Discussion

More documents

Recommendations

Info

Again, it’s worthwhile showing all sections of the configuration together, with added comments: [edit services] service-set ipsec-dynamic { next-hop-service { inside-service-interface sp-1/2/0.1; #
[edit protocols ospf area 0.0.0.0] ospf { area 0.0.0.0 { interface so-0/0/0; interface lo0.0 passive; interface sp-1/2/1.0; # request security pki ca-certificate enroll ca-profile entrust Received following certificates: Certificate: C=us, O=mycompany Fingerprint: 00:8e:6f:58:dd:68:bf:25:0a:e3:f9:17:70:d6:61:f3:53:a7:79:10 Certificate: C=us, O=mycompany, CN=First Officer Fingerprint: bc:78:87:9b:a7:91:13:20:71:db:ac:b5:56:71:42:ad:1a:b6:46:17 Certificate: C=us, O=mycompany, CN=First Officer Fingerprint: 46:71:15:34:f0:a6:41:76:65:81:33:4f:68:47:c4:df:78:b8:e3:3f Do you want to load the above CA certificate ? [yes,no] (no) yes Next, generate a public/private key pair, which is required to submit a request for a local certificate: aviva@RouterA> request security pki generate-key-pair certificate-id local-entrust Generated key pair local-entrust, key size 1024 bits Then, send a request for a local certificate to the CA: aviva@RouterA> request security pki generate-certificate-request certificate-id local-entrust domain-name RouterA.mycompany.com filename entrust-request-RouterA subject cn=RouterA.mycompany.com Using Digital Certificates to Create Dynamic IPSec SAs | 121 This is the Title of the Book, eMatter Edition Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Page 3 and 4:
JUNOS Cookbook
Page 5 and 6:
JUNOS Cookbook Aviva Garrett Beijin
Page 7 and 8:
Table of Contents Foreword . . . .
Page 9 and 10:
3. IPSec . . . . . . . . . . . . .
Page 11 and 12:
8.5 Creating Static Routes 263 8.6
Page 13 and 14:
13.5 Adjusting Local Preference Val
Page 15 and 16:
Foreword The early days at Juniper
Page 17 and 18:
Throughout 1997 and early 1998, all
Page 19 and 20:
Preface1 Over the past decade, netw
Page 21 and 22:
Organization As the name suggests,
Page 23 and 24:
Constant width Used for code sectio
Page 25 and 26:
Chapter 1 CHAPTER 1 Router Configur
Page 27 and 28:
You can use a number of operational
Page 29 and 30:
The show command displays the items
Page 31 and 32:
Each listed completion is the confi
Page 33 and 34:
command on the left side of the pip
Page 35 and 36:
The > tells you that you are in ope
Page 37 and 38:
} } } root@# commit root@router1# e
Page 39 and 40:
For the initial router configuratio
Page 41 and 42:
At this point in configuring the ro
Page 43 and 44:
1.4 Displaying the Commands to Recr
Page 45 and 46:
Discussion It is generally good pra
Page 47 and 48:
is often the first thing to check w
Page 49 and 50:
In this example, the error is in th
Page 51 and 52:
To track down what changed in the c
Page 53 and 54:
Solution Use the following command
Page 55 and 56:
login { class superuser-local { per
Page 57 and 58:
If PIM is not yet configured, merge
Page 59 and 60:
You can also save it to a file in y
Page 61 and 62:
These files are also compressed. av
Page 63 and 64:
You see that the running configurat
Page 65 and 66:
Solution The rollback configuration
Page 67 and 68:
See Also Recipe 1.17 1.19 Backing U
Page 69 and 70:
ad1 11513 MB IBM-DARA-212000 AH0AHG
Page 71 and 72:
J-series filesystems on a device co
Page 73 and 74:
1.22 Installing a Different Softwar
Page 75 and 76:
Use the request system software add
Page 77 and 78:
support site (http://www.juniper.ne
Page 79 and 80:
JUNOS 7.0 was released in the fourt
Page 81 and 82:
Some of the main processes are MGD,
Page 83 and 84:
switching board (the SSB), and two
Page 85 and 86:
1.28 Gathering Information Before C
Page 87 and 88:
The apply-groups statement causes t
Page 89 and 90:
} } } address 10.0.16.1/24; Finally
Page 91 and 92:
The commit synchronize command comm
Page 93 and 94: modules/ packages/ proc/ root/ sbin
Page 95 and 96: At this point, you can also upgrade
Page 97 and 98: lets them gain access to the router
Page 99 and 100: client/server systems—the RADIUS
Page 101 and 102: You need to enable FTP only if you
Page 103 and 104: use of the root account. Logging in
Page 105 and 106: A slight twist to this recipe is to
Page 107 and 108: Also, you will not be able to commi
Page 109 and 110: Solution Set all plain-text passwor
Page 111 and 112: Discussion When you want users to b
Page 113 and 114: individual user accounts with passw
Page 115 and 116: ead-only Can perform all actions in
Page 117 and 118: If you try to enter a command that
Page 119 and 120: aviva@router1# set class operator-p
Page 121 and 122: If you use a centralized server, it
Page 123 and 124: aviva@RouterF# set term ssh-telnet
Page 125 and 126: statement in the configuration, whi
Page 127 and 128: een idle, and what they are doing.
