skip to main |
skip to sidebar
Previous posted about setup mini lab OSPF with one Juniper use virtual-router to separate route table. The virtual-router is not just separate routing table as basic function, but some of other feature can also separated. It's not just OSPF can run between virtual-router, BGP routing protocols can running well. This is great feature, why ? because a physical router can setup multiple AS number to running multiple BGP process.
The other great way from JunOS to really separation is Logical-Systems (LSYS). LSYS isn't just traffic separation and some feature, but LSYS can administrative separation, logging separation and resource separation. The purpose is to partition system, the system don't talk each other. Special for SRX system, LSYS only allow for the high end SRX (SRX1400, SRX3400, SRX3600, SRX5600 and SRX5800) and also have licenses.
#### R0
user@JunOS> show configuration routing-instances R0
instance-type virtual-router;
interface ge-0/0/0.0;
routing-options {
autonomous-system 10;
}
protocols {
bgp {
group BGPtoR1 {
type external;
peer-as 11;
neighbor 172.16.1.11;
}
}
}
#### R1
user@JunOS> show configuration routing-instances R1
instance-type virtual-router;
interface ge-0/0/1.0;
routing-options {
autonomous-system 11;
}
protocols {
bgp {
group BGPtoR0 {
type external;
peer-as 10;
neighbor 172.16.1.10;
}
}
}
#### Verify BGP
user@JunOS> show bgp summary
Groups: 2 Peers: 2 Down peers: 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
172.16.1.10 10 14 15 0 0 5:20 Establ
R1.inet.0: 0/0/0/0
172.16.1.11 11 14 14 0 0 5:20 Establ
R0.inet.0: 0/0/0/0
user@JunOS> show bgp neighbor instance R0 | no-more
Peer: 172.16.1.11+179 AS 11 Local: 172.16.1.10+51682 AS 10
Type: External State: Established Flags:
Last State: OpenConfirm Last Event: RecvKeepAlive
Last Error: None
Options:
Holdtime: 90 Preference: 170
Number of flaps: 0
Peer ID: 172.16.1.11 Local ID: 172.16.1.10 Active Holdtime: 90
Keepalive Interval: 30 Peer index: 0
BFD: disabled, down
Local Interface: ge-0/0/0.0
NLRI for restart configured on peer: inet-unicast
NLRI advertised by peer: inet-unicast
NLRI for this session: inet-unicast
Peer supports Refresh capability (2)
Restart time configured on the peer: 120
Stale routes from peer are kept for: 300
Restart time requested by this peer: 120
NLRI that peer supports restart for: inet-unicast
NLRI that restart is negotiated for: inet-unicast
NLRI of received end-of-rib markers: inet-unicast
NLRI of all end-of-rib markers sent: inet-unicast
Peer supports 4 byte AS extension (peer-as 11)
Table R0.inet.0 Bit: 10000
RIB State: BGP restart is complete
RIB State: VPN restart is complete
Send state: in sync
Active prefixes: 0
Received prefixes: 0
Accepted prefixes: 0
Suppressed due to damping: 0
Advertised prefixes: 0
Last traffic (seconds): Received 8 Sent 17 Checked 24
Input messages: Total 15 Updates 1 Refreshes 0 Octets 289
Output messages: Total 15 Updates 0 Refreshes 0 Octets 348
Output Queue[0]: 0
user@JunOS> show bgp neighbor instance R1 | no-more
Peer: 172.16.1.10+51682 AS 10 Local: 172.16.1.11+179 AS 11
Type: External State: Established Flags:
Last State: OpenConfirm Last Event: RecvKeepAlive
Last Error: None
Options:
Holdtime: 90 Preference: 170
Number of flaps: 0
Peer ID: 172.16.1.10 Local ID: 172.16.1.11 Active Holdtime: 90
Keepalive Interval: 30 Peer index: 0
BFD: disabled, down
Local Interface: ge-0/0/1.0
NLRI for restart configured on peer: inet-unicast
NLRI advertised by peer: inet-unicast
NLRI for this session: inet-unicast
Peer supports Refresh capability (2)
Restart time configured on the peer: 120
Stale routes from peer are kept for: 300
Restart time requested by this peer: 120
NLRI that peer supports restart for: inet-unicast
NLRI that restart is negotiated for: inet-unicast
NLRI of received end-of-rib markers: inet-unicast
NLRI of all end-of-rib markers sent: inet-unicast
Peer supports 4 byte AS extension (peer-as 10)
Table R1.inet.0 Bit: 20000
RIB State: BGP restart is complete
RIB State: VPN restart is complete
Send state: in sync
Active prefixes: 0
Received prefixes: 0
Accepted prefixes: 0
Suppressed due to damping: 0
Advertised prefixes: 0
Last traffic (seconds): Received 21 Sent 12 Checked 12
Input messages: Total 15 Updates 1 Refreshes 0 Octets 329
Output messages: Total 16 Updates 0 Refreshes 0 Octets 367
Output Queue[1]: 0
Then after the BGP established, I will disable interface in R0 ge-0/0/0.0 then enable again. During enable interface ge-0/0/0.0 also capture traffic in R1 ge-0/0/1.0 use internal feature 'monitor traffic'.
