Learning IOS and JUNOS

[POC] Cisco vs Juniper running OSPF w/o Backbone Area 0

noreply@blogger.com (CCIE11440) — Fri, 30 May 2014 10:06:00 +0000

As everyone knows that OSPFv2 is a standard routing protocol (http://www.ietf.org/rfc/rfc2328.txt), but not all vendors device will implement it exactly the same. Especially when the network scenario was not follow the standard design, then it might have different exceptional behavior in different vendor devices.

In order to compare the difference behavior between Cisco and Juniper. I designed a special OSPF topology just like below, so we can see Cisco and Juniper have different result of routing exchange behavior.

Cisco IOS (GNS3)

When we are using Cisco device with IOS to simulate this topology:

R1 will not receive any routes. But if you check the R1 OSPF database, actually, you still see that LSA type 5 was received from R2, even R2 is not an ABR(because it has no backbone area 0).
R2 will learn all routes because it belong to both OSPF areas.
R3 will only learn all routes which was belong to area 2.

R1#sh running-config
Building configuration...

Current configuration : 1144 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
ip subnet-zero
no ip icmp rate-limit unreachable
ip cef
!
!
ip tcp synwait-time 5
no ip domain-lookup
!
no mpls traffic-eng auto-bw timers frequency 0
call rsvp-sync
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.252
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
router ospf 1
log-adjacency-changes
network 1.1.1.1 0.0.0.0 area 1
network 10.1.1.0 0.0.0.3 area 1
!
ip classless
!
no ip http server
!
!
!
!
!
!
control-plane
!
!
dial-peer cor custom
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
no login
!
!
end

R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

10.0.0.0/30 is subnetted, 1 subnets

C 10.1.1.0 is directly connected, FastEthernet0/0

R1#sh ip ospf database

OSPF Router with ID (10.1.1.1) (Process ID 1)

Router Link States (Area 1)

Link ID ADV Router Age Seq# Checksum Link count
2.2.2.2 2.2.2.2 882 0x80000003 0x005AA9 1
10.1.1.1 10.1.1.1 903 0x80000003 0x00CB31 1

Net Link States (Area 1)

Link ID ADV Router Age Seq# Checksum
10.1.1.1 10.1.1.1 903 0x80000002 0x003ECE

Type-5 AS External Link States

Link ID ADV Router Age Seq# Checksum Tag
100.100.100.0 10.1.1.6 697 0x80000002 0x003A26 0

R2#sh run
Building configuration...

Current configuration : 1297 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
ip subnet-zero
no ip icmp rate-limit unreachable
ip cef
!
!
ip tcp synwait-time 5
no ip domain-lookup
!
no mpls traffic-eng auto-bw timers frequency 0
call rsvp-sync
!
!
!
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
no clns route-cache
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.252
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet0/1
ip address 10.1.1.5 255.255.255.252
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
router ospf 1
log-adjacency-changes
redistribute static subnets
network 2.2.2.2 0.0.0.0 area 2
network 10.1.1.0 0.0.0.3 area 1
network 10.1.1.4 0.0.0.3 area 2
!
ip classless
!
no ip http server
!
!
!
!
!
!
control-plane
!
!
dial-peer cor custom
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
no login
!
!
end

R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

2.0.0.0/32 is subnetted, 1 subnets
C 2.2.2.2 is directly connected, Loopback0
100.0.0.0/24 is subnetted, 1 subnets
O E2 100.100.100.0 [110/20] via 10.1.1.6, 00:51:05, FastEthernet0/1
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/2] via 10.1.1.6, 00:51:05, FastEthernet0/1
10.0.0.0/30 is subnetted, 2 subnets
C 10.1.1.0 is directly connected, FastEthernet0/0

C 10.1.1.4 is directly connected, FastEthernet0/1

R2#sh ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 1)

Router Link States (Area 1)

Link ID ADV Router Age Seq# Checksum Link count

2.2.2.2 2.2.2.2 1315 0x80000003 0x005AA9 1

10.1.1.1 10.1.1.1 1338 0x80000003 0x00CB31 1

Net Link States (Area 1)

Link ID ADV Router Age Seq# Checksum

10.1.1.1 10.1.1.1 1338 0x80000002 0x003ECE

Router Link States (Area 2)

Link ID ADV Router Age Seq# Checksum Link count

2.2.2.2 2.2.2.2 1315 0x80000004 0x00DC06 2

10.1.1.6 10.1.1.6 1130 0x80000005 0x00794F 2

Net Link States (Area 2)

Link ID ADV Router Age Seq# Checksum

10.1.1.5 2.2.2.2 1315 0x80000002 0x00A365

Type-5 AS External Link States

Link ID ADV Router Age Seq# Checksum Tag

100.100.100.0 10.1.1.6 1130 0x80000002 0x003A26 0

R3#sh run
Building configuration...

Current configuration : 1295 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
ip subnet-zero
no ip icmp rate-limit unreachable
ip cef
!
!
ip tcp synwait-time 5
no ip domain-lookup
!
no mpls traffic-eng auto-bw timers frequency 0
call rsvp-sync
!
!
!
!
!
!
!
!
interface Loopback0
ip address 3.3.3.3 255.255.255.255
no clns route-cache
!
interface FastEthernet0/0
ip address 10.1.1.6 255.255.255.252
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
no clns route-cache
!
router ospf 1
log-adjacency-changes
redistribute static subnets
network 3.3.3.3 0.0.0.0 area 2
network 10.1.1.4 0.0.0.3 area 2
!
ip classless
ip route 100.100.100.0 255.255.255.0 Null0
!
no ip http server
!
!
!
!
!
!
control-plane
!

!
dial-peer cor custom
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
no login
!
!
end

R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/2] via 10.1.1.5, 00:52:24, FastEthernet0/0
100.0.0.0/24 is subnetted, 1 subnets
S 100.100.100.0 is directly connected, Null0
3.0.0.0/32 is subnetted, 1 subnets
C 3.3.3.3 is directly connected, Loopback0
10.0.0.0/30 is subnetted, 1 subnets

C 10.1.1.4 is directly connected, FastEthernet0/0

R3# sh ip ospf database

OSPF Router with ID (10.1.1.6) (Process ID 1)

Router Link States (Area 2)

Link ID ADV Router Age Seq# Checksum Link count

2.2.2.2 2.2.2.2 1387 0x80000004 0x00DC06 2

10.1.1.6 10.1.1.6 1200 0x80000005 0x00794F 2

Net Link States (Area 2)

Link ID ADV Router Age Seq# Checksum

10.1.1.5 2.2.2.2 1387 0x80000002 0x00A365

Type-5 AS External Link States

Link ID ADV Router Age Seq# Checksum Tag

100.100.100.0 10.1.1.6 1200 0x80000002 0x003A26 0

Juniper JUNOS(olive)

When we are using Juniper device with JUNOS to simulate the same topology:

