory setting 2. CLI/Shell mode (%) 3. operational mode (>) 4. configuration mode (#) Startup: SWITCH (ttyd0) 0 means, device running on default facctory setting login: root Password: JUNOS 19.4R1.10 built 2019-12-19 03:54:05 UTC root@SWITCH: RE: 0% cli {master:0} root@SWITCH> configure operational mode entering cinfiguration mode {master:0} [edit] root@SWITCH#exit configuration mode Exiting configuration mode {master:0} root@SW-B1> exit SW-B1 (ttyd0) root# set system host-name SW-B1 domain name abc.com *********************** Header or Login Banner *********************** [edit] user@router# set system login message "LOGIN MESSAGE HERE........" [edit] user@router# commit <<<<<<<<<<<<<<<<<<<<<<<<< Juniper switch/Router factory default/Reset/Password Reset/Upgrade/Downgrade >>>>>>>>>>>>>>>>>>>>>>>>> *********************** Junos Password recovery *********************** restart the router by using either command root> request system reboot reboot whole router root> request system reboot both routing-engine reboot both REs root> request system reboot other routing-engine reboot Backup RE keep pressing SPACEBAR while rebooting, try not to press spacebar bar immediately when start, press after 5-6 seconds, other wise folloing message will show => if this shows type boot => boot then a "loader> prompt" or "OK prompt" will be diplayed now type: boot -s now press ENTER after process completed this message will be displayed Enter full pathname of shell or 'recovery' for root password recovery or RETURN for / bin/sh: recovery then here type: recovery and press ENTER then CLI mode will be displayed: Starting CLI root> now configure new password root# set system root-authentication plain-text-password OR [edit] root@# set system root-authentication encrypted-password PASWORD better to restart once ***************** JUNOS Factory Default ***************** {master:0} root@SW-B1> request system zeroize media reset & also wipe all data like logs etc OR [edit] user@router# load factory-default works on routers, SRX100 confirmed [edit] user@router# set system root-authentication plain-text-password better to restart once The Junos OS does not allow you to save the configuration until you configure root authentication information. Do not forget to issue a commit to activate your changes. ***************** Rollback or Disaster/Rescue Recovery ***************** Active configuration Running Configs & startup configs these are operational & and load from FLASH at startup Candidate configuration - Temporary Configs stored in buffer, activated after commit rollback configuration terminal >>>>>>>candidate configs--->>>commit--->>>active configs--->>>rollback "n=0,1,2,...49"--->>>candidate configs Configurations Folder Location Rollback levels Active configs /config FLASH 1 to 3 Rollabck configs /var/db/config Hard Drive 4 to 49 Backup of Rollbacks /altconfig Hard Drive show | compare show | compare rollback 0 | save compare0 >request system configuration rescue save >file list /config >file show /config/rescue.conf.gz root@router> file list ? root@router> file list /config/ show active configs files rollback 1-3 root@router> file list /var/db/config/ backup configs files rollback 4-49 user@host# rollback 0 user@host# rollback 1 recall one last change committed user@host# rollback 2 root@router> request system configuration rescue save user@host> test configuration /config/rescue.conf.gz verify if a rescue configuration file is correct user@host# rollback rescue Roll Back to a Rescue Configuration user@host> request system configuration rescue delete Delete the Rescue Configuration root> request system autorecovery state recover To recover the device, with the saved information in autorecovery root@router> file list /config/ to show files list in a directory root> file show /config/juniper.conf.gz to show content of the file root> file delete /config/juniper.conf.gz delete configuration files root> file delete /config/juniper.conf.1.gz --------------- Auto recovery configs ---------------- The autorecovery feature is supported on dual-partitioned SRX100, SRX110, SRX210, SRX220, SRX240, SRX550 and SRX650 Services Gateways from Junos version 11.2. With this feature, information on disk partitioning, configuration, and licenses is recovered automatically; in the event it gets corrupted. The following issues can be resolved by using the autorecovery feature: Disk partitioning corruption. Junos OS rescue configuration is corrupted and unable load to the device. Junos OS licenses corruption. SOLUTION: Power cycle of the device. Sudden power disconnection. Abrupt restart of the device. DATA which Is BACKED UP in an AUTO-RECOVERY : Rescue configuration (regenerated from the current configuration) License keys BSD labels (disk-partitioning information) root> show system autorecovery state root> request system autorecovery state save root> show system alarms ***************** Copy Configuration File/Rescue Configuration to & from Remote Server ***************** ++++++++++++++ Via TFTP Server ++++++++++++++ user@host> start shell Start the device shell Go to the /config directory and list the configuration files. The currently running configuration file is juniper.conf.gz and the rescue configuration file is rescue.conf.gz. root@%cd /config root@% ls root@% tftp 192.168.1.2 tftp> put FILENAME.txt copy from router to tftp ? = help tftp> get FILENAME.txt copy from tftp to router tftp> quit root@% ls to list files ++++++++++++++ Via FTP Server ++++++++++++++ user@host-re0:~# ftp host2 Name: user2 Password: password User user2 logged in. ftp> cd /var/tmp ftp> lcd /config ftp> bin ftp> put rescue.conf.gz local: rescue.conf.gz remote: rescue.conf.gz Transfer complete. ftp> put juniper.conf.gz local: juniper.conf.gz remote: juniper.conf.gz Transfer complete. ftp> bye To synchronize rescue configuration from primary Routing Engine to secondary Routing Engine, issue file copy command on primary Routing Engine: user@host-re0> file copy /config/rescue.conf.gz re1:/config/ root@# load override /var/tmp/filename load complete *********************** Upgrade Junos image *********************** root@router> request system software add PATH/ImageName OR you can reboot at the end also by following command root@router> request system software add PATH/ImageName reboot root@router> request system software add /var/tmp/ImageName reboot root@router> request system storage cleanup root@router> show system storage root@router> show version root@router> show system boot-messages *********************** SYSLOG configs *********************** system logs are stored in /var/log/ directory /var/log/messages file path this file can be stored in remote FTP or TFTP server root@SW-B1> file list /var/log to show directory containing messages file etc root@SW-B1> file delete /var/log/FILENAME used to DELETE log file root@SW-B1> file delete /var/log/messages set system syslog console authorization any it this way, one can set many syslog services like console etc root@SW-B1> monitor start FILENAME used to start monitoring live logs of a file root@SW-B1> monitor stop FILENAME used to stop monitoring live logs of a file root@SW-B1> monitor start messages root@SW-B1> monitor start messages | match fail root@SW-B1> monitor start messages | match block root@SW-B1> clear log messages root@SW-B1> show system syslog root@SW-B1> show log messages root@SW-B1> show log messages | match fail root@SW-B1> help syslog COMPLETE_LOG_MESSAGE ***********Juniper Devices Models/Series*********** M Series SP M7, M120, M320 (Speed Upto 320 Gbps) T Series SP T640, T1600, T4000 (Speed Upto 25.6 Tbps) QFX Series DC QFX10008, QFX5100-96S/48S/24Q Like cisco Nexus series DC switches MX Series SP/Entr Routers MX240, MX2K, MX240, MX480, MX2010, MX2020 (Speed Upto 80 Tbps) Like cisco Aggregation Services Routers (ASR) SRX Series SP/Entr Firewalls SRX100, SRX110, SRX210, SRX550, SRX300, SRX5800 (Speed Upto 200 Gbps) Like cisco ASA (also a Partial Router) MX10K MX2K MX1K PTX1OK QFX5100 ------------------- EX Series ------------------- SP/Entr Like cisco catalyst switches (Speed Upto 13.2 Tbps) Fixed Chassis switches EX2200, EX2300, EX3300, EX3400, EX4200, EX4300 can provide PoE EX4600/4650 Modular Chassis switches: EX8208 RE=2x Line Cards=8x PSUs=6 EX8216 RE=2x Line Cards=16x PSUs=6 EX9204 RE=2x Line Cards=2-3x PSUs=4 EX9208 RE=2x Line Cards=6x PSUs=4 EX9214 RE=2x Line Cards=12x PSUs=4 ************** Hardware Info ************** Control Plane: Chassis chassis Backplane SCB Switch Control Boards Controller Card RE Routing Engine Routing Card Forwarding Plane: (Packet Forwarding Engine) PIC Physical Interface Cards Cards in Slots or PICs in FPCs FPC Flexible PIC concentrator Slots in CB MIC Modular interface card Like interface card PIM - Physical Interface