Upgrade Junos 10.0 to 12.3. Activating NSR, NSB

Junos 10.0 is not recommended and supported anymore. Latest releases add some interresting features on pure/non-mixed EX 4200 virtual-chassis like nonstop active routing, nonstop bridging and ISSU. Best choice is to upgrade to newest release during one maintenance window.

Link to JTAC Recommended Junos Software Versions

Link to EX4200 - Download Software

They upgraded download page, so it directly leads you to recommended version. You need priviledges to download Junos.

There is a little notice when you want to download Junos 10.4R3+. for EX 4200. I am going to incorporate content of this notice later in this blog. We need to click on text TSB15524 to download jloader file. Link to jloader files.

Notice that there has been some problem with newer hardware revisions. As mentioned on TSB15524, links are changed to right jloader files. Link to more info about this problem.

You should have read release notes for version that you are going to upgrade to. So please read 12.3 release notes. Link to Junos Software Release Notes 12.3. You should also have to download additional files like MIBs, Documentation, Radius Dictionary, etc.

Read this from Relase notes 12.3. On left click Junos OS Release Notes for EX Series Switches and then Upgrade and Downgrade Instructions for Junos OS Release 12.3 for EX Series Switches. This is the same direct link: Upgrade and Downgrade Instructions for Junos OS Release 12.3 for EX Series Switches. 

You cannot directly upgrade to 12.3:

Upgrading from Junos OS Release 10.4R2 or Earlier

To upgrade to Junos OS Release 12.3 from Junos OS Release 10.4R2 or earlier, first upgrade to Junos OS Release 11.4 by following the instructions in the Junos OS Release 11.4 release notes. See Upgrading from Junos OS Release 10.4R2 or Earlier or Upgrading from Junos OS Release 10.4R3 or Later in the Junos OS 11.4 Release Notes .

So download latest 11.4 and jloader. Link to jloader files was mentioned before. Download Junos OS 11.4 Release Notes.

So the process looks like this:

download jloader, Junos 11.4, 12.3 ->

-> upgrade jloader -> upgrade to 11.4 and reboot -> check VC -> upgrade to 12.3 and reboot -> check VC ->

-> if not configured, configure commit synchronize, graceful switchover->

-> if VC consists of two switches, configure no-split-detection ->

-> deactivate GRES (graceful-restart) -> activate NSB -> activate NSR -> check NSR, NSB

Install jloader and Junos 11.4 from USB

Copy these files to an USB with FAT32.

 

Log to virtual-chassis (I recommend via Console)

 

Plug it to a Master switch. (MST led is green on or > show virtual-chassis) 

Login as root and start shell

> start shell user root

Create new directory 

% mkdir /var/tmp/usb

Mount usb

% mount -t msdosfs /dev/da1s1 /var/tmp/usb

Add jloader

% cli

> request system software add /var/tmp/usb/jloader-ex-3242-XX.Xbuild-signed.tgz

 

Add software and automatically reboot. Content of usb will be erased. All members of VC will be upgraded,

> request system software add /var/tmp/usb/jinstall.... reboot

After boot. Check system status of VC. Copy new 12.3 junos to usb, plug it in master switch, mount it and upgrade to 12.3

> request system software add /var/tmp/usb/jinstall.... reboot

How to enable NSR & NSB?

configure commit synchronize, graceful switchover (GRES)

> configure

# set system commit synchronize
# set chassis redundancy graceful-switchover

# commit

if VC consists of two switches, configure no-split-detection

# set virtual-chassis no-split-deteciton

# commit

GR and NSR cannot be enabled on the same device. Please read this link to overview what is GR and NSR.[Subscriber Management] GRES & NSR Configuration Quick Summary 

 

deactivate graceful restart (GR)

# delete routing-options greceful-restart

GR could be enabled under protocols like bgp. Show where GR is configured

# show | display set | match graceful-restart

# set protocols bgp graceful-restart

# delete protocols bgp graceful-restart

# commit 

activate NSB, activate NSR

# set routing-options nonstop-routing
# commit

# set ethernet-switching-options nonstop-routing

# commit

ISSU

Just read following link. There is a lot to do. ISSU is basically a technology that upgrades VC members one after another to minimalize downtime. Best achieved if your links are aggregated trunks spanning through multiple members.

Link to Understanding Nonstop Software Upgrade on EX Series Switches

check NSR, NSB

Check this link on how to check NSR and NSB. [Subscriber Management] GRES & NSR Configuration Quick Summary

That is all.

Juniper EX mac-based VLANs

Juniper EX mac-based VLANs

Hi All,

Imagine that you have to assign a VLAN to a device that is not capable of sending a tagged frames. You can assign VLAN based on a MAC address or a MAC address OUI (first 3 octets), or mask. An example could be a VoIP phone or a set-top-box. Yes, for VoIP, you have a great functionality called Voice VLAN that could suits your scenario. But for my scenario it was not an option.