R1 will receive all routes. Just like we still have OSPF backbone area 0.
R2 will learn all routes because it belong to both OSPF areas.
R3 will receive all routes. Just like we still have OSPF backbone area 0.

lab# show logical-systems R1
interfaces {
em1 {
unit 12 {
vlan-id 12;
family inet {
address 10.1.1.1/30;
}
}
}
lo0 {
unit 1 {
family inet {
address 1.1.1.1/32;
}
}
}
}
protocols {
ospf {
area 0.0.0.1 {
interface em1.12;
interface lo0.1;
}
}
}

lab# run show route logical-system R1

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

1.1.1.1/32 *[Direct/0] 02:19:11

> via lo0.1

2.2.2.2/32 *[OSPF/10] 00:03:01, metric 1

> to 10.1.1.2 via em1.12

3.3.3.3/32 *[OSPF/10] 00:03:01, metric 2

> to 10.1.1.2 via em1.12

10.1.1.0/30 *[Direct/0] 00:03:46

> via em1.12

10.1.1.1/32 *[Local/0] 00:03:46

Local via em1.12

10.1.1.4/30 *[OSPF/10] 00:03:01, metric 2

> to 10.1.1.2 via em1.12

100.100.100.0/24 *[OSPF/150] 00:03:01, metric 0, tag 0

> to 10.1.1.2 via em1.12

224.0.0.5/32 *[OSPF/10] 02:13:34, metric 1

MultiRecv

[edit]

lab# run show ospf database detail logical-system R1

OSPF database, Area 0.0.0.1

Type ID Adv Rtr Seq Age Opt Cksum Len

Router *1.1.1.1 1.1.1.1 0x8000001b 206 0x22 0x2eb3 48

bits 0x0, link count 2

id 10.1.1.2, data 10.1.1.1, Type Transit (2)

Topology count: 0, Default metric: 1

id 1.1.1.1, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.2

Metric: 1, Bidirectional

Router 2.2.2.2 2.2.2.2 0x8000001b 207 0x22 0x31ba 36

bits 0x1, link count 1

id 10.1.1.2, data 10.1.1.2, Type Transit (2)

Topology count: 0, Default metric: 1

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.2

Metric: 1, Bidirectional

Network 10.1.1.2 2.2.2.2 0x80000004 207 0x22 0x1404 32

mask 255.255.255.252

attached router 2.2.2.2

attached router 1.1.1.1

Topology default (ID 0)

Type: Transit, Node ID: 1.1.1.1

Metric: 0, Bidirectional

Type: Transit, Node ID: 2.2.2.2

Metric: 0, Bidirectional

Summary 2.2.2.2 2.2.2.2 0x80000004 2007 0x22 0xea3f 28

mask 255.255.255.255

Topology default (ID 0) -> Metric: 0

Summary 3.3.3.3 2.2.2.2 0x80000003 207 0x22 0xc85d 28

mask 255.255.255.255

Topology default (ID 0) -> Metric: 1

Summary 10.1.1.4 2.2.2.2 0x80000009 211 0x22 0x73ab 28

mask 255.255.255.252

Topology default (ID 0) -> Metric: 1

ASBRSum 3.3.3.3 2.2.2.2 0x80000003 207 0x22 0xba6a 28

mask 0.0.0.0

Topology default (ID 0) -> Metric: 1

OSPF AS SCOPE link state database

Type ID Adv Rtr Seq Age Opt Cksum Len

Extern 100.100.100.0 3.3.3.3 0x80000002 1245 0x22 0x86f1 36

mask 255.255.255.0

Topology default (ID 0)

Type: 2, Metric: 0, Fwd addr: 0.0.0.0, Tag: 0.0.0.0

[edit]

lab# show logical-systems R2

interfaces {

em2 {

unit 12 {

vlan-id 12;

family inet {

address 10.1.1.2/30;

}

unit 23 {

vlan-id 23;

family inet {

address 10.1.1.5/30;

}

lo0 {

unit 2 {

family inet {

address 2.2.2.2/32;

}

protocols {

ospf {

area 0.0.0.1 {

interface em2.12;

}

area 0.0.0.2 {

interface lo0.2;

interface em2.23;

}

[edit]

lab# run show route logical-system R2

inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

1.1.1.1/32 *[OSPF/10] 00:04:47, metric 1

> to 10.1.1.1 via em2.12

2.2.2.2/32 *[Direct/0] 02:20:57

> via lo0.2

3.3.3.3/32 *[OSPF/10] 00:04:51, metric 1

> to 10.1.1.6 via em2.23

10.1.1.0/30 *[Direct/0] 00:05:32

> via em2.12

10.1.1.2/32 *[Local/0] 00:05:32

Local via em2.12

10.1.1.4/30 *[Direct/0] 00:05:32

> via em2.23

10.1.1.5/32 *[Local/0] 00:05:32

Local via em2.23

100.100.100.0/24 *[OSPF/150] 00:04:51, metric 0, tag 0

> to 10.1.1.6 via em2.23

224.0.0.5/32 *[OSPF/10] 02:15:20, metric 1

MultiRecv

[edit]

lab# run show ospf database detail logical-system R2

OSPF database, Area 0.0.0.1

Type ID Adv Rtr Seq Age Opt Cksum Len

Router 1.1.1.1 1.1.1.1 0x8000001b 255 0x22 0x2eb3 48

bits 0x0, link count 2

id 10.1.1.2, data 10.1.1.1, Type Transit (2)

Topology count: 0, Default metric: 1

id 1.1.1.1, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.2

Metric: 1, Bidirectional

Router *2.2.2.2 2.2.2.2 0x8000001b 254 0x22 0x31ba 36

bits 0x1, link count 1

id 10.1.1.2, data 10.1.1.2, Type Transit (2)

Topology count: 0, Default metric: 1

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.2

Metric: 1, Bidirectional

Network *10.1.1.2 2.2.2.2 0x80000004 254 0x22 0x1404 32

mask 255.255.255.252

attached router 2.2.2.2

attached router 1.1.1.1

Topology default (ID 0)

Type: Transit, Node ID: 1.1.1.1

Metric: 0, Bidirectional

Type: Transit, Node ID: 2.2.2.2

Metric: 0, Bidirectional

Summary *2.2.2.2 2.2.2.2 0x80000004 2054 0x22 0xea3f 28

mask 255.255.255.255

Topology default (ID 0) -> Metric: 0

Summary *3.3.3.3 2.2.2.2 0x80000003 254 0x22 0xc85d 28

mask 255.255.255.255

Topology default (ID 0) -> Metric: 1

Summary *10.1.1.4 2.2.2.2 0x80000009 258 0x22 0x73ab 28

mask 255.255.255.252

Topology default (ID 0) -> Metric: 1

ASBRSum *3.3.3.3 2.2.2.2 0x80000003 254 0x22 0xba6a 28

mask 0.0.0.0

Topology default (ID 0) -> Metric: 1

OSPF database, Area 0.0.0.2

Type ID Adv Rtr Seq Age Opt Cksum Len

Router *2.2.2.2 2.2.2.2 0x80000010 258 0x22 0xad2a 48

bits 0x1, link count 2

id 10.1.1.6, data 10.1.1.5, Type Transit (2)