Model: found in J Series - adaptor card for I/F's - T1, ADSL, Ethernet...... PIC- Physical Interface Card: found in other JUNOS Routers - adaptor card for I/F's - T1, ADSL, Ethernet...... used in M series routers FPC - Flexible PIC Concentrator: PICs go into FPCs on larger routers - - example 4 PICs to an FPC - used in larger routers =========================================== MPC – Modular Port Concentrator (Juniper MX Series) =========================================== • Full Form : Modular Port Concentrator • Vendor : Juniper Networks • Used In : MX Series Routers • Plane : Forwarding Plane (Data Plane) • Function : High-speed packet forwarding line card =========================================== WHAT IS MPC? =========================================== • MPC is a modern high-capacity line card. • It replaces the older FPC + PIC architecture. • It contains forwarding ASIC + interfaces in one module. • It processes actual user traffic (not routing decisions). =========================================== WHERE IT SITS IN ARCHITECTURE =========================================== Control Plane: -------------- • RE = Routing Engine (runs routing protocols) • SCB = Switch Control Board (fabric switching) • Chassis Backplane Forwarding Plane: ----------------- • MPC = Handles packet forwarding • Traffic enters and exits through MPC ports =========================================== OLD ARCHITECTURE (M Series / Early Design) =========================================== • PIC = Physical Interface Card • FPC = Flexible PIC Concentrator • PICs inserted into FPC • FPC inserted into chassis Example: • 4 PICs → 1 FPC → Router Chassis Limitations: • Separate forwarding and interface logic • Lower scalability • More hardware layers =========================================== NEW ARCHITECTURE (MX Series with MPC) =========================================== • MPC replaces FPC + PIC combination • Interfaces integrated directly on MPC • May contain MIC slots for modular ports • High-speed internal forwarding ASIC So: OLD : PIC + FPC NEW : Single MPC =========================================== INSIDE AN MPC =========================================== • Trio ASIC (Forwarding Chip) - Performs routing lookup - MPLS label switching - ACL filtering - QoS processing - Policing and shaping • High-speed Interfaces - 10GE - 40GE - 100GE - 400GE (newer models) • Memory & Buffers - Packet buffering - Queue management - Deep traffic handling =========================================== TRAFFIC FLOW =========================================== Packet In → MPC Port → Trio ASIC Processing → Forwarding Decision → Output Port → Packet Out =========================================== WHY MPC IS IMPORTANT =========================================== • Very high throughput (Tbps level in newer models) • Low latency • Hardware-based forwarding • Scalable architecture • Carrier-grade performance =========================================== SIMPLE COMPARISON =========================================== PIC = Interface adaptor card (old routers) FPC = Slot card that holds PICs MPC = Modern integrated high-speed line card =========================================== IN ONE LINE =========================================== MPC is the high-performance forwarding line card in Juniper MX routers that processes and forwards real network traffic. ===================================================== JUNIPER ROUTER ARCHITECTURE – COMPLETE MASTER SHEET (RE + SCB + FPC + PIC + MIC + MPC + PIM) ===================================================== ======================================== CONTROL PLANE COMPONENTS ======================================== ------------------------------------------------------- RE – Routing Engine ------------------------------------------------------- • Full Form : Routing Engine • Plane : Control Plane • Function : Brain of the router • Runs: - Routing protocols (OSPF, BGP, IS-IS, RIP) - Junos OS - CLI management - Routing table calculations • Does NOT forward packets. • Sends forwarding table to forwarding plane. ------------------------------------------------------- SCB – Switch Control Board ------------------------------------------------------- • Full Form : Switch Control Board • Plane : Control + Fabric • Function : Internal switching fabric control • Connects: - RE - Line cards (FPC/MPC) - Chassis backplane • Handles: - Fabric communication - Internal packet switching between slots ========================================= FORWARDING PLANE COMPONENTS (DATA PLANE) ========================================= ------------------------------------------------------- FPC – Flexible PIC Concentrator ------------------------------------------------------- • Plane : Forwarding Plane • Used In : Older M Series / Early MX • Function: - Holds multiple PICs - Provides forwarding resources • Example: 4 PICs → 1 FPC → Chassis • Older architecture design. ------------------------------------------------------- PIC – Physical Interface Card ------------------------------------------------------- • Plane : Forwarding Plane • Function : Interface adaptor card • Provides ports like: - T1/E1 - Ethernet - STM-1 - POS • Inserted into FPC (old design). ------------------------------------------------------- MIC – Modular Interface Card ------------------------------------------------------- • Plane : Forwarding Plane • Function : Modern interface module • Used inside: - MPC (MX routers) • Provides: - 10GE - 40GE - 100GE ports • More compact and high-density than PIC. ------------------------------------------------------- MPC – Modular Port Concentrator ------------------------------------------------------- • Plane : Forwarding Plane • Used In : MX Series Routers • Replaces : FPC + PIC architecture • Contains: - Interfaces (built-in or MIC slots) - Forwarding ASIC (Trio chipset) - Packet buffers • Function: - Hardware packet forwarding - MPLS processing - QoS - ACL filtering • High throughput (Gbps to Tbps). ------------------------------------------------------- PIM – Physical Interface Module ------------------------------------------------------- • Used In : J Series Routers • Function : Interface adaptor module • Provides: - T1 - ADSL - Ethernet • Similar concept to PIC but for smaller branch routers. ======================================== ARCHITECTURE EVOLUTION ======================================== OLD DESIGN (M Series): ---------------------- PIC → FPC → Chassis NEW DESIGN (MX Series): ----------------------- MIC → MPC → Chassis Very Old (J Series): -------------------- PIM → Router Chassis ======================================== TRAFFIC FLOW (MX WITH MPC) ======================================== Incoming Packet ↓ MPC Port ↓ Trio ASIC Processing ↓ Forwarding Decision (from RE table) ↓ Outgoing Port ======================================== CONTROL vs FORWARDING SUMMARY ======================================== CONTROL PLANE: • RE • SCB FORWARDING PLANE: • FPC (old) • PIC (old) • MIC (modern) • MPC (modern) • PIM (branch routers) ======================================== ONE-LINE MEMORY TRICK ======================================== RE thinks. SCB connects. MPC forwards. MIC/PIC/PIM provide ports. FPC was old holder card. ======================================== ---------------------- Hardware/system SHOW and monitoring Commands ---------------------- root> show chassis alarms root> show chassis hardware root> show chassis temperature-threshold root> show chassis routing-engine show routing engines details root> show chassis fpc show line cards info root> show chassis fpc detail show ram, temp, cpu, ram, start/uptime root> show chassis pic fpc-slot slot-number or pic-slot slot-number root> show chassis environment no-forwarding root> show chassis fan root> show chassis environment root> show system alarms root> show system connections root> show system statistics root> show system services show either telnet or SSH, HTTP, DHCP configured root> show system storage root> show interfaces vlan VLAN-ID root> show interfaces terse like brief in cisco root> show interfaces brief detailed info about interfaces root> show interfaces extensive root> show interfaces ge-0/0/0 brief root> show interfaces description root> show interfaces detail root> show interfaces statistics root> show interfaces switchport root> show interfaces ge-0/0/0 switchport root> show interfaces terse | match em root> monitor interface root> monitor interface ge-0/0/0 root> monitor interface traffic root> monitor traffic ? detail extensive interface layer2-headers root> show version root> show version detail root> show version detail | match RPD etc. root> show version invoke-on other routing-engine root> show log messages root> show log chassisd ******************* Power Commands ******************* • Use request system halt to