#### Verify BGP Packet Capture
user@JunOS> monitor traffic interface ge-0/0/1
verbose output suppressed, use or for full protocol decode
Address resolution is ON. Use to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on ge-0/0/1, capture size 96 bytes
Reverse lookup for 172.16.1.11 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use to avoid reverse lookups on IP addresses.
08:46:01.819936 Out IP truncated-ip - 4 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: S 1242851017:1242851017(0) win 16384
08:46:04.922312 Out IP truncated-ip - 4 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: S 1242851017:1242851017(0) win 16384
08:46:06.452115 In IP 172.16.1.10.51682 > 172.16.1.11.bgp: FP 3682718233:3682718254(21) ack 1992165605 win 16384 : BGP, length: 21
08:46:06.452337 Out IP 172.16.1.11.bgp > 172.16.1.10.51682: R 1992165605:1992165605(0) win 0
08:46:08.205122 Out IP truncated-ip - 4 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: S 1242851017:1242851017(0) win 16384
08:46:08.208571 In IP 172.16.1.10.bgp > 172.16.1.11.58976: S 376449534:376449534(0) ack 1242851018 win 16384
08:46:08.208894 Out IP 172.16.1.11.58976 > 172.16.1.10.bgp: . ack 1 win 17376
08:46:08.209875 Out IP truncated-ip - 51 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: P 1:60(59) ack 1 win 17376 : BGP, length: 59
08:46:08.217495 In IP 172.16.1.10.bgp > 172.16.1.11.58976: P 1:60(59) ack 60 win 16384 : BGP, length: 59
08:46:08.218170 Out IP truncated-ip - 11 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: P 60:79(19) ack 60 win 17317 : BGP, length: 19
08:46:08.238541 In IP 172.16.1.10.bgp > 172.16.1.11.58976: P 60:79(19) ack 79 win 16365 : BGP, length: 19
08:46:08.240109 Out IP truncated-ip - 11 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: P 79:98(19) ack 79 win 17298 : BGP, length: 19
08:46:08.258311 In IP 172.16.1.10.bgp > 172.16.1.11.58976: P 79:121(42) ack 98 win 16365 : BGP, length: 42
08:46:08.258629 Out IP truncated-ip - 15 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: P 98:121(23) ack 121 win 17256 : BGP, length: 23
08:46:08.365815 In IP 172.16.1.10.bgp > 172.16.1.11.58976: . ack 121 win 16384
08:46:35.063993 In IP 172.16.1.10.bgp > 172.16.1.11.58976: P 121:140(19) ack 121 win 16384 : BGP, length: 19
08:46:35.165828 Out IP 172.16.1.11.58976 > 172.16.1.10.bgp: . ack 140 win 17237
08:46:35.902168 Out IP truncated-ip - 11 bytes missing! 172.16.1.11.58976 > 172.16.1.10.bgp: P 121:140(19) ack 140 win 17237 : BGP, length: 19
08:46:36.006820 In IP 172.16.1.10.bgp > 172.16.1.11.58976: . ack 140 win 16384
^C
19 packets received by filter
0 packets dropped by kernel
user@JunOS> show bgp summary
Groups: 2 Peers: 2 Down peers: 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
172.16.1.10 10 443 449 0 1 56 Establ
R1.inet.0: 0/0/0/0
172.16.1.11 11 4 4 0 1 56 Establ
R0.inet.0: 0/0/0/0
Good Friday, Today I will setup mini lab with one Juniper device. That is one reason why JunOS is cool, We can setup one Juniper router/firewall/switch for mini lab and create many scenario for practice and practice, That is cool .. yeah.
We can create so many simple scenario, like for find packet exchange between routing-protocols, test filter, create policy, and other features.
Before prepare and set configuration, connect physical cable between port/interface ge-0/0/0 and ge-0/0/1.
#### Simple Connectivity R0 and R1
#### R0
user@JunOS> show configuration routing-instances R0
instance-type virtual-router;
interface ge-0/0/0.0;
user@JunOS> show configuration interfaces ge-0/0/0
unit 0 {
description "to R1 ge-0/0/1";
family inet {
address 172.16.1.10/24;
}
}
#### R1
user@JunOS> show configuration routing-instances R1
instance-type virtual-router;
interface ge-0/0/1.0;
user@JunOS> show configuration interfaces ge-0/0/1
unit 0 {
description "to R0 ge-0/0/0";
family inet {
address 172.16.1.11/24;
}
}
#### Verify and Ping Test
user@JunOS> ping routing-instance R0 172.16.1.11 source 172.16.1.10 rapid
PING 172.16.1.11 (172.16.1.11): 56 data bytes
!!!!!
--- 172.16.1.11 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.709/3.806/5.937/1.107 ms
user@JunOS> ping routing-instance R1 172.16.1.10 source 172.16.1.11 rapid
PING 172.16.1.10 (172.16.1.10): 56 data bytes
!!!!!