Topology count: 0, Default metric: 1

id 2.2.2.2, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.6

Metric: 1, Bidirectional

Router 3.3.3.3 3.3.3.3 0x80000012 259 0x22 0xc007 48

bits 0x2, link count 2

id 10.1.1.6, data 10.1.1.6, Type Transit (2)

Topology count: 0, Default metric: 1

id 3.3.3.3, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.6

Metric: 1, Bidirectional

Network 10.1.1.6 3.3.3.3 0x80000004 259 0x22 0x22e5 32

mask 255.255.255.252

attached router 3.3.3.3

attached router 2.2.2.2

Topology default (ID 0)

Type: Transit, Node ID: 2.2.2.2

Metric: 0, Bidirectional

Type: Transit, Node ID: 3.3.3.3

Metric: 0, Bidirectional

Summary *1.1.1.1 2.2.2.2 0x80000003 254 0x22 0x2509 28

mask 255.255.255.255

Topology default (ID 0) -> Metric: 1

Summary *10.1.1.0 2.2.2.2 0x80000003 1721 0x22 0xa781 28

mask 255.255.255.252

Topology default (ID 0) -> Metric: 1

OSPF AS SCOPE link state database

Type ID Adv Rtr Seq Age Opt Cksum Len

Extern 100.100.100.0 3.3.3.3 0x80000002 1292 0x22 0x86f1 36

mask 255.255.255.0

Topology default (ID 0)

Type: 2, Metric: 0, Fwd addr: 0.0.0.0, Tag: 0.0.0.0

[edit]

lab# show logical-systems R3

interfaces {

em3 {

unit 23 {

vlan-id 23;

family inet {

address 10.1.1.6/30;

}

lo0 {

unit 3 {

family inet {

address 3.3.3.3/32;

}

protocols {

ospf {

export STATIC2OSPF;

area 0.0.0.2 {

interface em3.23;

interface lo0.3;

}

policy-options {

policy-statement STATIC2OSPF {

from protocol static;

then accept;

}

routing-options {

static {

route 100.100.100.0/24 discard;

}

[edit]

lab# run show route logical-system R3

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

1.1.1.1/32 *[OSPF/10] 00:05:44, metric 2

> to 10.1.1.5 via em3.23

2.2.2.2/32 *[OSPF/10] 00:05:49, metric 1

> to 10.1.1.5 via em3.23

3.3.3.3/32 *[Direct/0] 00:48:49

> via lo0.3

10.1.1.0/30 *[OSPF/10] 00:05:49, metric 2

> to 10.1.1.5 via em3.23

10.1.1.4/30 *[Direct/0] 00:06:30

> via em3.23

10.1.1.6/32 *[Local/0] 00:06:30

Local via em3.23

100.100.100.0/24 *[Static/5] 00:42:07

Discard

224.0.0.5/32 *[OSPF/10] 00:48:50, metric 1

MultiRecv

[edit]

lab# run show ospf database detail logical-system R3

OSPF database, Area 0.0.0.2

Type ID Adv Rtr Seq Age Opt Cksum Len

Router 2.2.2.2 2.2.2.2 0x80000010 362 0x22 0xad2a 48

bits 0x1, link count 2

id 10.1.1.6, data 10.1.1.5, Type Transit (2)

Topology count: 0, Default metric: 1

id 2.2.2.2, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.6

Metric: 1, Bidirectional

Router *3.3.3.3 3.3.3.3 0x80000012 361 0x22 0xc007 48

bits 0x2, link count 2

id 10.1.1.6, data 10.1.1.6, Type Transit (2)

Topology count: 0, Default metric: 1

id 3.3.3.3, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: Transit, Node ID: 10.1.1.6

Metric: 1, Bidirectional

Network *10.1.1.6 3.3.3.3 0x80000004 361 0x22 0x22e5 32

mask 255.255.255.252

attached router 3.3.3.3

attached router 2.2.2.2

Topology default (ID 0)

Type: Transit, Node ID: 2.2.2.2

Metric: 0, Bidirectional

Type: Transit, Node ID: 3.3.3.3

Metric: 0, Bidirectional

Summary 1.1.1.1 2.2.2.2 0x80000003 358 0x22 0x2509 28

mask 255.255.255.255

Topology default (ID 0) -> Metric: 1

Summary 10.1.1.0 2.2.2.2 0x80000003 1825 0x22 0xa781 28

mask 255.255.255.252

Topology default (ID 0) -> Metric: 1

OSPF AS SCOPE link state database

Type ID Adv Rtr Seq Age Opt Cksum Len

Extern *100.100.100.0 3.3.3.3 0x80000002 1394 0x22 0x86f1 36

mask 255.255.255.0

Topology default (ID 0)

Type: 2, Metric: 0, Fwd addr: 0.0.0.0, Tag: 0.0.0.0

Conclusion:

If you have such kind of IOT network design you should be aware of this to prepare some workaround for such surprise if area 0 interface was disappeared in the OSPF network(ex: the ABR uplink interface was disconnect) !

Reference:

What Makes a Router an OSPF ABR: Cisco and Juniper Comparison

Learning JUNOS from IOS - Day3 (View/Modify Configuration)

noreply@blogger.com (CCIE11440) — Sat, 24 May 2014 15:59:00 +0000

A bird in the hand is worth two in the bush

Day 3 - How to view or modify JUNOS configuration ?

Entering Configuration Mode

When you stand behind an engineer, you can identify the engineer is Cisco or Juniper guy easily.

Most cisco engineers like to use the command 'conf t' to enter configure mode of router or switch.

router> enable
Password:
router# conf t
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#

When you want to show any results, you don't need to exit to the privilege mode(#) to show it. You can leverage 'do' command to check the status.

router(config)# do sh ip int brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1 10.17.14.195 YES manual up up
GigabitEthernet2 unassigned YES unset administratively down down
GigabitEthernet0 unassigned YES manual up up
Loopback0 5.5.5.5 YES manual up up

As below is the common Cisco IOS configuration sample, to speak frankly, its content is much easier to read and understand by mouse scroll if you understand how to use google search engine well, you must be able to read a simple Cisco IOS configuration by yourself if you have basic CCNA knowledge.

router(config)# do sh run
Building configuration...