gracefully halt the Junos OS and help ensure file system integrity • When the Junos OS has been halted, system power is maintained • Reboot with console activity root> request system power-off OR user@router> request system halt? to shutdown the router running junos Possible completions: at in media message user@host> request halt both routing engines if there are two REs, shutdowns the both REs user@host> request halt all-members if there are more than two REs, shutdowns the all the REs user@host> show chassis environment pem to check the status of installed power supply modules. # run show chassis power > show chassis alarms root> request system power-off root> request system reboot reboot whole router root> request system reboot both routing-engine reboot both REs root> request system reboot other routing-engine reboot Backup RE root> request chassis fpc restart slot 0 restart fpc slot ************** Commit Command *********** Commit write immediately commit confirmed write, then roll back after 10 minutes, Default commit confirmed 5 write, then roll back after 5 minutes commit comment COMMENT to give comment ad comment or description about configs commit and-quit save and quit back to operational mode commit at TIME save configs at specific time commit check check syntax errors before commit <<<<<<<<<<<<<<<<<<<<<<<<< SHOW COMMANDS >>>>>>>>>>>>>>>>>>>>>> show | compare to show and compare before and after configuration changes before applying COMMIT command show | display set to show uncommitted or unsaved commands show zones to show security zones configured in SRX firewalls show configuration run show configuration | display set Show arp ------------- Show System ------------- root> show system alarms root> show system connections root> show system statistics root> show system services show either telnet or ssh configured root> show system storage ------------- Show Chassis ------------- root> show chassis alarms root> show chassis hardware root> show chassis temperature-threshold root> show chassis routing-engine show routing engines details root> show chassis fpc show line cards info root> show chassis fpc detail show ram, temp, cpu, ram, start/uptime root> show chassis pic fpc-slot slot-number or pic-slot slot-number root> show chassis environment no-forwarding root> show chassis fan root> show chassis environment ------------- Show Ports/Interfaces ------------- | Speed | Type | Example | | -------- | ------- | ---------------------------------------------- | | 1 Gbps | ge | `ge-0/0/1` | | 10 Gbps | xe | `xe-0/0/1` | | 25 Gbps | et-25g | `et-0/0/12` (some platforms label 25G as “et”) | | 40 Gbps | xe / et | `xe-0/0/1` or `et-0/0/1` | | 100 Gbps | et | `et-0/0/12` | | 400 Gbps | et | `et-0/0/0` | Format: -// FPC: Flexible PIC Concentrator (slot) PIC: Physical Interface Card (subslot) Port: Physical port number Example: show interfaces et-0/0/12 | Vendor | 1G | 10G | 25G | 40G | 100G | Example | | ----------- | -- | ---- | ---- | ----- | ----- | ------------- | | **Cisco** | Gi | Te | Twe | Fo | Hu | `Hu1/0/12` | | **Huawei** | GE | 10GE | 25GE | 40GE | 100GE | `100GE1/0/12` | | **Juniper** | ge | xe | et | xe/et | et | `et-0/0/12` | root> show interfaces terse root> show interfaces brief root> show interfaces extensive root> show interfaces ge-0/0/0 brief root> show interfaces description root> show interfaces detail root> show interfaces statistics root> show interfaces switchport root> show interfaces ge-0/0/0 switchport root> show interfaces terse | match em {master:0} [edit interfaces ge-0/0/1] root@SW-B1# show show interface details {master:0} [edit interfaces ge-0/0/1] root@SW-B1# top show show details of operational mode ------------- Show Security ------------- show root-authentication ------------- Show Syslog ------------- root@SW-B1> show system syslog root@SW-B1> show log messages root@SW-B1> show log messages | match fail ------------- Show Routing ------------- user@R1# run show route instance run show route to show routing table ------------- Show BGP ------------- show configuration protocols bgp | display set show BGP neighbour show BGP summary user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ------------- Show Static Route ------------- root# show route root# show route protocol static user@R1# show routing-options user@R1# show configuration routing-options static | display set user@R1# show interfaces user@R6> show route 10.0.0.5 user@host> show < configuration | bgp | interfaces | isis | ospf | route > user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ------------- Show OSPF ------------- root# run show route user@host> show ospf route user@host> show ospf interface user@host> show ospf database user@host> show route protocols ospf user@host# show protocols ospf user@host# show protocols user@host# show interfaces user@host> show ospf neighbor user@host# show routing-options user@host# show configuration protocols ospf | display set user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ------------- Show RIP ------------- user@R1# show protocols user@R1# show policy-options user@R1> show route protocol rip user@R1> show route advertising-protocol rip 10.0.0.1 user@R1> show route receive-protocol rip 10.0.0.2 user@R1> show rip neighbor user@R1> show rip statistics user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ------------- Show RIPng ------------- user@R1> show route protocol ripng user@R1> show ripng neighbor user@R1> show interfaces terse user@R1> show route advertising-protocol ripng fe80::2a0:a514:0:14c user@R1> show route receive-protocol ripng fe80::2a0:a514:0:24c user@R1> show ripng statistics user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ------------- Show Time ------------- show system uptime show time show ntp status show ntp associations MX> show ddos-protection protocols ntp parameters detail check the max bandwidth for NTP traffic. If crossed, there could be drop of NTP packet. ------------- Show DHCP ------------- user@host> show dhcp client binding user@host> show dhcp client statistics show dhcp client binding routing instance show dhcp client statistics routing instance user@host# show access user@host> show dhcp server user@host> show dhcp server statistics user@host> show dhcp server binding user@host# show interfaces reth1 unit 0 family inet user@host> show dhcp client binding interface reth1 detail user@host> show configuration system services | display set user@host> show configuration access address-assignment | display set *********************** NTP/Time/Date Management Commands *********************** root@SW-B1> set system date YYYYMMDDhhmm.ss time in 24 hours format root@SW-B1# set system time-zone PST ------------------- NTP client configs ------------------- make sure internet connectivity in case of no local ntp server available set system ntp server NTP_SERVER_IP_or_DOMAIN set system ntp preferred-server (Optional) set system ntp authentication-key type 1 md5 nespk@123 authentication key for NTP (Optional) set system ntp trusted-key 1 set system ntp log-queries Enable NTP logging (Optional) ------------------- NTP/Time/Date Troubleshooting ------------------- show system uptime show time show ntp status show ntp associations MX> show ddos-protection protocols ntp parameters detail check the max bandwidth for NTP traffic. If crossed, there could be drop of NTP packet. <<<<<<<<<<<<<<<<<<<<<<<<<<<<<< SECURITY/ User management of switches, Routers etc >>>>>>>>>>>>>>>>>>>>>>>>>>>>> {master:0} [edit] root@SW-B1# set system login user USERNAME1 class super-user authentication plain-text-password {master:0} [edit] root@SW-B1# set system login user USERNAME2 class read-only authentication plain-text-password {master:0} [edit] root@SW-B1# set system login user USERNAME2 authentication plain-text-password root@SW-B1# set system root-authentication plain-text-password press ENTER and type password root@# set system root-authentication encrypted-password PASWORD show | find root-authentication show configuration system | display set | match user ***************** AAA, RADIUS, TACACS ***************** [edit system] root# set system radius-server SERVER_IP secret PASSWORD connect to radius erver [edit system] root# set system tacplus-server SERVER_IP secret PASSWORD connect to tacacs+ server hello [edit system] root# show system authentication order to check whether to authenticate first from RADIUS, TACACS or local Database [edit system] root# show radius-server [edit system] root# show tacplus-server [edit system] root# show login user USERNAME *********************** Swicth Access and Management via Telnet, HTTP/HTTPS & SSH *********************** [edit] root# set system services telnet [edit] root# set system services ssh [edit] root# set system services web-management