Page 129 and 130: Mike would be logged out: mike@rout
Page 131 and 132: Encryption, which is the encoding o
Page 133 and 134: networks, it does not scale well. A
Page 135 and 136: } } [edit interfaces] es-3/0/0 { #
Page 137 and 138: have to set up an IKE SA and a fire
Page 139 and 140: Here’s what the relevant portions
Page 141 and 142: Finally, configure the domain’s I
Page 143: Configure the security gateway rout
Page 147 and 148: Then, configure the IPSec tunnel to
Page 149 and 150: Issuer: Organization: mycompany, Co
Page 151 and 152: Alternate subject: RouterB.mycompan
Page 153 and 154: Chapter 4 CHAPTER 4 SNMP4 4.0 Intro
Page 155 and 156: juniperMIB, which is the top node o
Page 157 and 158: Juniper Networks provides several d
Page 159 and 160: 4.2 Setting Router Information for
Page 161 and 162: Table 4-1. SNMP trap categories Key
Page 163 and 164: Solution You can add a term to the
Page 165 and 166: You might want to give access to al
Page 167 and 168: aviva@router1> show snmp mib get "j
Page 169 and 170: 4.9 Collecting Router Operational I
Page 171 and 172: CPU utilization: User 0 percent Bac
Page 173 and 174: Table 4-2. System logging severity
Page 175 and 176: Discussion RMON is an SNMP specific
Page 177 and 178: See Also RFC 2819, Remote Network M
Page 179 and 180: nms1 sha/3des nonvolatile active Gr
Page 181 and 182: Again, this recipe is somewhat invo
Page 183 and 184: Finally, configure which traps the
Page 185 and 186: } notify chassis-notification-list
Page 187 and 188: Some are the same as those used by
Page 189 and 190: Solution Use the following commands
Page 191 and 192: 5.2 Limiting the Messages Collected
Page 193 and 194: Discussion The default maximum size
Page 195 and 196:
no longer need. Here, we logged RIP
Page 197 and 198:
Discussion This configuration redir
Page 199 and 200:
This command causes all messages se
Page 201 and 202:
Apr 29 22:55:16 router xntpd[4977]:
Page 203 and 204:
The traceoption flags indicate the
Page 205 and 206:
Chapter 6 CHAPTER 6 NTP6 6.0 Introd
Page 207 and 208:
6.2 Setting the Time Zone Problem Y
Page 209 and 210:
Engine boots, the ntpdate utility r
Page 211 and 212:
You can also have all the routers s
Page 213 and 214:
6.6 Checking NTP Status Problem You
Page 215 and 216:
Chapter 7 CHAPTER 7 Router Interfac
Page 217 and 218:
under the name of the interface and
Page 219 and 220:
Solution Use the show interfaces co
Page 221 and 222:
the physical interface. It allows y
Page 223 and 224:
Solution The show interfaces extens
Page 225 and 226:
Broadcast packets 0 [0] Multicast p
Page 227 and 228:
Input packets : 5 Output packets: 5
Page 229 and 230:
1.0.12.2/30 so-1/0/0 Mars 1.0.0.1/3
Page 231 and 232:
To remove an extra IP address, use
Page 233 and 234:
Discussion For MPLS traffic to tran
Page 235 and 236:
Flags: None Addresses, Flags: Is-Pr
Page 237 and 238:
Solution Configure the router’s m
Page 239 and 240:
On an M-series or a T-series router
Page 241 and 242:
You can confirm the presence of the
Page 243 and 244:
Protocol inet6, MTU: 1500 Flags: Is
Page 245 and 246:
Solution Use the Virtual Router Red
Page 247 and 248:
Solution There are three steps to s
Page 249 and 250:
7.16 Configuring T1 Interfaces Prob
Page 251 and 252:
Run the loopback test, which sends
Page 253 and 254:
7.18 Setting Up a BERT Test on a T1
Page 255 and 256:
You can configure an error rate to
Page 257 and 258:
Discussion Synchronous Optical Netw
Page 259 and 260:
SEF 22 182 OK LOS 22 1 OK LOF 22 1
Page 261 and 262:
Use the show aps command to check t
Page 263 and 264:
type of ATM PIC, the configuration
Page 265 and 266:
gre up ipip up lo0 up up lo0.0 up u
Page 267 and 268:
Solution Add the new interface to t
Page 269 and 270:
While this does what you want, it m
Page 271 and 272:
When a single routing protocol prov
Page 273 and 274:
IPv6 uses 128-bit addresses that co