Current configuration : 1233 bytes
!
! Last configuration change at 08:45:57 UTC Mon Mar 31 2014 by lab
|
service timestamps debug datetime msec
service timestamps log datetime msec

service password-encryption

!
hostname router
!
...(omit)
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login local
!
!
end

Remove a statement

If you want to delete any statement(some statements cannot be removed, ex: line vty or physical interface) in Cisco IOS, just insert 'no' command in front of any current statement:

router# conf t
Enter configuration commands, one per line. End with CNTL/Z.
router(config)# no service password-encryption

Show configuration with filter

You can use the pipeline symbol '|' behind the 'show run' command, with include, exclude or other keywords to filter display or manipulate file content.

In the following example, output from the 'show tech-support' command is redirected to an existing file on Disk 1 with the file-name of "showoutput.txt." This output is added at the end of any existing data in the file.

Router# show tech-support | append disk1:showoutput.txt

The following is partial sample output of the 'show interface | begin' command that begins unfiltered output with the first line that contains the regular expression "Ethernet."

Router# show interface | begin Ethernet

Ethernet0 is up, line protocol is up
Hardware is Lance, address is 0060.837c.6399 (bia 0060.837c.6399)
Description: ip address is 172.1.2.14 255.255.255.0
Internet address is 172.1.2.14/24

The following is partial sample output of the show | exclude command used with the show buffers command. It excludes lines that contain the regular expression "0 misses."

Router# show buffers | exclude 0 misses

Buffer elements:
398 in free list (500 max allowed)
Public buffer pools:
Small buffers, 104 bytes (total 50, permanent 50):
50 in free list (20 min, 150 max allowed)
551 hits, 3 misses, 0 trims, 0 created
Big buffers, 1524 bytes (total 50, permanent 50):
49 in free list (5 min, 150 max allowed)
Very Big buffers, 4520 bytes (total 10, permanent 10):

The following examples is the filtering result of the show running-config | include command:

Router# show running-config | include interface

interface Ethernet0/0

interface Ethernet1/0

interface Serial2/0

interface Serial3/0

Entering Configuration Mode

If it is the first time you login a new juniper router, you need to type 'cli' command to switch to JUNOS operational mode at first. Then type 'configure' command to enter JUNOS configuration mode.

CLI Modes

If you log in to the device as the root user, you enter the UNIX shell, which is indicated by the percent sign (%) as the prompt. To access the Junos CLI, enter the 'cli' command at the shell prompt:

root% cli
lab@router>

The Junos CLI has two modes:

Operational mode--This mode displays the current status of the device. In operational mode, you enter commands to monitor and troubleshoot Junos OS and devices and network connectivity.

Configuration mode--A Junos device configuration is stored as a hierarchy of statements. In configuration mode, you enter these statements to define all properties of Junos OS, including interfaces, general routing information, routing protocols, flow-based security features, user access, and system and hardware properties.

Operational Mode

After logging in, you enter operational mode, which is indicated by the right angle bracket (>):

lab@router>

Configuration Mode

From operational mode, use the configure command to enter configuration mode, which is indicated by the pound sign (#):

lab@router> configure
entering configuration mode
[edit]

lab@router#

To exit configuration mode and go back to operational mode, enter exit at the prompt:

lab@router# exit
lab@router>

If you would like to remove any statement, you can user 'delete' command in front of each statement:

lab@router> configure

lab@router# delete system backup-router 172.16.1.253

If you would like to remove specific hierarchical level, you can user 'delete' command to remove all statements under the specific hierarchical level:

lab@router# delete routing-options

Then all statements under the routing-options will be removed.

Many Cisco engineers were not used to see the prompt symbol '{' and '}' as below:

lab@router> show configuration
... policy-options {
policy-statement Export_to_EBGP {
from {
protocol static;
route-filter 10.0.0.0/8 orlonger;
}
then accept;
}
}
...

I believe its not so easy to change anyone's reading behavior in a short time but we can use some JUNOS features to provide a 'flat' configuration view with line-by-line statement but not shown as hierarchical view as above.

In configuration mode, you can display the configuration as a series of configuration mode commands required to re-create the configuration. This is useful if you are not familiar with how to use configuration mode commands or if you want to cut, paste, and edit the displayed configuration.

To display the configuration as a series of configuration mode commands, which are required to re-create the configuration from the top level of the hierarchy as setcommands, issue the show configuration mode command with the display set option:

[edit interfaces fe-0/0/0]lab@router# show

unit 0 {family inet {address 192.107.1.230/24;}

}

lab@router# show | match fe-0/0/0 | display setset interfaces fe-0/0/0 unit 0 family inet address 192.107.1.230/24
To display the output of an operation mode command, such as 'show', while in configuration mode, issue the run configuration mode command and then specify the operational mode command:user@host# run show vrrp detailPhysical interface: xe-5/2/0, Unit: 0, Address: 192.168.29.10/24Interface state: up, Group: 10, State: backupPriority: 190, Advertisement interval: 3, Authentication type: simplePreempt: yes, VIP count: 1, VIP: 192.168.29.55Dead timer: 8.326, Master priority: 201, Master router: 192.168.29.254[edit interfaces xe-4/2/0 unit 0 family inet vrrp-group 27]

Reference:

[POC] Junos script Operations Automation (op script) - show-bgp-policy

noreply@blogger.com (CCIE11440) — Fri, 28 Mar 2014 07:09:00 +0000

Junos Script Automation is a powerful and flexible on-box toolset which provides customization of network behavior, adaption to what your application expects to configure, manage and diagnose if and when needed. It sits right above the Junos OS, with a northbound interface to Junos Space applications, and southbound access to Junos SDK applications and native management plane instrumentation. This customized programmable solution makes your application smarter and better in real-time.

In Juniper official website provides many script samples to match part of common requests. In my company, we deployed many inter-connections EBGP/IBGP between router or layer 3 switch. So I picked one op script from the JUNOS Script Library - show bgp policy: display all routing-policies in sequential order for a selected BGP peer.

If you ever used JUNOS, you will know that JUNOS BGP needs import/export policy to include/exclude the routes to be advertised or received. When you have lots of different BGP neighbors you may apply different import/export policy to match different BGP peer request or limitation.

So you can leverage this JUNOS script to review each neighbor policy more easily:

Preparation

As below are the steps of installation on your juniper routers:

1. Download the script file from JUNOS Script Library:

2. To confirm that your routers has the directory already(if not, please make the same directory path by yourself by using the command mkdir) : /var/db/scripts/op

--- JUNOS 12.1X46-D10.2 built 2013-12-18 02:43:42 UTC

lab@vSRX-1> start shell

% pwd

/cf/var/home/lab

% cd /var/db

% ls scripts/

commit event import lib op

3. Configure the script path under system hierarchical level:

% exit

lab@vSRX-1> configure

Entering configuration mode

[edit]

lab@vSRX-1#set system scripts op file show-bgp-policy.slax description "show bgp policy import/export policy"

4. Enable ftp service on your router: (you should have any user account already, then you don't need to setup additional user account to use the ftp service)

[edit]

lab@vSRX-1# set system services ftp

5. DO NOT forget to commit to make the commands take effect:

[edit]

lab@vSRX-1# commit

commit complete

6. Use any ftp client connect to your router then upload the script under the directory /var/db/scripts/op

7. Done!

Implementation

Now let's start to use the script in your daily operation to help you to check the bgp policy:

At first, let's see what BGP peers we have on router:

[edit]

lab@vSRX-1> show bgp summary

Groups: 1 Peers: 128 Down peers: 0

Table Tot Paths Act Paths Suppressed History Damp State Pending

inet.0 0 0 0 0 0 0

Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...