http interface vlan.30 [edit] root# commit [edit] root# set system services telnet connection-limit 5 max no of simultaneous connections ------------------ Telnet, SSH, HTTP Troubleshooting ------------------ show | compare show configuration system | display set | match ssh show configuration system | display set | match telnet ------------------ CLI idle timeout ------------------ root@SW-B1> set cli idle-timeout 60 (in minutes) root@SW-B1> set cli idle-timeout 0 idle timeout disabled ------------------ remove or delete telnet/ssh configs ------------------ delete telnet delete ssh *********************** Link Layer Discovery Protocol LLDP configs*********************** root@SW-B1# set protocols lldp interface all ------------------ LLDP Troubleshoot ------------------ show lldp neighbours show lldp neighbours interface ge-0/0/0 *********************** Virtual Local Area Network VLANs configs*********************** root@SW-B1# set vlan NAME vlan-id 20 create vlan root@SW-B1# set interface ge 0/0/5 unit 0 family ethenet-switching vlan members VLAN-ID root@SW-B1# set interface ge 0/0/5 unit 0 family ethenet-switching vlan members VLAN-NAME {master:0} [edit] root@SW-B1# edit interfaces ge-0/0/10 [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching set an interface as an L2 interface {master:0} [edit interfaces ge-0/0/10] root@SW-B1# set unit family ethernet-switching vlan members 20 {master:0} [edit] root@SW-B1# edit interfaces ge-0/0/11 {master:0} [edit interfaces ge-0/0/11] root@SW-B1# set unit family ethernet-switching vlan members 20 {master:0} [edit] root@SW-B1# edit interfaces ge-0/0/23 ------------------ Ports as Access or Trunk ------------------ [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode access [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode trunk [edit interfaces fe-0/0/0] root set unit 0 family ethernet-switching vlan members all [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode trunk vlan members VLAN-NAME [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode trunk vlan members all -----------Delete VLANs------------- {master:0} [edit] root@SW-B1# delete vlans [edit] root# delete vlans VLAN-NAME [edit] root# delete vlans VLAN-ID [edit] root# delete vlans nespk interface fe-0/0/0 remove an interface from a vlan [edit interfaces fe-0/0/0] root# delete unit 0 family ethernet-switching vlan members VLAN-NAME remove a vlan from trunk port [edit interfaces fe-0/0/0] root# delete unit 0 family ethernet-switching vlan members VLAN-ID remove a vlan from trunk port [edit interfaces fe-0/0/0] root# delete unit 0 family ethernet-switching vlan members all remove all vlan from trunk port ----------- VLANs Troubleshoot ------------- root@SW-B1# show vlans root> show vlans show all vlans like default, vlan-trust and others alongwith assigned interfaces [edit] root# show vlans vlan-trust to show trust vlan [edit] root# show vlans VLAN_NAME [edit] root# show vlans 20 VLAN_ID [edit interfaces fe-0/0/0] root# show vlan-tagging to check 802.1q VLAN tagging support ----------------- inter vlan Routing ----------------- {master:0} [edit] root@SW-B1# set vlans IT l3-interface irb.10 {master:0} [edit] root@SW-B1# set vlans SERVERS l3-interface irb.20 {master:0} [edit] root@SW-B1# set vlans ACCOUNTS l3-interface vlan.30 {master:0} [edit] root@SW-B1# set vlans HR l3-interface vlan.40 **************** Ports / Interfaces configurations **************** Ports/Interfaces Types management interfaces fxp0, me0 etc used to connect junos device to management network internal interfaces fxp1, em0 etc used to connect control & forwarding planes services interfaces irb interfaces loopback interfaces lo0, lo1, lo0.16384 etc Logical interfaces sub interfaces em0.0, em1.0, em1.32768, lo0.16384 etc [edit] root@SW-B1# edit interfaces ge-0/0/1 {master:0} [edit interfaces ge-0/0/1] root@SW-B1# show show interface details {master:0} [edit interfaces ge-0/0/1] root@SW-B1# top show show details of operational mode [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching set an interface as an L2 interface {master:0} [edit interfaces ge-0/0/1] root@SW-B1# set disable disable interface OR [edit] root@SW-B1# set interfaces ge-0/0/1 disable {master:0} [edit interfaces ge-0/0/1] root@SW-B1# delete disable enable interface OR [edit] root@SW-B1# delete interfaces ge-0/0/1 disable ---------------------------------- Copper Ports Ethernet Loop -------------------------------- ==================== JUNOS ==================== ! 100M / 1G Copper set interfaces ge-0/0/0 enable set interfaces ge-0/0/0 ether-options auto-negotiation commit ! Or force set interfaces ge-0/0/0 ether-options speed 1g set interfaces ge-0/0/0 ether-options link-mode full-duplex commit ! 10G RJ-45 set interfaces xe-0/0/0 enable set interfaces xe-0/0/0 ether-options auto-negotiation commit ! Verify show interfaces ge-0/0/0 extensive show interfaces xe-0/0/0 extensive ----------------- Select interfaces in range ----------------- [edit] user@device# set interfaces interface-range range-name member-range fe-0/0/0 to fe0/0/4 [edit] user@device# edit interfaces interface-range range-name ENTER [edit interfaces interface-range abc] user@device# set member-range fe-0/0/0 to fe0/0/4 [edit interfaces interface-range abc] add another interface to range user@device# set member fe0/0/5 [edit interfaces interface-range abc] disable interfaces from range of interfaces root@nespk2# set disable member-range fe-0/0/0 to fe0/0/4 [edit interfaces interface-range abc] enable interfaces from range of interfaces root@nespk2# delete disable if does'nt work first set disable the delete disable [edit interfaces interface-range abc] root@nespk2# show | compare ------------------ Ports as Access or Trunk ------------------ [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode access [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode trunk [edit interfaces fe-0/0/0] root set unit 0 family ethernet-switching vlan members all [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode trunk vlan members VLAN-NAME [edit interfaces fe-0/0/0] root# set unit 0 family ethernet-switching port-mode trunk vlan members all [edit] root@SW-B1# show logical-systems default logical configs on an interface displayed, sometimes needs to be deleted [edit] root@SW-B1# delete logical-systems LOGICAL_SYSTEM_NAME enter LOGICAL_SYSTEM_NAME shown in above command to delete **************** Internet Protocol IP Address configurations **************** [edit] root@SW-B1# set interfaces vlan unit VLAN-ID family inet address 192.168.10.1/24 [edit] root@SW-B1# set interfaces irb unit 10 family inet address 192.168.10.1/24 [edit] root@SW-B1# set interfaces irb unit 20 family inet address 192.168.20.1/24 [edit] root@SW-B1# set interfaces ge-0/0/1 unit 30 family inet address 192.168.30.1/24 [edit] root@SW-B1# commit ------------------------- IP Address via DHCP or DHCP Client Configs ---------------------- [edit] user@host# edit interfaces ge-0/0/2 unit 0 family inet dhcp-client [edit interfaces ge-0/0/2 unit 0 family inet dhcp-client] user@host# set lease-time 86400 Set the DHCP lease time. [edit interfaces ge-0/0/2 unit 0 family inet dhcp-client] user@host# set force-discover. Configure the force-discover option. [edit interfaces ge-0/0/2 unit 0 family inet dhcp-client] user@host# set server-address 192.168.2.1 Set the IPv4 address of the preferred DHCP server. [edit interfaces ge-0/0/2 unit 0 family inet dhcp-client] user@host# set options no-hostname if you do not want the client to send the hostname in packets. `````````````````` DHCP Client Troubleshooting `````````````````` user@host> show dhcp client binding user@host> show dhcp client statistics show dhcp client binding routing instance show dhcp client statistics routing instance `````````````````` clear or remove DHCP Client configs `````````````````` user@host> clear dhcp client binding user@host> clear dhcp client statistics clear dhcp client binding routing instance clear dhcp client statistics routing instance ------------ remove or delete IP Address ------------ [edit] root@SW-B1# delete interfaces ge-0/0/1 unit 10 family inet address 192.168.10.1/24 ------------ modify IP Address ------------ {master:0} [edit interfaces ge-0/0/1 unit 0] root@SW-B1# rename family inet address 192.168.30.1/24 to address 192.168.30.1/28 {master:0} [edit interfaces ge-0/0/1 unit 0] root@SW-B1# show ------------------------- IPv6 configs ---------------------- [edit] root@R1# set interfaces ge-0/0/0 unit 20 family inet6 address 3FFE:B00:C181::2/64 [edit] root@R2# set interfaces ge-0/0/0 unit 20 family inet6 address 3FFE:B00:C181::3/64 ---------------------- ping ---------------------- ping DEST_ADDRESS source SOURCE_ADDRESS ------------------------- IP Address Troubleshooting ---------------------- [edit] root@R2# show | display set {master:0} [edit interfaces ge-0/0/1 unit 0] root@SW-B1# show user@host> show interfaces terse show | find fe-0/0/2 **************** DHCP Server Configs **************** most newer devices run ELS software, configure DHCP on SRX firewalls as well as old switches (non-ELS) Enhanced Layer 2 Software (ELS) provides a uniform CLI for configuring and monitoring Layer 2 features on QFX Series switches, EX Series switches, and other Juniper Networks devices, such as MX Series routers. With ELS, you configure Layer 2 features in the same way on all these Juniper Networks devices. ---------------------- METHOD - old switches (non-ELS) ---------------------- s[edit] root# set system services dhcp pool 192.168.10.0/24 low 192.168.10.2 s[edit] root# set system services dhcp pool 192.168.10.0/24 high 192.168.10.254 s[edit] root# set system services dhcp pool 192.168.10.0/24 domain-name NESPK.COM s[edit] root# set system services dhcp pool 192.168.10.0/24 name server 8.8.8.8 s[edit] root# set system services dhcp pool 192.168.10.0/24 router 192.168.10.1 s[edit] root# set system services dhcp pool 192.168.10.0/24 default-lease-time 3600(in seconds) [edit] root# set system services dhcp static-binding 00:xx:xx:xx:xx:x fixed-address 10.102.100.xxx DHCP MAC binding with IP address ---------------------- METHOD 2- newer devices run ELS software ---------------------- [edit system services] user@host# set dhcp-local-server group g1 interface ge-0/0/2.0 Configure the DHCP local server. [edit interfaces] user@host# set interfaces ge-0/0/2 unit 0 family inet address 203.0.113.1/24 Configure IP address of the server. [edit access] Configure an address pool. user@host# set address-assignment pool p1 family inet network 203.0.113.0/24 user@host# set address-assignment pool p1 family inet range RANGE_NAME low 203.0.113.5 user@host# set address-assignment pool p1 family inet range RANGE_NAME high 203.0.113.20 user@host# set address-assignment pool p1 family inet dhcp-attributes router 203.0.113.1 user@host# set address-assignment pool p1 family inet dhcp-attributes maximum-lease-time 86400 lease time in seconds user@host# set address-assignment pool p1 family inet dhcp-attributes domain-name adilawan.com user@host# set address-assignment pool p1 family inet dhcp-attributes name-server 8.8.8.8 user@host# set address-assignment pool p1 family inet dhcp-attributes name-server 8.8.4.4 user@host# set address-assignment pool p1 family inet host PC3 hardware-address MAC_ADDRESS_OF_PC3 MAC Binding user@host# set address-assignment pool p1 family inet host PC3 ip-address 203.0.113.10 ---------------------- DHCP Relay Agent ---------------------- user@host# set forwarding-options dhcp-relay server-group DHCP_GROUP_NAME DHCP_SERVER_IP user@host# set forwarding-options dhcp-relay group GROUP_NAME active-server-group DHCP_GROUP_NAME user@host# set forwarding-options dhcp-relay group GROUP_NAME interface ge-0/0/0.0 user@host# run show interface terse ---------------------- DHCP Troubleshoot ---------------------- user@host# show | comapre user@host# show access user@host> show dhcp server user@host> show dhcp server statistics user@host> show dhcp server binding user@host# show interfaces reth1 unit 0 family inet user@host> show dhcp client binding interface reth1 detail user@host> show configuration system services | display set user@host> show configuration access address-assignment | display set restart dhcp-service gracefully <<<<<<<<<<<<<<<<<<<<<<<<<< Routing >>>>>>>>>>>>>>>>>>>>>>>>>> ************************* IPv4 Static Routing Configs ************************* 1. Configure the hostname on the R1 (provider) device. [edit ] user@R1# set system host-name R1 2. Configure the interfaces on the R1 (provider) device. [edit interfaces] user@R1# set ge-0/0/0 unit 0 description "Link from R1 to R2" user@R1# set ge-0/0/0 unit 0 family inet address 172.16.1.1/24 user@R1# set lo0 unit 0 family inet address 10.0.0.1/32 user@R1# set lo0 unit 0 family inet address 10.0.0.2/32 3. Define the static route to the customer’s prefix on the R1 device. Be sure to specify the R2 end of the point-to-point link as the next hop for the static route. The static route ensures the provider network can route to all remote destinations in the customer network by forwarding traffic through the R2 device. [edit routing-options] user@R1# set static route 192.168.47.0/24 next-hop 172.16.1.2 4. Commit your changes on the R1 device. [edit ] user@R1# commit 5. Configure the hostname on the R2 (customer) device. [edit ] user@R2# set system host-name R2 6. Configure the interfaces on the R2 (customer) device. [edit interfaces] user@R2# set ge-0/0/0 unit 0 description "Link from R2 to R1" user@R2# set ge-0/0/0 unit 0 family inet address 172.16.1.2/24 user@R2# set lo0 unit 0 family inet address 192.168.47.5/32 user@R2# set lo0 unit 0 family inet address 192.168.47.6/32 7. Define the IPv4 static default route on the R2 device. Be sure to specify the R1 end of the point-to-point link as the next hop for the static route. The IPv4 default route ensures the customer can route to all nonlocal destinations by forwarding traffic to the R1 device in the provider network. [edit routing-options] user@R2# set static route 0.0.0.0/0 next-hop 172.16.1.1 8. Commit your changes on the R2 device. [edit] user@R2# commit ----------------- IPv6 Static Route ---------------- `````````` R1 Device (Provider) `````````` set system host-name R1 set interfaces ge-0/0/0 description "Link from R1 to R2" set interfaces ge-0/0/0 unit 0 family inet6 address 2001:db8:1:1::1/126 set interfaces lo0 unit 0 family inet6 address 2001:db8:1:10::1/128 set interfaces lo0 unit 0 family inet6 address 2001:db8:1:11::1/128 set routing-options rib inet6.0 static route 2001:db8:2::/48 next-hop 2001:db8:1:1::2 `````````` R2 Device (Customer) `````````` set system host-name R2 set interfaces ge-0/0/0 description "Link from R2 to R1" set interfaces ge-0/0/0 unit 0 family inet6 address 2001:db8:1:1::2/126 set interfaces lo0 unit 0 family inet6 address 2001:db8:2:10::1/128 set interfaces lo0 unit 0 family inet6 address 2001:db8:2:11::1/128 set routing-options rib inet6.0 static route ::/0 next-hop 2001:db8:1:1::1 ----------------- Troubleshooting Static Route ---------------- [edit] root# show route [edit] root# show route protocol static user@R1# show routing-options user@R1# show configuration routing-options static | display set user@R1# show interfaces user@R6> show route 10.0.0.5 user@host> show < configuration | bgp | interfaces | isis | ospf | route > user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ----------------- Remove or delete Static Route ---------------- user@R2# delete routing-options static route destination-prefix [edit] user@R2# delete routing-options static route 10.0.0.5/32 ************************* Open Shortest Path First (OSPF) Configs ************************* 1. Configure the interface. [edit] user@host# set interfaces ge-0/2/0 unit 0 family inet address 10.0.0.1 2. Create an OSPF area. [edit] user@host# edit protocols ospf area 0.0.0.1 3. Assign the interface to the area. [edit protocols ospf area 0.0.0.1 ] user@host# set interface ge-0/2/0 4. If you are done configuring the device, commit the configuration. [edit protocols ospf area 0.0.0.1 ] user@host# commit 5. Configure the security zone to allow the inbound OSPF traffic into the interfaces that are active [edit] user@host# set security zones security-zone Trust host-inbound-traffic protocols all user@host# set security zones security-zone Trust host-inbound-traffic system-services all user@host# set groups global security policies default-policy permit-all user@host# set security zones security-zone Trust interfaces ge-0/2/0 user@host# commit NOTE: You can also enable specific protocols or services for a security zone instead of all protocols or services. For instance, OSPF protocol or SSH service in this example: set security zones security-zone Trust host-inbound-traffic protocols ospf set security zones security-zone Trust host-inbound-traffic system-services ssh ----------------- Remove or delete OSPF ---------------- [edit] root# delete set protocols ospf area 0 interface ge-0/0/1 ----------------- Troubleshooting OSPF ---------------- [edit] root# run show route user@host> show ospf route user@host> show ospf interface user@host> show ospf database user@host# show protocols ospf user@host# show protocols user@host# show interfaces user@host> show ospf neighbor user@host# show routing-options user@host# show configuration protocols ospf | display set user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ************************* RIP Configs ************************* ----------------- Router 1 ---------------- 1. Configure the network