On a picture you can see three devices connected to unmanaged switch that send untagged frames. Unmanaged switch is connected to EX2200. On EX2200 you have a configuration that assign particular VLAN to specific frames:

interfaces {
    ge-0/0/0 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members 10;
                }
            }
        }
    }
}
protocols {
    dot1x {
        authenticator {
            static {
                00:15:c5:f5:d1:d1/48 {
                    vlan-assignment 11;
                }
                00:1c:c4:00:00:00/24 {
                    vlan-assignment 78;
                }
            }
            interface {
                ge-0/0/0.0 {
                    supplicant multiple;
                }            }
        }
    }
}
vlans {
    v11 {
        description "PHONE";
        vlan-id 11;
    v78 {
        description "VIDEO";
        vlan-id 78;
    }
}

This will "set" vlan 11 to a device with MAC 00:15:c5:f5:d1:d1 and vlan 78 to addresses 00:1c:c4:00:00:00/24. Interface is configured for mode access so PC is automatically taged to default vlan 10. Uplink port configuration is not included. To show a vlan assigment use show vlans, show dot1x interface


Here are some references.

• My older forum post: http://forums.juniper.net/t5/Ethernet-Switching/mac-based-vlans/td-p/78548.
• Junos static mac-based vlan assigment http://www.juniper.net/techpubs/en_US/junos12.2/topics/task/configuration/authentication-static-mac-bypass-ex-series-cli.html
• Vlan could be set via Radius. I googled and found this http://daemonkeeper.net/638/configure-mac-based-vlan-assignment-with-freeradius-and-junos/. Search for Configure MAC-Auth and EX Configuration and this: Junos reference http://www.juniper.net/techpubs/en_US/junos9.4/topics/concept/802-1x-pnac-guest-vlan-understanding.html and https://kb.juniper.net/InfoCenter/index?page=content&id=KB12688&cat=EX8216_1&actp=LIST&showDraft=false

End notes:

• I was not successful with setting bidirectional untagged vlan on port for particular mac-address with firewall filters. (on EX2200).
• Mac-based vlans are compatible with other features like multicast-igmp snooping and QoS-per queue (VLAN) shaping
• This should works on some devices. I didn't tested it: ... vlan mapping policy + firewall filter http://forums.juniper.net/t5/Ethernet-Switching/quot-filter-based-VLANs-quot/td-p/141799
• There is a new functionality on 11.1. I didn't tested it: http://juniper.tw/techpubs/en_US/junos12.2/topics/reference/configuration-statement/next-hop-edit-ethernet-switching-options-static.html

Testing how much routes a device could handle with Quagga

Hi,

I wanted to stress-test multilayer switch Juniper EX 4200 and its routing engine. Somehow. I wanted to simulate a number of BGP routes and how will switch react. Importing and filtering BGP routes to Adj-RIB-In table and then to routing table could be stressfull for device and this could lead to 100% cpu usage and for example OSPF adjacency flapping. Most of work in this blog is done by a route generator script. You could also use a spreadsheet editor (Excel) and then edit exported text to create routes in Quagga configuration file.

 What do you need?

• router (EX4200 with a advanced license. But don't worry. BGP on EX4200 should work even without license. At least it used to work on older releases. It yelds message to console during commit  and regularry to syslog)
• standard Linux or Ubuntu PC with NIC and Quagga
• ethernet cable :-)

Juniper EX 4200 specifications [2]

IPv4 Unicast routes: 16,000

Install and configure Quagga on a Ubuntu PC
# apt-get install quagga

Change Ubuntu IP addresses
# ifconfig eth0 192.0.2.1/24

 Edit Quagga configuration file ...
# nano /etc/quagga/daemons

... and you should run at least these two Quagga daemons
zebra=yes
bgp=yes

How to generate many routes
I used script from this site V. Glinsky[1] blog.
Change these two lines in that script:

my $router_id="192.0.2.1"; #bgp router-id
my $remote_ip="192.0.2.2"; #BGP neighbor ip address

Leave other values unchanged. It is going to generate 300,000 routes. Much more than 16,000. Let's say we are all right with AS numbers. Ubuntu AS65099, Juniper AS65001. Actually I generated 599999 routes in my example.

Copy generated bgpd.conf file to a directory /etc/quagga/.