10.10.10.1 2 41886 41888 0 0 2w0d1h 0/0/0/0 0/0/0/0

Check your bgp neighbor 10.10.10.1 policy as below: (In my case, I did not config import policy)

lab@vSRX-1> op show-bgp-policy neighbor 10.10.10.1 direction export
BGP Neighbor: 10.10.10.1 in group EBGP
Export Policies: Export_to_EBGP
Policy: Export_to_EBGP
policy-statement Export_to_EBGP {
from {
protocol static;
route-filter 10.0.0.0/8 orlonger;
}
then accept;
}

lab@vSRX-1> op show-bgp-policy neighbor 10.10.10.1 direction import
error: There are no import policies for 10.10.10.1
BGP Neighbor: 10.10.10.1 in group EBGP

Learning JUNOS from IOS - Day2 (Configuration Management)

noreply@blogger.com (CCIE11440) — Tue, 25 Mar 2014 15:26:00 +0000

Configuration Management

Day 2 - How to review router configuration ?

In Cisco IOS, it has two default configuration files:

(1) startup-config: is used for initialization of router boot up process

(2) running-config. is the real-time concurrent configuration repository whenever you type any commands in IOS.

And how do you differentiate screen output is the startup-config or running-config ?

Startup-config is stored in NVRAM, so you can see how many disk space it is using out of NVRAM total bytes.

Router#show startup-config
Using 1448 out of 129016 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
...

Running-config is stored in RAM, so you can see the prompt of "Current configuration"

Router#show running-config
Building configuration...
Current configuration : 1448 bytes
!
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
boot-start-markerboot-end-marker

If the final change of configuration is okay, you need to remember to backup the current configuration by below command:

Router#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

or you can use legacy quick command as below:

Router#write
Building configuration...
[OK]

It's a pity that Cisco IOS has no rollback feature. Just imagine that if you don't have a well-designed change and rollback SOP for Cisco IOS(it sometime happened when emergency change to control routing path for congestion mitigation or apply ACL for security incident by emergency request from security team), you may create a disaster if you did lots of wrong configuration and you forgot what you did and your terminal clients buffer config was not enough to store all the change history. You may need to review the running-configuration in details then remove the wrong configuration line-by-line.

In some rare case, the router did not load the final configuration as you expected, then please use below command to check the configuration register by below command.

Router#sh ver
...
Configuration register is 0x2102

In normal condition, the configuration register value should be 0x2102. If you would like to skip the startup-configuration during router boot-up process for special purpose (ex: password recovery), then you would need to use below command to change the configuration register value to 0x2142.

Don't forget to change it back to 0x2102 as below or it will bypass startup-config again, it means you may not be able to access the router remotely after it reboot by power on/off or power outage accident.)

Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#config-register 0x2102
Router(config)#end
Router#show version
...
Configuration register is 0x2142 (will be 0x2102 at next reload)

In fact, if you want to backup your running-config to other file but not the default startup-config, you can use below command to backup configurations as you want:

Router#copy running-config disk0:/backup-20140325.cfg
Destination filename [backup-20140325.cfg]?
766 bytes copied in 0.356 secs (2152 bytes/sec)

Router#dir
Directory of disk0:/
1 -rw- 766 Mar 25 2014 14:49:26 +00:00 backup-20140325.cfg
66850816 bytes total (66846720 bytes free)

Archive command

I believe many people may not know that Cisco IOS has provide a similar feature with JUNOS rollback features - archive. We can leverage the archive command that will perform a similar rollback function to to the JUNOS command.

At first, let's how it works and configure:

path: directory: disk0:/archive, rollback is each filename common prefix (it depends on hardware model, you may use slot0: or disk0: or flash:)
write-memory: Enable automatic backup generation during write memory
maximum: the maximum number of backup copies(max is 14)
time-period: I defined 1440 mins(One day) then it will auto-backup running-config

Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R1
Router(config)#archive
Router(config-archive)#path disk0:/archive/rollback
Router(config-archive)#write-memory
Router(config-archive)#maximum 14
Router(config-archive)#time-period 1440
Router(config-archive)#^Z
Router#

Then let's create the directory in router's file system(it depends on your hardware model):

Router#mkdir disk0:/archive
Create directory filename [archive]?
Created dir disk0:/archive
Router#cd archive

Router#dir

Directory of disk0:/archive/
No files in directory
66850816 bytes total (66842624 bytes free)
Router#

Next, please try to use write command to backup your running-config to startup-config:

Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R1

R1(config)#^Z

R1#wr

Building configuration...

[OK]

R1#dir

Directory of disk0:/archive/
3 -rw- 796 Mar 25 2014 15:06:22 +00:00 rollback-1
66850816 bytes total (66838528 bytes free)

Here you are, now you use leverage this file system as your configuration repository!

So, how can we know the difference between these files and current running-config ?

R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#hostname XYZ
XYZ(config)#int loopback 0
00:47:47: %LINK-3-UPDOWN: Interface Loopback0, changed state to up
00:47:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
XYZ(config-if)#ip address 1.1.1.1 255.255.255.255
XYZ(config-if)#^Z
XYZ#
00:47:52: %SYS-5-CONFIG_I: Configured from console by console

XYZ#sh archive config differences disk0:/archive/rollback-1
Contextual Config Diffs:
+hostname R1
-hostname XYZ
-interface Loopback0
-ip address 1.1.1.1 255.255.255.255
-no clns route-cache

XYZ#wr
Building configuration...
[OK]
XYZ#dir
Directory of disk0:/archive/
3 -rw- 796 Mar 25 2014 15:06:22 +00:00 rollback-1
4 -rw- 876 Mar 25 2014 15:12:24 +00:00 rollback-2
66850816 bytes total (66834432 bytes free)

Yes, it looks like JUNOS compare feature, if you have ever used JUNOS

So, if you want to rollback to previously backup configuration, you can use below command:

XYZ#config replace disk0:/archive/rollback-1
This will apply all necessary additions and deletions to replace the current running configuration with thecontents of the specified configuration file, which is assumed to be a complete configuration, not a partialconfiguration. Enter Y if you are sure you want to proceed. ? [no]: yes
Total number of passes: 1
Rollback Done

R1#
00:54:59: Rollback:Acquired Configuration lock.
00:55:01: %LINK-5-CHANGED: Interface Loopback0, changed state to administratively down
00:55:02: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to down

In JUNOS configuration, you need to develop a good habit that is to remember to commit to make the change take effect every time. Several case of JUNOS configuration troubleshooting and the root cause is not the SOP config issue just because users forgot to commit it to activate the change.