interfaces. [edit interfaces] user@R1# set fe-1/2/0 unit 1 family inet address 10.0.0.1/30 user@R1# set lo0 unit 1 family inet address 172.16.0.1/32 user@R1# set lo0 unit 1 family inet address 192.168.1.1/32 2. Create the RIP group and add the interface. [edit protocols rip group rip-group] user@R1# set neighbor fe-1/2/0.1 3. Create the routing policy to advertise both direct and RIP-learned routes. [edit policy-options policy-statement advertise-routes-through-rip term 1] user@R1# set from protocol direct user@R1# set from protocol rip user@R1# set then accept 4. Apply the routing policy. [edit protocols rip group rip-group] user@R1# set export advertise-routes-through-rip ----------------- Router 2 ---------------- set interfaces fe-1/2/0 unit 2 family inet address 10.0.0.2/30 set interfaces fe-1/2/1 unit 5 family inet address 10.0.0.5/30 set interfaces lo0 unit 2 family inet address 192.168.2.2/32 set interfaces lo0 unit 2 family inet address 172.16.2.2/32 set protocols rip group rip-group export advertise-routes-through-rip set protocols rip group rip-group neighbor fe-1/2/0.2 set protocols rip group rip-group neighbor fe-1/2/1.5 set policy-options policy-statement advertise-routes-through-rip term 1 from protocol direct set policy-options policy-statement advertise-routes-through-rip term 1 from protocol rip set policy-options policy-statement advertise-routes-through-rip term 1 then accept ----------------- Router 3 ---------------- set interfaces fe-1/2/0 unit 6 family inet address 10.0.0.6/30 set interfaces lo0 unit 3 family inet address 192.168.3.3/32 set interfaces lo0 unit 3 family inet address 172.16.3.3/32 set protocols rip group rip-group export advertise-routes-through-rip set protocols rip group rip-group neighbor fe-1/2/0.6 set policy-options policy-statement advertise-routes-through-rip term 1 from protocol direct set policy-options policy-statement advertise-routes-through-rip term 1 from protocol rip set policy-options policy-statement advertise-routes-through-rip term 1 then accept ----------------- RIP Troubleshooting ---------------- user@R1# show protocols user@R1# show policy-options user@R1> show route protocol rip user@R1> show route advertising-protocol rip 10.0.0.1 user@R1> show route receive-protocol rip 10.0.0.2 user@R1> show rip neighbor user@R1> show rip statistics user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ----------------- RIPng configs ---------------- 1. Configure the network interfaces. [edit interfaces] user@R1# set fe-1/2/0 unit 1 description to-R2 user@R1# set fe-1/2/0 unit 1 family inet6 address 2001:db8:0:1::/64 eui-64 user@R1# set lo0 unit 1 family inet6 address 2001:db8::1/128 2. Create the RIPng group and add the interface. [edit protocols ripng group ripng-group] user@R1# set neighbor fe-1/2/0.1 3. Create the routing policy to advertise both direct and RIPng-learned routes. [edit policy-options policy-statement advertise-routes-through-ripng term 1] user@R1# set from protocol direct user@R1# set from protocol ripng user@R1# set then accept 4. Apply the routing policy. [edit protocols ripng group ripng-group] user@R1# set export advertise-routes-through-ripng ----------------- RIPng Troubleshooting ---------------- user@R1> show route protocol ripng user@R1> show ripng neighbor user@R1> show interfaces terse user@R1> show route advertising-protocol ripng fe80::2a0:a514:0:14c user@R1> show route receive-protocol ripng fe80::2a0:a514:0:24c user@R1> show ripng statistics user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ********************** Border Gateway Protocol (BGP ) ********************** eBGP is configured b/w different ASs like AS100, AS200 and AS300 iBGP is configured within same AS ------------- eBGP on Router 1 as AS100 ------------- user@R1# set protocols bgp group BGP-GROUP local-as 100 user@R1# set protocols bgp group BGP-GROUP neighbor 192.168.10.2(Neighbour-Router-Interface-IP) peer-as 200(Neighbour-AS) user@R1# set group BGP-GROUP type external optional to define eBGP configs ------------- eBGP on Router 2 as AS200 ------------- user@R1# set protocols bgp group BGP-GROUP local-as 200 user@R1# set protocols bgp group BGP-GROUP neighbor 192.168.10.1(Neighbour-Router-Interface-IP) peer-as 100(Neighbour-AS) user@R1# set group BGP-GROUP type external optional to define eBGP configs ------------- iBGP on Router 1 as AS100 ------------- user@R1# set routing-options autonomous-system 100 user@R1# set group BGP-GROUP neighbour 192.168.10.1 peer-as 100 user@R1# set group BGP-GROUP type internal optional to define iBGP configs ------------- iBGP on Router 2 as AS100 ------------- user@R1# set routing-options autonomous-system 100 user@R1# set group BGP-GROUP neighbour 192.168.10.2 peer-as 100 user@R1# set group BGP-GROUP type internal optional to define iBGP configs ------------- BGP Troubleshooting ------------- show | compare show configuration protocols bgp | display set show BGP neighbour show BGP summary user@R1# run show route martians to check whether routes are allowed to configure or disallowed user@R1# run show route forwarding-table ----------- Delete or Remove BGP configs ------------ delete protocols bgp ________________________________________________________________________________________________________________________ <<<<<<<<<<<<<<<<<<<<<<<<<< SRX Firewalls Configs >>>>>>>>>>>>>>>>>>>>>>>>>> method 1 [edit] root# edit security [edit security] root# set zones security-zone TRUST defines zones [edit security] root# set zones security-zone UNTRUST defines zones [edit security] root# set zones security-zone UNTRUST interfaces ge-0/0/0 [edit security] root# set zones security-zone TRUST address-book address Local_LAN1 192.168.10.0/24 method 2 [edit] root# set security zones security-zone UNTRUST interfaces ge-0/0/0 Zone congiurations and WAN facing interface as untrust [edit] root# set security zones security-zone UNTRUST host-inbounf-traffic system-services all allow all services [edit] root# set security zones security-zone UNTRUST host-inbounf-traffic protocols all allow all protocols [edit] root# set security zones security-zone TRUST interfaces ge-0/0/1 Zone congiurations and LAN facing interface as trust [edit] root# set security zones security-zone TRUST host-inbounf-traffic system-services all allow all services [edit] root# set security zones security-zone TRUST host-inbounf-traffic protocols all allow all protocols **************** SRX Firewalls security Policies Configs **************** [edit security] root# set policies from-zone TRUST to-zone UNTRUST policy LANtoWAN match source-address Local_LAN1 [edit security] root# set policies from-zone TRUST to-zone UNTRUST policy LANtoWAN match destination-address any [edit security] root# set policies from-zone TRUST to-zone UNTRUST policy LANtoWAN match application any [edit security] root# set policies from-zone TRUST to-zone UNTRUST policy LANtoWAN then permit method 2 -------allow all traffic from LANtoWAN------ [edit security policies from-zone TRUST to-zone UNTRUST policy LANtoWAN] root# set match source-address any [edit security policies from-zone TRUST to-zone UNTRUST policy LANtoWAN] root# set match destination-address any [edit security policies from-zone TRUST to-zone UNTRUST policy LANtoWAN] root# set match application any [edit security policies from-zone TRUST to-zone UNTRUST policy LANtoWAN] root# set then permit --------Deny all traffic from WANtoLAN------- [edit security policies from-zone UNTRUST to-zone TRUST policy WANtoLAN] root# set match source-address any [edit security policies from-zone UNTRUST to-zone TRUST policy WANtoLAN] root# set match destination-address any [edit security policies from-zone UNTRUST to-zone TRUST policy WANtoLAN] root# set match application any [edit security policies from-zone UNTRUST to-zone TRUST policy WANtoLAN] root# set then deny [edit security policies from-zone UNTRUST to-zone TRUST policy WANtoLAN] root# exit [edit] root# commit --------configure static route-------- [edit] root# set routing-options static route 0.0.0.0/0 next hop 192.168.8.1 --------configure NAT-------- [edit] root# set security nat source rule-set LANtoWAN from zone trust [edit] root# set security nat source rule-set LANtoWAN to zone untrust [edit] root# set security nat source rule-set LANtoWAN rule SUBNET10 match source-address LAN_NET_ADDRESS/CIDR [edit] root# set security nat source rule-set LANtoWAN rule SUBNET10 match destination-address 0.0.0.0/0 [edit] root# set security nat source rule-set LANtoWAN rule SUBNET10 then source-nat interface [edit] root# commit **************** SRX Firewalls Troubleshootings **************** [edit security] root# show zones [edit security] root# show | compare set cli timestamp - Enable CLI timestamps show chassis alarms - Show hardware alarms show