Page 275 and 276:
8.1 Viewing the Routes in the Routi
Page 277 and 278:
oute is learned from a dynamic rout
Page 279 and 280:
} } family iso { address 49.0020.19
Page 281 and 282:
8.2 Viewing Routes to a Particular
Page 283 and 284:
8.3 Viewing Routes Learned from a S
Page 285 and 286:
ff00::/8 perm 0 mdsc 53 1 ff02::1/1
Page 287 and 288:
The actual forwarding tables that t
Page 289 and 290:
and the traffic to these networks i
Page 291 and 292:
Attacker A B Target Real source add
Page 293 and 294:
Check the firewall filter counts wi
Page 295 and 296:
Solution Create a routing policy th
Page 297 and 298:
Discussion Martian addresses are pr
Page 299 and 300:
Solution After configuring both OSP
Page 301 and 302:
To verify the preference change, lo
Page 303 and 304:
Peer supports Refresh capability (2
Page 305 and 306:
This recipe shows how to enable gra
Page 307 and 308:
Because the policy and filter condi
Page 309 and 310:
then accept; } } } protocols { ospf
Page 311 and 312:
The first command in the recipe def
Page 313 and 314:
[edit] aviva@router1# set protocols
Page 315 and 316:
Table 9-4. Actions that change rout
Page 317 and 318:
(called longest-match lookup), so t
Page 319 and 320:
aviva@router1# set term 2 then reje
Page 321 and 322:
See Also IANA, http://www.iana.org/
Page 323 and 324:
the community string from the route
Page 325 and 326:
used to verify that the router is m
Page 327 and 328:
} } Discussion } } Placing firewall
Page 329 and 330:
Table 9-5. Header match conditions
Page 331 and 332:
counterintuitive. However, understa
Page 333 and 334:
protocol-except tcp; } then { count
Page 335 and 336:
protocol tcp; destination-port [ te
Page 337 and 338:
Firewall filter terms are evaluated
Page 339 and 340:
9.12 Using a Firewall Filter to Cou
Page 341 and 342:
04:58:41 pfe A t1-0/0/3.0 TCP 10.0.
Page 343 and 344:
which traffic is more important and
Page 345 and 346:
The next term allows TCP traffic: [
Page 347 and 348:
Routing Engine, you want to make su
Page 349 and 350:
from { source-address { 10.0.8.0/24
Page 351 and 352:
9.16 Rate-Limiting Traffic Flow to
Page 353 and 354:
list of IP addresses in one place i
Page 355 and 356:
lished TCP connections and you sudd
Page 357 and 358:
By default, the JUNOS software impl
Page 359 and 360:
} } } neighbor fe-0/0/0.0; neighbor
Page 361 and 362:
10.0.0.0/24 *[Direct/0] 2w4d 23:05:
Page 363 and 364:
The routing policy you set up is a
Page 365 and 366:
so the inbound metrics are 1. The m
Page 367 and 368:
can use it in the authentication-ke
Page 369 and 370:
10.6 Sending Version 1 Update Messa
Page 371 and 372:
Mar 31 10:11:13 Group beta-rip-grou
Page 373 and 374:
Chapter 11 CHAPTER 11 IS-IS11 11.0
Page 375 and 376:
oundary. This means that the IS-IS
Page 377 and 378:
might be useful when migrating two
Page 379 and 380:
Interface System L State Hold (secs
Page 381 and 382:
RouterA.02-00 0x59 0xeda9 632 L1 L2
Page 383 and 384:
The next four lines show the IP pre
Page 385 and 386:
configuring the preference statemen
Page 387 and 388:
11.5 Configuring a Level 1-Only Rou
Page 389 and 390:
11.6 Controlling DIS Election Probl
Page 391 and 392:
key, or password, for each interfac
Page 393 and 394:
} } from protocol static; then acce
Page 395 and 396:
Again, we expect the metric to chan
Page 397 and 398:
RouterA Level 2 RouterB Level 2 Rou
Page 399 and 400:
Increasing the IS-IS cost of Router
Page 401 and 402:
11.12 Moving IS-IS Traffic off a Ro
Page 403 and 404:
11.14 Tracing IS-IS Protocol Traffi
Page 405 and 406:
Using some of the other flags, you
Page 407 and 408:
OSPF views routers as nodes, which
Page 409 and 410:
Area 0.0.0.0 RouterG lo0:192.168.19
Page 411 and 412:
Another common problem in establish
Page 413 and 414:
The route entries starting with [OS
Page 415 and 416:
entries that originated from the lo
Page 417 and 418:
OSPF network. Route 192.168.18.1:0.