Commit command

[edit]
user@router# commit
commit complete

When you make a configuration change, the change does not take effect immediately. Instead, it goes into a candidate configuration file.

You can make as many configuration additions, deletions, and changes as you like, and none of them become active on the router until you enter a commit command. That command causes the candidate configuration to become the active configuration.

You can use below command to review the change(the difference between candidate and active configuration) before you commit:

user@router# show | compare rollback 0
[edit interfaces ge-0/0/0 unit 0]
+ family iso;

You can make all your changes, check them as many times as you like during the configuration process, and only commit them when you are ready and are sure the changed configuration looks right.

Even more, you can compare all previously commit changes(up to 50) by below command:

user@router# show | compare rollback ?
Possible completions:
0 2014-03-24 14:11:30 UTC by lab via cli
1 2014-03-19 10:55:50 UTC by lab via cli
2 2014-03-18 15:43:37 UTC by lab via cli
3 2014-03-18 15:17:23 UTC by lab via cli
...
49 2014-03-11 02:40:59 UTC by root via cli

[edit]
user@router# show | compare rollback 1
[edit protocols ospf]
+ export default-static;
- export static-default
[edit policy-options]
+ policy-statement default-static {
+ from protocol static;
+ then accept;
+ }

Junos provides another automatic rollback mechanism to returns to the previous version of the configuration. To use commit confirmed to rollback to previously configuration if you did not commit again during that time period you defined (default is 10mins):

[edit]
user@router# commit confirmed
commit confirmed will be automatically rolled back in 10 minutes unless confirmed
commit complete

# commit confirmed will be rolled back in 10 minutes
[edit]
user@router#
# commit confirmed will be rolled back in 7 minutes
[edit]
user@router# commit
commit complete

Rollback command

If you want to get back to an earlier configuration(three days ago), you can do that in JUNOS because when you do a commit and the candidate configuration becomes the active configuration, the previous configuration is saved to a hard disk on the router.

So if you want to get back to a previous configuration, you can use below command to achieve:

[edit]user@router# rollback 1
load complete

[edit]user@router# commit
commit complete

Hint1: DO REMEBER to commit after you rollback!

Hint2: rollback 0 is the Candidate Configuration which included the commands not commit yet. If you executed "rollback 0", it means you abort all the changes and rollback to the original configuration you commit last time!

JUNOS saves the last 49 configuration files. When you commit a new configuration, the old active configuration is saved as juniper.conf.1. What was juniper.conf.1 becomes juniper.conf.2, what was juniper.conf.2 becomes juniper.conf.3, and so on.

So if you want to go back to some config older than the most recently saved one, you can do that. For example if you enter rollback 3, juniper.conf.3 – the configuration that was active before the last three commits – is loaded back into the candidate configuration.

Save Command

Sometimes you would like to save the "golden" configuration(which is running for a long time without any issue) as a permanent file as an rescue configuration, then you can apply below command:

[edit]
user@host# save golden_config_20140325.cfg
Wrote 367 lines of configuration to 'golden_config_20140325.cfg'

[edit]
user@host# run file list
/cf/var/home/lab/:
.ssh/golden_config_20140325.cfg

As you see, the files will be located at the login user home directory.

Actually, you have another choice to save current configuration as rescue config:

user@host> request system configuration rescue save
user@host>

If you want to rollback the rescue config, you can use below command:

[edit]
user@router# rollback rescue
load complete

[edit]
user@router# commit
commit complete

Load Command

When you got a old juniper device and you would like to reset it to default, you can use below command:

[edit]
user@router# load factory-default
warning: activating factory configuration

[edit]
user@router# commit
commit complete

In JUNOS configuration mode, it provides a great feature which let you to load a partial config from terminal, it helps a lot in most changes when you only have soft copy of another JUNOS online configuration in hierarchical format.

For example, I got a SOP configuration as below from my colleague, but such configuration cannot just like Cisco IOS to paste it to apply.(This would be one of most difficulties when Cisco IOS engineer start learning JUNOS)

protocols {
ospf {
area 0.0.0.0 {
interface ge-0/0/1.0;

interface lo0.0;
}
}
}

So how can you use copy & paste to apply to the target change router?

[edit]

lab@router# load merge terminal

[Type ^D at a new line to end input]

protocols {

ospf {

area 0.0.0.0 {

interface ge-0/0/1.0;

interface lo0.0;

}

load complete

[edit]

lab@router# commit

commit complete

But you should be aware when you use this command which hierarchical level you are, because if your SOP configuration is just a part of specific hierarchical level code it might not be able to apply without proper command.

For example: as below incomplete config should be under [policy-options] hierarchical level

policy-statement Export_to_EBGP {

from {

protocol static;

route-filter 10.0.0.0/8 orlonger;

}

then accept;

}

If you did not change to correct hierarchical level, you would see the error message:

[edit]

lab@router# load merge terminal

[Type ^D at a new line to end input]

policy-statement Export_to_EBGP {

from {

protocol static;

terminal:1:(20) syntax error: policy-statement

[edit]

'policy-statement Export_to_EBGP {'

syntax error

route-filter 10.0.0.0/8 orlonger;

}

then accept;

}

^C[abort]

When you see the error message, what you can do is use Ctrl-C to abort it, then try again!

[edit]

lab@router# edit policy-options

[edit policy-options]

lab@router# load merge terminal

[Type ^D at a new line to end input]

policy-statement Export_to_EBGP {

from {

protocol static;

terminal:1:(20) syntax error: policy-statement

[edit]

'policy-statement Export_to_EBGP {'

syntax error

route-filter 10.0.0.0/8 orlonger;

}

then accept;

}

^C[abort]

You might feel a little frustrated..let me show you the correct command:

[edit policy-options]

lab@router# load merge terminal relative

[Type ^D at a new line to end input]

policy-statement Export_to_EBGP {

from {

protocol static;

route-filter 10.0.0.0/8 orlonger;

}

then accept;

}

load complete

[edit policy-options]

lab@router# commit

commit complete

When you got a partial config which was under specific hierarchical level, you should change to the correct hierarchical level then use the command load merge terminal relative then paste the configuration and do remember commit it to make it take effect!