system alarms - Show system alarms show virtual-chassis status - Show VC status, members, roles show log messages - Show system logs show log messages | last 100 - Show last 100 logs show log messages | except "is Unreachable" - Filter NTP unreachable logs show log messages | last 100 | except "is Unreachable" - Filter recent logs show krt queue - Show kernel routing queues show route active-path - Show active routing path show route active-path 11.248.11.2 - Check routing to 11.248.11.2 show route active-path 10.248.11.2 - Check routing to 10.248.11.2 show route active-path 10.60.1.1 - Check routing to gateway show configuration - Show full configuration show configuration | display set - Show config in set format show configuration | display set | match 901 - Show VLAN 901 config show configuration | display set | no-more - Show full config without paging show arp no-resolve - Show ARP table show arp no-resolve | match 901 - Show ARP for VLAN 901 ping - Ping destination ping rapid count 100 - Stress ping test ping 10.60.1.3 rapid count 100 - Ping peer interface ping 10.60.1.1 rapid count 100 - Ping gateway show interfaces descriptions - Show all interfaces show interfaces descriptions | match ae2 - Show ae2 interface show interfaces descriptions | match Free - Show unused interfaces show interfaces descriptions | match Free except Free - Show active interfaces traceroute no-resolve - Trace route without DNS show chassis hardware - Show hardware inventory show chassis hardware | match chassis - Show chassis serial show arp - Show ARP table ************************** STC ************************** .Dear Mc, this is service impact as one link is down so you need to check & fix the issue to restore the service @PE-L3Agg-MX2K-Una-602-2-re1> show interfaces descriptions | match MNTHQIAJ ge-100/0/1 down down TYP=INT;VID=0;NBR=By NCM: Task ID 86413 - HU-NGN-MNTHQIAJ Active ge-101/0/1 up up TYP=INT;VID=0;NBR=By NCM: Task ID 86413 - HU-NGN-MNTHQIAJ Standby set version 11.2R4.3 set system host-name nespk2 set system root-authentication encrypted-password "nespk@123" set system login user nbp uid 2000 set system login user nbp class super-user set system login user nbp authentication encrypted-password "$1$bxcF.2ig$rR8OGl3KDADqBUyFzE9X8." set system services ssh set system services telnet set interfaces fe-0/0/0 unit 0 family inet set interfaces gr-0/0/0 unit 5 description "**** BCP Satcom OF Primray ****" set interfaces gr-0/0/0 unit 5 tunnel source 192.168.150.225 set interfaces gr-0/0/0 unit 5 tunnel destination 192.168.150.253 set interfaces gr-0/0/0 unit 5 family inet address 10.201.241.174/30 set interfaces gr-0/0/0 unit 6 description "**** BCP Mobilink OF Primray ****" set interfaces gr-0/0/0 unit 6 tunnel source 10.125.1.2 set interfaces gr-0/0/0 unit 6 tunnel destination 10.125.1.1 set interfaces gr-0/0/0 unit 6 family inet address 10.201.241.178/30 set interfaces fe-0/0/1 description Jazz-Secondary set interfaces fe-0/0/1 unit 0 family inet mtu 1420 set interfaces fe-0/0/1 unit 0 family inet address 10.125.1.2/30 set interfaces fe-0/0/2 description LAN set interfaces fe-0/0/2 unit 0 family inet address 10.201.29.1/24 set interfaces fe-0/0/3 unit 0 family inet mtu 1420 set interfaces gr-0/0/3 unit 0 set interfaces fe-0/0/4 description Satcom-Primary set interfaces fe-0/0/4 unit 0 family inet address 192.168.150.225/30 set interfaces lo0 unit 0 family inet address 10.255.201.240/32 set snmp community "nbP@Nms2019" authorization read-only set snmp community public authorization read-only set snmp community public clients 10.10.48.188/32 set routing-options static route 192.168.150.252/30 next-hop 192.168.150.226 set routing-options static route 10.125.1.0/30 next-hop 10.125.1.1 set routing-options static route 0.0.0.0/0 next-hop gr-0/0/0.6 set protocols ospf area 0.0.0.105 stub set protocols ospf area 0.0.0.105 interface gr-0/0/0.5 metric 2000 set protocols ospf area 0.0.0.105 interface gr-0/0/0.6 set protocols ospf area 0.0.0.105 interface fe-0/0/2.0 set protocols ospf area 0.0.0.105 interface lo0.0 set security policies default-policy permit-all set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces lo0.0 set security zones security-zone untrust interfaces gr-0/0/0.5 set security zones security-zone untrust interfaces fe-0/0/1.0 set security zones security-zone untrust interfaces gr-0/0/0.6 set security zones security-zone untrust interfaces fe-0/0/2.0 set security zones security-zone untrust interfaces fe-0/0/4.0 root@nespk# show | display set set version 12.1X44-D35.5 set system host-name nespk set system time-zone GMT+5 set system root-authentication encrypted-password "$1$CNB0ZWO0$xHFwRPZVrEAIRbS76.cWP/" set system name-server 208.67.222.222 set system name-server 208.67.220.220 set system login user faraz uid 2000 set system login user faraz class super-user set system login user faraz authentication encrypted-password "$1$uKTMYkR1$1xwjr3SZwgIEFLoZRbF4g." set system services ssh root-login allow set system services xnm-clear-text set system services web-management http interface vlan.0 deactivate system services web-management http set system services web-management https system-generated-certificate set system services web-management https interface vlan.0 set system services web-management https interface fe-0/0/0.0 set system syslog archive size 100k set system syslog archive files 3 set system syslog user * any emergency set system syslog host 10.33.0.166 security any set system syslog host 10.33.0.166 facility-override local4 set system syslog file messages any any set system syslog file messages authorization info set system syslog file interactive-commands interactive-commands error set system syslog source-address 10.66.18.50 set system max-configurations-on-flash 5 set system max-configuration-rollbacks 5 set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval set system ntp server 10.33.0.166 set interfaces fe-0/0/0 unit 0 set interfaces fe-0/0/1 unit 0 description PRIMARY-JAZZ-WAN-PMP set interfaces fe-0/0/1 unit 0 family inet address 172.25.4.130/29 set interfaces fe-0/0/2 unit 0 description SECONDARY-ST-WAN-LTE set interfaces fe-0/0/2 unit 0 family inet address 172.25.1.230/30 set interfaces fe-0/0/3 unit 0 family ethernet-switching vlan members vlan-trust set interfaces fe-0/0/4 unit 0 family ethernet-switching vlan members vlan-trust set interfaces fe-0/0/5 unit 0 family ethernet-switching vlan members vlan-trust set interfaces fe-0/0/6 unit 0 family ethernet-switching vlan members vlan-trust set interfaces st0 unit 0 family inet set interfaces st0 unit 10 description PRI-LHR-0320-SHADRA-DR-JAZZ set interfaces st0 unit 10 family inet address 192.168.61.98/30 set interfaces st0 unit 20 description BKUP-LHR-0320-SHADRA-DR-ST set interfaces st0 unit 20 family inet mtu 1500 set interfaces st0 unit 20 family inet address 192.168.15.38/32 set interfaces st0 unit 87 description PRI-LHR-0320-SHADRA-HO-JAZZ set interfaces st0 unit 87 family inet address 192.168.87.98/30 set interfaces st0 unit 90 description BKUP-LHR-0320-SHADRA-HO-ST set interfaces st0 unit 90 family inet address 192.168.91.38/30 set interfaces vlan unit 0 description LAN-SEGMENT set interfaces vlan unit 0 family inet address 10.66.18.50/24 set interfaces vlan unit 1 family inet address 172.16.100.2/24 set snmp community egiblpk334357 clients 10.33.0.105/32 set snmp community egiblpk authorization read-only set snmp community egiblpk clients 10.33.0.105/32 set routing-options static route 172.25.1.0/30 next-hop 172.25.1.229 set routing-options static route 10.16.102.5/32 next-hop 172.25.1.229 set routing-options static route 172.25.6.0/29 next-hop 172.25.4.129 set routing-options static route 10.16.102.4/32 next-hop 172.25.4.129 set routing-options static route 172.25.6.8/29 next-hop 172.25.4.129 set routing-options static route 10.15.102.4/32 next-hop 172.25.4.129 set routing-options static route 172.25.1.4/30 next-hop 172.25.1.229 set routing-options static route 10.15.102.5/32 next-hop 172.25.1.229 set protocols ospf area 0.0.0.21 nssa set protocols ospf area 0.0.0.21 interface st0.87 interface-type p2p set protocols ospf area 0.0.0.21 interface st0.87 metric 10 set protocols ospf area 0.0.0.21 interface st0.10 interface-type p2p set protocols ospf area 0.0.0.21 interface st0.10 metric 50 set protocols ospf area 0.0.0.21 interface vlan.1 passive set protocols ospf area 0.0.0.21 interface vlan.0 passive set protocols ospf area 0.0.0.21 interface st0.90 interface-type p2p set protocols ospf area 0.0.0.21 interface st0.90 metric 30 set protocols ospf area 0.0.0.21 interface st0.20 interface-type p2p set protocols ospf area 0.0.0.21 interface st0.20 metric 80 set protocols ospf area 0.0.0.21 interface st0.20 neighbor 192.168.61.97 set protocols stp set security ike