Page 419 and 420:
Checking on RouterA at the other en
Page 421 and 422:
192.168.19.1/32 *[Direct/0] 3d 01:5
Page 423 and 424:
The routers in the stub area no lon
Page 425 and 426:
Router 192.168.16.1 192.168.16.1 0x
Page 427 and 428:
Solution You configure MD5 authenti
Page 429 and 430:
Use the show ospf interface detail
Page 431 and 432:
With the default metric, traffic fr
Page 433 and 434:
12.12 Improving OSPF Convergence Ti
Page 435 and 436:
This output shows two BFD sessions
Page 437 and 438:
aviva@RouterG# commit aviva@RouterG
Page 439 and 440:
Jun 14 22:00:26 CHANGE 192.168.17.1
Page 441 and 442:
Jun 13 16:55:20 IP Route added with
Page 443 and 444:
list of ASs to see whether a route
Page 445 and 446:
E Route was originally learned from
Page 447 and 448:
Then configure an EBGP session to t
Page 449 and 450:
NLRI for this session: inet-unicast
Page 451 and 452:
Next is information about routes le
Page 453 and 454:
Looking at the remote peer router,
Page 455 and 456:
* 10.0.31.0/24 Self I * 172.19.121.
Page 457 and 458:
aviva@RouterE> show bgp summary Gro
Page 459 and 460:
to 10.0.31.1 via t1-0/0/3.0 10.0.29
Page 461 and 462:
lem with BGP itself. When the TCP s
Page 463 and 464:
13.4 Adjusting the Next-Hop Attribu
Page 465 and 466:
The first configuration in this rec
Page 467 and 468:
13.7 Prepending AS Numbers to the A
Page 469 and 470:
13.8 Filtering BGP Routes Based on
Page 471 and 472:
Translated, this match looks for fo
Page 473 and 474:
Type: External State: Established F
Page 475 and 476:
This recipe configures MD5 authenti
Page 477 and 478:
oute reflector system has a set of
Page 479 and 480:
10.0.24.0/24 *[BGP/170] 00:18:38, l
Page 481 and 482:
AS 65500 Sub-AS 65501 RouterF 192.1
Page 483 and 484:
figure-of-merit value correlates to
Page 485 and 486:
Once the routing policy is set up,
Page 487 and 488:
change, the router will unsuppress
Page 489 and 490:
See Also RFC 2439, BGP Route Flap D
Page 491 and 492:
You see that the route to 192.168.1
Page 493 and 494:
When setting up policies, also crea
Page 495 and 496:
} See Also next-hop 192.0.2.1; acce
Page 497 and 498:
Another restriction for multipath B
Page 499 and 500:
This forwarding table is then copie
Page 501 and 502:
BGP establishes the connection, fro
Page 503 and 504:
Chapter 14a CHAPTER 14 MPLS14 14.0
Page 505 and 506:
Layer 2 header MPLS header Layer 3
Page 507 and 508:
RouterG 192.168.19.1 Ingress router
Page 509 and 510:
The main difference between LDP and
Page 511 and 512:
family to the t1-4/0/0 interface; o
Page 513 and 514:
Also verify the MPLS-enabled interf
Page 515 and 516:
The first line of the output shows
Page 517 and 518:
aviva@RouterG> show configuration p
Page 519 and 520:
via t1-4/0/0.0, Push 100000 192.168
Page 521 and 522:
aviva@RouterG> show route forwardin
Page 523 and 524:
This recipe shows how to configure
Page 525 and 526:
Oct 5 19:25:52 Msg Hello (0x100), l
Page 527 and 528:
aviva@R3# set rsvp interface fxp0.0
Page 529 and 530:
fxp0 up up fxp0.0 up up inet 192.16
Page 531 and 532:
aviva@R1> show rsvp interface RSVP
Page 533 and 534:
y 13:31:06 the LSP was up and runni
Page 535 and 536:
10.0.0.6 10.0.0.1 Up 0 1 FF 3 - R1-
Page 537 and 538:
Solution On the ingress router, loo
Page 539 and 540:
for LSP signaling. On the egress an
Page 541 and 542:
Discussion There are several ways t
Page 543 and 544:
14.9 Verifying that the RSVP-Signal
Page 545 and 546:
14.11 Protecting an LSP’s Path Pr
Page 547 and 548:
RSVP RRO in the path calculation lo
Page 549 and 550:
The configuration allocates 50 Mbps
Page 551 and 552:
However, RSVP cannot establish the