Reference:

Learning JUNOS from IOS - Day1 (Show Interface)

noreply@blogger.com (CCIE11440) — Sun, 23 Mar 2014 15:49:00 +0000

Once a use, forever a custom

My first-time experience of Cisco router installation was in 1997, when I was a junior network engineer in a small company. I remembered that day I finished installing a customer router on-site for only 15 mins then I left and went back again after 2 hours to configure the router via console again..because I forgot to configure password under line vty (I told myslef I would never made such stupid mistake again like that - Password required, but none set)

After 13 years later, I started to learn JUNOS since 2010. Because I familiar Cisco IOS so much, so I knew the feeling of use behavior change from IOS to JUNOS. The hierarchical structure is not so easy to read when you see it in the first time.(especially when you have no any programming experience)

However, having the use experience of Cisco IOS is a not a bad thing before you start to learn JUNOS. I believe if you can leverage your previously IOS command knowledge then map to JUNOS relative statements, it will help you to learn the JUNOS quickly. This the reason why I want to write this series of articles to share my personal learning experience and tips with you.

As below comparison comments came from a great blog article -
Cisco IOS vs. Juniper JUNOS: The technical differences can help you to understand the difference between these NOS(Network Operating System):

IOS traditionally is a monolithic operating system, which means it runs as a single operation and all processes share the same memory space. Because of the latter feature, bugs in one operation can have an impact on or corrupt other processes. In addition, if a user wishes to add features or functions to the operating system, IOS has to be deactiviated while a completely new version with the desired features is loaded.

JUNOS, on the other hand, was constructed as a modular operating system. The kernel is based on the open source FreeBSD operating system, and processes that run as modules on top of the kernel are segregated in exclusive, protected, memory space. Users thus can add features and functions to the version of JUNOS running on their systems without disabling the entire operating system — a characteristic known as in-service software upgrades that also enhances uptime and availability.

The goal of Cisco's new IOS variants — IOS XR, IOS XE and NX-OS — is to overcome the monolithic limitations of the traditional IOS while addressing critical needs for increased uptime and availability in the service-provider core and edge, and enterprise data center, respectively. All these operating systems are modular, in that IOS services run as modules on top of a Linux-based kernel (in IOS XE and NX-OS), or as a third-party Portable-Operating-System-Interface (POSIX)-based real-time kernel (in IOS XR).

Day 1 - How to check router installed interface ?

As blow is the Cisco IOS CLI to see which physical interface are installed and recognized by Cisco device. I like this kind of new interface configuration added by Cisco IOS, because most junior engineer has no idea how to add new interface configuration of new type of interface card, especially when the new hardware installation was executed by remote hand support :

If there's a new hardware was installed and acknowledged by proper Cisco IOS, the new interface with slot/port configuration will appear in Cisco running-config automatically.(no matter the interface was administratively down/down or up/down, it must be exists in running-config and it cannot be deleted or altered by manual config)

hostname# show run

Building configuration...

Current configuration : 1408 bytes

!

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname R2

!

boot-start-marker

boot-end-marker

...

!

interface FastEthernet0/0

ip address 10.1.1.2 255.255.255.252

duplex auto

speed auto

no clns route-cache

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

no clns route-cache

...

If you would like to see each interface status and related ip address was assigned, you can use above command to see all of them.

hostname# show ip interface brief

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 10.1.1.2 YES manual up up

FastEthernet0/1 unassigned YES unset administratively down down

FastEthernet1/0 unassigned YES unset administratively down down

FastEthernet1/1 unassigned YES unset administratively down down

Serial2/0 unassigned YES unset administratively down down

Serial2/1 unassigned YES unset administratively down down

Serial2/2 unassigned YES unset administratively down down Serial2/3 unassigned YES unset administratively down down

The most obviously difference between IOS and JUNOS is the physical interface would not appear automatically in JUNOS if you clear all default configuration or deletes the physical interface configurations by yourself.(You can not just rely on configuration to check all interface exist or not)

In Juniper JUNOS CLI has a little different behavior, if you do not aware how the slot/port and media type of the device, you may not be able to understand how to config them because it will not appear on the configuration automatically(it means you need someone guide you or you should read the installation guide at first to know how to assign the slot/port number to the new installed interface.

PS: In some juniper device (fixed module) provide factory default configuration, so it doesn't need to manual config for new interface with correct slot/port number.

username@hostname> show config

version 12.1X46-D10.2;

system {

host-name vSRX-14.190;

root-authentication {

encrypted-password "$1$DAgfs0I1$RsHy7/nSsMFgZASDlrmze/"; ## SECRET-DATA

}

...

}

interfaces {

ge-0/0/0 {

unit 0 {

family inet {

address 10.17.4.190/22 {

}

}

}

}

ge-0/0/1 {

description "for Management 10.17.14.0/24";

unit 0 {

family inet {

address 10.17.14.190/24;

}

}

}

lo0 {

unit 0 {

family inet {

address 1.1.1.1/32;

}

family iso;

}

}

}

...

In JUNOS configuration mode, you need to use 'run' keyword to execute the show command as above. But you may not be able to all interface(because JUNOS allow users to delete the interface even the physical interface was exist)

username@hostname> show interfaces terse

Interface Admin Link Proto Local Remote

ge-0/0/0 up up

ge-0/0/0.0 up up inet 10.10.10.0/31

gr-0/0/0 up up

ip-0/0/0 up up

lsq-0/0/0 up up

lt-0/0/0 up up

mt-0/0/0 up up

sp-0/0/0 up up

sp-0/0/0.0 up up inet

inet6

sp-0/0/0.16383 up up inet 10.0.0.1 --> 10.0.0.16

10.0.0.6 --> 0/0

128.0.0.1 --> 128.0.1.16

128.0.0.6 --> 0/0

ge-0/0/1 up up

ge-0/0/1.0 up up inet 10.17.14.190/24

dsc up up

gre up up

ipip up up

lo0 up up

lo0.0 up up inet 1.1.1.1 --> 0/0

iso

lo0.16384 up up inet 127.0.0.1 --> 0/0

lo0.16385 up up inet 10.0.0.1 --> 0/0

10.0.0.16 --> 0/0

128.0.0.1 --> 0/0

128.0.0.4 --> 0/0

128.0.1.16 --> 0/0

lo0.32768 up up

lsi up up

mtun up up

pimd up up

pime up up

pp0 up up

ppd0 up up

ppe0 up up

st0 up up

tap up up

vlan up down

Most JUNOS engineers will use this command to check router interface at the first time to have brief view of all interface than just "show configuration". And there's some pre-defined software interface for different purpose will appear too.

As a beginner of JUNOS, I would suggest to ignore them but remember their's name when you found some features has mention that then you will understand those software interface one-by-one.

username@hostname> show chassis hardware

Hardware inventory:

Item Version Part number Serial number Description

Chassis 34f56038e66c FIREFLY-PERIMETER

Midplane

System IO

Routing Engine FIREFLY-PERIMETER RE

FPC 0 Virtual FPC

PIC 0 Virtual GE

Power Supply 0

If you would like to know each physical module/interface was installed in which slot, you have to use above command to see those hardware, and its a good tool to check that current JUNOS version can recognize those modules successfully or not.