proposal IKE-Proposal authentication-method pre-shared-keys set security ike proposal IKE-Proposal dh-group group2 set security ike proposal IKE-Proposal authentication-algorithm md5 set security ike proposal IKE-Proposal encryption-algorithm 3des-cbc set security ike proposal IKE-Proposal lifetime-seconds 28800 set security ike proposal IKE authentication-method pre-shared-keys set security ike proposal IKE dh-group group2 set security ike proposal IKE authentication-algorithm md5 set security ike proposal IKE encryption-algorithm 3des-cbc set security ike policy IKE-policy mode main set security ike policy IKE-policy proposals IKE-Proposal set security ike policy IKE-policy pre-shared-key ascii-text "$9$pXIQuIEylK8xNrlgoJGiHBIRElK8X7sgo7N" set security ike policy IKE-POLICY mode main set security ike policy IKE-POLICY proposals IKE set security ike policy IKE-POLICY pre-shared-key ascii-text "$9$bXwsgaJDjkmCtK87dg4TzF6p01Rh" set security ike policy IKE-POLICY-DR mode main set security ike policy IKE-POLICY-DR proposals IKE set security ike policy IKE-POLICY-DR pre-shared-key ascii-text "$9$Osu5B1ESyKv8xoJz6AuEh4aJGk.f5z" set security ike policy IKE-POLICY-HO mode main set security ike policy IKE-POLICY-HO proposals IKE set security ike policy IKE-POLICY-HO pre-shared-key ascii-text "$9$47oaGji.m5zO1X-w2GU69CpIESre" set security ike policy IKE-POLICY-DR-SEC mode main set security ike policy IKE-POLICY-DR-SEC proposals IKE set security ike policy IKE-POLICY-DR-SEC pre-shared-key ascii-text "$9$7QN-bY2aJUi36SeWXbwFn690BRES" set security ike gateway GW-TO-HO ike-policy IKE-policy set security ike gateway GW-TO-HO address 192.168.95.226 set security ike gateway GW-TO-HO external-interface fe-0/0/0.0 set security ike gateway PRI-GW-HO ike-policy IKE-POLICY set security ike gateway PRI-GW-HO address 10.16.102.4 set security ike gateway PRI-GW-HO external-interface fe-0/0/1.0 set security ike gateway PRI-GW-DR ike-policy IKE-POLICY-DR set security ike gateway PRI-GW-DR address 10.15.102.4 set security ike gateway PRI-GW-DR external-interface fe-0/0/1.0 set security ike gateway SEC-GW-HO ike-policy IKE-POLICY-HO set security ike gateway SEC-GW-HO address 10.16.102.5 set security ike gateway SEC-GW-HO external-interface fe-0/0/2.0 set security ike gateway DR-GW-DR ike-policy IKE-POLICY-DR-SEC set security ike gateway DR-GW-DR address 10.15.102.5 set security ike gateway DR-GW-DR external-interface fe-0/0/2.0 set security ipsec proposal IPSEC-Proposal protocol esp set security ipsec proposal IPSEC-Proposal authentication-algorithm hmac-md5-96 set security ipsec proposal IPSEC-Proposal encryption-algorithm 3des-cbc set security ipsec proposal IPSEC protocol esp set security ipsec proposal IPSEC authentication-algorithm hmac-md5-96 set security ipsec proposal IPSEC encryption-algorithm 3des-cbc set security ipsec proposal IPSEC lifetime-seconds 3600 set security ipsec policy IPSEC-Policy proposals IPSEC-Proposal set security ipsec policy IPSEC-policy perfect-forward-secrecy keys group2 set security ipsec policy IPSEC-policy proposals IPSEC set security ipsec vpn VPN-to-HO bind-interface st0.0 set security ipsec vpn VPN-to-HO ike gateway GW-TO-HO set security ipsec vpn VPN-to-HO ike proxy-identity local 10.66.18.0/24 set security ipsec vpn VPN-to-HO ike proxy-identity remote 0.0.0.0/0 set security ipsec vpn VPN-to-HO ike proxy-identity service any set security ipsec vpn VPN-to-HO ike ipsec-policy IPSEC-Policy set security ipsec vpn VPN-to-HO establish-tunnels immediately set security ipsec vpn ABB-HO bind-interface st0.87 set security ipsec vpn ABB-HO ike gateway PRI-GW-HO set security ipsec vpn ABB-HO ike proxy-identity service any set security ipsec vpn ABB-HO ike ipsec-policy IPSEC-policy set security ipsec vpn ABB-HO establish-tunnels immediately set security ipsec vpn ABB-DR bind-interface st0.10 set security ipsec vpn ABB-DR ike gateway PRI-GW-DR set security ipsec vpn ABB-DR ike proxy-identity service any set security ipsec vpn ABB-DR ike ipsec-policy IPSEC-policy set security ipsec vpn ABB-DR establish-tunnels immediately set security ipsec vpn ABB-HO-SEC bind-interface st0.90 set security ipsec vpn ABB-HO-SEC ike gateway SEC-GW-HO set security ipsec vpn ABB-HO-SEC ike proxy-identity service any set security ipsec vpn ABB-HO-SEC ike ipsec-policy IPSEC-policy set security ipsec vpn ABB-HO-SEC establish-tunnels immediately set security ipsec vpn ABB-DR-SEC bind-interface st0.20 set security ipsec vpn ABB-DR-SEC ike gateway DR-GW-DR set security ipsec vpn ABB-DR-SEC ike proxy-identity service any set security ipsec vpn ABB-DR-SEC ike ipsec-policy IPSEC-policy set security ipsec vpn ABB-DR-SEC establish-tunnels immediately set security screen ids-option untrust-screen icmp ping-death set security screen ids-option untrust-screen ip source-route-option set security screen ids-option untrust-screen ip tear-drop set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024 set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200 set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024 set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048 set security screen ids-option untrust-screen tcp syn-flood timeout 20 set security screen ids-option untrust-screen tcp land set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit set security policies from-zone Internal to-zone DMZ policy to-ho match source-address LAN set security policies from-zone Internal to-zone DMZ policy to-ho match destination-address HO set security policies from-zone Internal to-zone DMZ policy to-ho match destination-address HO1 set security policies from-zone Internal to-zone DMZ policy to-ho match destination-address HO2 set security policies from-zone Internal to-zone DMZ policy to-ho match destination-address HO4 set security policies from-zone Internal to-zone DMZ policy to-ho match destination-address HO5 set security policies from-zone Internal to-zone DMZ policy to-ho match application any set security policies from-zone Internal to-zone DMZ policy to-ho then permit set security policies from-zone DMZ to-zone Internal policy from-ho match source-address HO set security policies from-zone DMZ to-zone Internal policy from-ho match source-address HO1 set security policies from-zone DMZ to-zone Internal policy from-ho match source-address HO2 set security policies from-zone DMZ to-zone Internal policy from-ho match source-address HO4 set security policies from-zone DMZ to-zone Internal policy from-ho match source-address HO5 set security policies from-zone DMZ to-zone Internal policy from-ho match destination-address LAN set security policies from-zone DMZ to-zone Internal policy from-ho match application any set security policies from-zone DMZ to-zone Internal policy from-ho then permit set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone Internal address-book address LAN 10.66.18.0/24 set security zones security-zone Internal host-inbound-traffic system-services all set security zones security-zone Internal host-inbound-traffic protocols all set security zones security-zone Internal interfaces vlan.0 set security zones security-zone DMZ address-book address HO 10.0.0.0/8 set security zones security-zone DMZ address-book address HO1 172.16.0.0/16 set security zones security-zone DMZ address-book address HO2 172.22.83.1/32 set security zones security-zone DMZ address-book address HO4 172.20.0.0/16 set security zones security-zone DMZ address-book address HO5 0.0.0.0/0 set security zones security-zone DMZ screen untrust-screen set security zones security-zone DMZ host-inbound-traffic system-services all set security zones security-zone DMZ host-inbound-traffic protocols all set security zones security-zone DMZ interfaces fe-0/0/0.0 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces fe-0/0/0.0 host-inbound-traffic protocols all set security zones security-zone DMZ interfaces fe-0/0/1.0 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces fe-0/0/1.0 host-inbound-traffic protocols all set security zones security-zone DMZ interfaces st0.0 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces st0.0 host-inbound-traffic protocols all set security zones security-zone DMZ interfaces st0.87 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces st0.10 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces fe-0/0/2.0 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces fe-0/0/2.0 host-inbound-traffic protocols all set security zones security-zone DMZ interfaces st0.90 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces st0.20 host-inbound-traffic system-services all set security zones security-zone DMZ interfaces st0.20 host-inbound-traffic protocols all set security zones security-zone untrust set vlans vlan-trust vlan-id 3 set vlans vlan-trust l3-interface vlan.0