--- 172.16.1.10 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 3.044/4.342/8.891/2.277 ms
user@JunOS> show arp
MAC Address Address Name Interface Flags
b0:c6:9a:xx:yy:zz 172.16.1.10 172.16.1.10 ge-0/0/1.0 none
b0:c6:9a:xx:yy:zz 172.16.1.11 172.16.1.11 ge-0/0/0.0 none
Total entries: 2
#### OSPF between R0 and R1
user@JunOS> configure
Entering configuration mode
[edit]
user@JunOS# set routing-instances R0 protocols ospf area 0.0.0.0 interface ge-0/0/0.0
[edit]
user@JunOS# set routing-instances R1 protocols ospf area 0.0.0.0 interface ge-0/0/1.0
[edit]
user@JunOS# show | compare
[edit routing-instances R0]
+ protocols {
+ ospf {
+ area 0.0.0.0 {
+ interface ge-0/0/0.0;
+ }
+ }
+ }
[edit routing-instances R1]
+ protocols {
+ ospf {
+ area 0.0.0.0 {
+ interface ge-0/0/1.0;
+ }
+ }
+ }
[edit]
user@JunOS# commit
commit complete
[edit]
user@JunOS#
#### Verify OSPF
user@JunOS> show ospf neighbor instance all
Instance: R0
Address Interface State ID Pri Dead
172.16.1.11 ge-0/0/0.0 Full 172.16.1.11 128 33
Instance: R1
Address Interface State ID Pri Dead
172.16.1.10 ge-0/0/1.0 Full 172.16.1.10 128 35
user@JunOS> show route table R0
R0.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.1.0/24 *[Direct/0] 00:14:12
> via ge-0/0/0.0
172.16.1.10/32 *[Local/0] 00:14:12
Local via ge-0/0/0.0
224.0.0.5/32 *[OSPF/10] 00:04:07, metric 1
MultiRecv
user@JunOS> show route table R1
R1.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.1.0/24 *[Direct/0] 00:14:23
> via ge-0/0/1.0
172.16.1.11/32 *[Local/0] 00:14:23
Local via ge-0/0/1.0
224.0.0.5/32 *[OSPF/10] 00:04:18, metric 1
MultiRecv
This is note and tutorial how to configure smoothly firewall Juniper SRX.
Basicly Juniper SRX is same behaviour with other variant JunOS router and JunOS switch. But as firewall SRX have specific behaviour of security feature. To simple identify specific security feature is SRX have more config under security tree.
#### Juniper SRX Security tree
user@JunOSRX> configure
Entering configuration mode
[edit]
user@JunOSRX# set security ?
Possible completions:
> alg Configure ALG security options
+ apply-groups Groups from which to inherit configuration data
+ apply-groups-except Don't inherit configuration data from these groups
> certificates X.509 certificate configuration
> dynamic-vpn Configure dynamic VPN
> firewall-authentication Firewall authentication parameters
> flow FLOW configuration
> forwarding-options Security-forwarding-options configuration
> ike IKE configuration
> ipsec IPSec configuration
> log Configure security log
> nat Configure Network Address Translation
> pki PKI service configuration
> policies Configure Network Security Policies
> resource-manager Configure resource manager security options
> screen Configure screen feature
> ssh-known-hosts SSH known host list
> traceoptions Network security daemon tracing options
> zones Zone configuration
[edit]
user@JunOSRX# exit
Exiting configuration mode
user@JunOSRX> show security ?
Possible completions:
alg Show ALG security services information
dynamic-policies Show security dynamic policies
dynamic-vpn Show Dynamic VPN Remote Access information
firewall-authentication Show firewall authentication tables, information
flow Show flow information
ike Show Internet Key Exchange information
ipsec Show IP Security information
monitoring Show security SPU monitoring information
nat Show Network Address Translation information
pki Show public-key infrastructure information
policies Show security firewall policies
resource-manager Show resource manager security services information
screen Show screen service information
zones Show security zone information
user@JunOSRX>
Due to SRX as firewall, it has strict rule for some configuration. The simple strict rule is implicit deny. By default all interface in Juniper SRX is implicit deny, that is mean all traffic is deny for ingress and egress. All interface is control under zone (or policy).
#### Example Set Physical Interface and Zone
user@JunOSRX> show configuration interfaces ge-0/0/1
unit 0 {
family inet {
address 172.16.0.1/24;
}
}
user@JunOSRX> show configuration security zones security-zone GE001
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
#### Example Set Logical Interface and Zone
user@JunOSRX> show configuration vlans VLAN7
vlan-id 7;
l3-interface vlan.7;
user@JunOSRX> show configuration interfaces fe-0/0/7
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members VLAN7;
}
}
}
user@JunOSRX> show configuration interfaces vlan unit 7
family inet {
address 172.16.0.7/24;
}
user@JunOSRX> show configuration security zones security-zone FE007
interfaces {
vlan.7 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
Thank you :-)