Reference:

[POC] Juniper SRX IPSec tunnel (Aggressive mode) SOP configuration

noreply@blogger.com (CCIE11440) — Wed, 19 Mar 2014 10:01:00 +0000

In order to prepare the future migration from Juniper SSG to SRX, so I tried to use SRX GUI interface to see how its easy for operation team to sustain this.

This is the first time I tried to use GUI to manage a router, and if you are not familiar with Juniper SRX features and functions, I have to say its a quick start to have a glance overview of Juniper SRX by web interface.

For many junior engineers, if they can have what-you-see-what-you-get interface, they will accept new technology as fast as they can or they might refuse to try or to learn new technology if there's no time pressure or instructions from high-level managers directly .

We are still using CLI to control most routing and switching network device today, but I believe someday the condition may change if the network virtualization come true.(I think no one would like to control firewall by CLI, isn't it ?)

In Juniper SRX, it provide some wizards for those common and lousy configuration needed features like PPPoE, FW, VPN and NAT. It's important for those new Juniper customers to do these jobs quickly without the JUNOS knowledge, and that's what I am trying to know the possibility to manage SRX as VPN device by GUI only.

The other benefits of GUI is the QoS visibility, if you are a JUNOS user, you would find out that Juniper QoS is a little difficult to understand and know how to use command line to see the class of service.

If you want to see whether your JUNOS CoS is running correctly on your SRX, please try to login your SRX by web then you might surprise the functions of Class of Service dash board in GUI. (I spent lots time to find out the interface CoS MIB of each class...now here it is, you can check the class of service in each interface, CoS value, RED profile...), its great!

Another advantage is that many juniper users would like to have similar function of Cisco IP SLA. Juniper has similar features which is called RPM(Real-time Performance Monitoring). But many people did not apply the features because there's no good network management tool to collect the information and provide a graphic statistics. But now you can leverage the embedded J-web to see the long-term status monitoring as below. You can configure the RPM functions directly without any JUNOS knowledge and then you will see the result later!

Today, I will use the Site-to-site IPSec VPN wizard to see the steps and each mandatory field of related configuration.

1. As below is the first screen shot of VPN Wizard, its very clear and simple. Just select which vpn type you would like to setup.

2. In this step, just fill the VPN name, zone, tunnel interface(st0.X) and the outbound physical interface selection.(in my case, I will trust all tunnel interface but untrust the internet facing interface)

3. In this step, you have to fill the remote side VPN internet public IP(in my case, its in the lab, so I still use private IP for SRX inter-connection).

For the Local/Remote Network, the wizard will try to use static route to ensure your VPN sites can communicate to each other after this wizard. So if you have your own dynamic routing protocol, I will suggest you should clear the static route manually after you finished the wizard.

4. In IPSec VPN configuration, you need to keep the same security level & policy for IKE and IPSec negotiation phase. In this wizard, you can just select the pre-defined policy to choose if you don't have special concern. Of course, if you want select desired DH group, encryption, integrity check method, you can modify these parameters after this wizard was finished and commit.

5. In my case, I will allow all service between VPN sites across this vpn tunnel, so I keep the default setting to permit all.

6. This is the final step, it will list all previously configuration steps you have, if it is okay, just press the commit button and it will upload the config and commit immediately.

As you see, there's only 6 steps to setup your site-to-site IPSec VPN! Its quite easy, isn't it ?

Don't forget that you need to login the other SRX to do the same procedure with correct parameters to finish this site-to-site vpn.

Finally, I reviewed the wizard configuration and clean up what configuration I don't need in our routine job, then I generate a simple CLI version of SOP to setup a site-to-site IPSec VPN in SRX as below.
You can re-use my sample config and convert them to become your network operators SOP.

PS1: I choosed aggressive mode to match the frequently network change in branch office.
PS2: I removed all static routing and source/destination prefix security policy.

SJDC Site:

Set system host-name SJDC-VPN

set interfaces st0.0 family inet address X.X.X.X/30 => SJDC side tunnel IP

set security zones security-zone trust interfaces st0.0

set security ike policy ike_pol_SJDC-ADC mode aggressive

set security ike policy ike_pol_SJDC-ADC proposal-set compatible

set security ike policy ike_pol_SJDC-ADC pre-shared-key ascii-text trend

set security ike gateway gw_SJDC-ADC ike-policy ike_pol_SJDC-ADC

set security ike gateway gw_SJDC-ADC dynamic hostname ADC-VPN => ADC VPN hostname

set security ike gateway gw_SJDC-ADC dead-peer-detection

set security ike gateway gw_SJDC-ADC external-interface fe-0/0/0.0 => Internet facing

set security ipsec policy ipsec_pol_SJDC-ADC perfect-forward-secrecy keys group2

set security ipsec policy ipsec_pol_SJDC-ADC proposal-set compatible

set security ipsec vpn SJDC-ADC bind-interface st0.0

set security ipsec vpn SJDC-ADC vpn-monitor

set security ipsec vpn SJDC-ADC ike gateway gw_SJDC-ADC

set security ipsec vpn SJDC-ADC ike ipsec-policy ipsec_pol_SJDC-ADC

set security ipsec vpn SJDC-ADC establish-tunnels immediately

set security policies from-zone trust to-zone trust policy trust-to-trust match source-address any

set security policies from-zone trust to-zone trust policy trust-to-trust match destination-address any

set security policies from-zone trust to-zone trust policy trust-to-trust match application any

set security policies from-zone trust to-zone trust policy trust-to-trust then permit

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services dhcp

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services tftp

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ike

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services https

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services snmp

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ssh

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ping

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services traceroute

ADC Site:

Set system host-name ADC-VPN

set interfaces st0.0 family inet address X.X.X.X/30 => ADC side tunnel IP

set security zones security-zone trust interfaces st0.0

set security ike policy ike_pol_ADC-SJDC mode aggressive

set security ike policy ike_pol_ADC-SJDC proposal-set compatible

set security ike policy ike_pol_ADC-SJDC pre-shared-key ascii-text trend

set security ike gateway gw_ADC-SJDC ike-policy ike_pol_ADC-SJDC

set security ike gateway gw_ADC-SJDC address X.X.X.X => SJDC side IP

set security ike gateway gw_ADC-SJDC local-identity hostname ADC-VPN => ADC VPN hostname

set security ike gateway gw_ADC-SJDC dead-peer-detection

set security ike gateway gw_ADC-SJDC external-interface fe-0/0/0.0 => Internet facing interface

set security ipsec policy ipsec_pol_ADC-SJDC perfect-forward-secrecy keys group2

set security ipsec policy ipsec_pol_ADC-SJDC proposal-set compatible

set security ipsec vpn ADC-SJDC bind-interface st0.0

set security ipsec vpn ADC-SJDC vpn-monitor

set security ipsec vpn ADC-SJDC ike gateway gw_ADC-SJDC

set security ipsec vpn ADC-SJDC ike ipsec-policy ipsec_pol_ADC-SJDC

set security ipsec vpn ADC-SJDC establish-tunnels immediately