Page 553 and 554:
Solution Fast reroute reduces packe
Page 555 and 556:
PATH sentto: 10.1.13.2 (so-0/0/2.0)
Page 557 and 558:
The RSVP interface status shows tha
Page 559 and 560:
14.13 Automatically Allocating Band
Page 561 and 562:
Then examine the history of the LSP
Page 563 and 564:
To understand how preemption works,
Page 565 and 566:
10.0.0.5 From: 10.0.0.1, State: Up,
Page 567 and 568:
9 Oct 14 10:51:20 Deselected as act
Page 569 and 570:
The router knows how to reach its i
Page 571 and 572:
10.1.13.1/32 *[Local/0] 2d 20:39:51
Page 573 and 574:
aviva@R1> clear log rsvp-trace-log
Page 575 and 576:
PATH rcvfrom: 10.1.13.2 (so-0/0/2.0
Page 577 and 578:
The discussion of Layer 3 VPNs invo
Page 579 and 580:
VPN, and routes announced by a remo
Page 581 and 582:
The third and final step is to conf
Page 583 and 584:
One last protocol that you need to
Page 585 and 586:
All routes that are part of the VPN
Page 587 and 588:
--- 192.168.13.1 ping statistics --
Page 589 and 590:
1 *[MPLS/0] 1d 18:03:41, metric 1 R
Page 591 and 592:
65500:3:10.0.31.0/24 *[BGP/170] 00:
Page 593 and 594:
emains private. When configuring th
Page 595 and 596:
} } peer-as 65500; neighbor 10.0.1.
Page 597 and 598:
The VPN2 routing table also knows n
Page 599 and 600:
Just to make sure that prefixes are
Page 601 and 602:
Multicast senders and receivers are
Page 603 and 604:
You administratively configure the
Page 605 and 606:
10.0.21.2/24 RouterB 192.168.12.1 R
Page 607 and 608:
IGMP Last Member Query Interval: 1.
Page 609 and 610:
Again, verify the configured group
Page 611 and 612:
willing to be an RP send RP Announc
Page 613 and 614:
JUNOS routers perform the encapsula
Page 615 and 616:
Now check the RP status on the rout
Page 617 and 618:
Also, make sure that the router’s
Page 619 and 620:
Check to see which RPs the various
Page 621 and 622:
The anycast PIM configuration is qu
Page 623 and 624:
Solution Specify the group address
Page 625 and 626:
The interfaces toward the multicast
Page 627 and 628:
Discussion Flags: sparse Upstream i
Page 629 and 630:
IGMP Query Response Interval: 10.0
Page 631 and 632:
If you are not sure that the domain
Page 633 and 634:
Discussion With PIM-SM, the RP in e
Page 635 and 636:
The full RIB group configuration lo
Page 637 and 638:
} address 192.168.19.1; # ping 224
Page 639 and 640:
Upstream interface: local Upstream
Page 641 and 642:
The first entry is for the source i
Page 643 and 644:
IGMP Last Member Query Interval: 1.
Page 645:
The command in this recipe is a sim
Page 648 and 649:
adjacencies (continued) IGPs and, 1
Page 650 and 651:
BGP (Border Gateway Protocol) (cont
Page 652 and 653:
configure command (continued) exclu
Page 654 and 655:
dotted quad notation, 248 down arro
Page 656 and 657:
firewall filters (continued) loggin
Page 658 and 659:
IBGP (internal BGP) (continued) LOC
Page 660 and 661:
IP multicast (continued) limiting g
Page 662 and 663:
Level 1 systems (IS-IS) authenticat
Page 664 and 665:
martian addresses/prefixes (continu
Page 666 and 667:
O Object Identifier (see OID) OID (
Page 668 and 669:
plain-text passwords (continued) JU
Page 670 and 671:
RFC (Request for Comment) on BGP, 4
Page 672 and 673:
outing tables (continued) checking
Page 674 and 675:
set route-filter command, 296 set r
Page 676 and 677:
show ospf interface command, 386, 3
Page 678 and 679:
ssh command, 3, 89 SSM (Source-Spec
Page 680 and 681:
tracing (trace logging) (continued)
Page 683:
About the Author Aviva Garrett has
show all

Discussion

Create successful ePaper yourself

Delete template?

Save as template?