Here is how bgpd.conf should look
hostname quagga-host
password zebra
enable password zebra
line vty
router bgp 65099
  bgp router-id 192.0.2.1
  neighbor 192.0.2.2 remote-as 65001
  network 70.0.0.0/24
  network 70.0.1.0/24
  network 70.0.2.0/24
  network 70.0.3.0/24 

Run Quagga
# /etc/init.d/quagga restart

Configure Juniper BGP protocol and interface
root@ex4200> show configuration protocols bgp 
local-as 65001;
group bgp-test {
    type external;
    peer-as 65099;
    neighbor 192.0.2.1;
}


root@ex4200> show configuration interfaces ge-0/0/0   
unit 0 {
    family inet {
        address 192.0.2.2/24;
}

root@ex4200> show configuration routing-options
router-id 192.0.2.2;
autonomous-system 65001; 

There is a warning during commit. You should have a license. Don't worry, it's OK for now. It will work even without it.
{master:0}[edit]
root@ex4200# commit
[edit protocols]
  'bgp'
    warning: requires 'bgp' license
configuration check succeeds
commit complete 

Connect two devices with ethernet cable and observe results
Juniper EX 4200:

root@ex4200> show bgp summary  
Groups: 1 Peers: 1 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0             
                   16372      16372          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.0.2.1             65099        299          4       0       0          28 16372/16372/16372/0  0/0/0/0
BGP neighbor adjacency status is Established. Highlighted is number of accepted routes in a Adj-Rib-In table. We don't use any import policy.

root@ex4200> show route

inet.0: 16384 destinations, 16384 routes (16384 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

2.0.0.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
                      AS path: 65099 I, validation-state: unverified
                    > to 192.0.2.1 via ge-0/0/0.0
2.0.1.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
                      AS path: 65099 I, validation-state: unverified
                    > to 192.0.2.1 via ge-0/0/0.0
2.0.2.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
                      AS path: 65099 I, validation-state: unverified
                    > to 192.0.2.1 via ge-0/0/0.0
2.0.3.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
                      AS path: 65099 I, validation-state: unverified
                    > to 192.0.2.1 via ge-0/0/0.0
2.0.4.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
                      AS path: 65099 I, validation-state: unverified
                    > to 192.0.2.1 via ge-0/0/0.0
2.0.5.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
                      AS path: 65099 I, validation-state: unverified
                    > to 192.0.2.1 via ge-0/0/0.0
2.0.6.0/24         *[BGP/170] 00:00:39, MED 0, localpref 100
---(more)---

Highlighted number is number of active routes in routing table.
 

root@ex4200> show chassis routing-engine
Routing Engine status:
  Slot 0:
    Current state                  Master
    Temperature                 34 degrees C / 93 degrees F
    CPU temperature             34 degrees C / 93 degrees F
    DRAM                      1024 MB
    Memory utilization          44 percent
    CPU utilization:
      User                      23 percent
      Background                 0 percent
      Kernel                    34 percent
      Interrupt                  0 percent
      Idle                      42 percent
    Model                          EX4200-24F
    Serial ID                      BR0210217636
    Start time                     2013-01-19 19:28:27 UTC
    Uptime                         31 minutes, 9 seconds
    Last reboot reason             0x2:watchdog
    Load averages:                 1 minute   5 minute  15 minute
                                       0.45       0.15       0.10
CPU utilization is a bit higher right after establishing adjacency and receiving routes.

You could also use command
> show system processes extended
to see how rpd process is using CPU [3].

Connect to Quagga and show bgp config
root@bt:~# telnet localhost 2605
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

Hello, this is Quagga (version 0.99.15).
Copyright 1996-2005 Kunihiro Ishiguro, et al.


User Access Verification
 
Password:  (password is zebra or quagga)
quagga-host>
quagga-host> show ip bgp summary
BGP router identifier 192.0.2.1, local AS number 65099
RIB entries 599999, using 37 MiB of memory
Peers 1, using 2520 bytes of memory

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4 65001       5     304        0    0    0 00:02:00        0

Total number of neighbors 1
 
quagga-host> show ip bgp neighbors
BGP neighbor is 192.0.2.2, remote AS 65001, local AS 65099, external link
  BGP version 4, remote router ID 192.0.2.2
  BGP state = Established, up for 00:02:05
  Last read 00:00:19, hold time is 90, keepalive interval is 30 seconds
  Neighbor capabilities:
    4 Byte AS: advertised and received
    Route refresh: advertised and received(old & new)
    Address family IPv4 Unicast: advertised and received
    Graceful Restart Capabilty: received
      Remote Restart timer is 120 seconds
      Address families by peer:
        none
  Graceful restart informations:
    End-of-RIB send: IPv4 Unicast
    End-of-RIB received:
  Message statistics:
    Inq depth is 0
    Outq depth is 0
                         Sent       Rcvd
    Opens:                  1          0
    Notifications:          0          0
    Updates:              298          0
    Keepalives:             6          5
    Route Refresh:          0          0
    Capability:             0          0
    Total:                305          5
  Minimum time between advertisement runs is 30 seconds

 For address family: IPv4 Unicast
  Community attribute sent to this neighbor(both)
  0 accepted prefixes

  Connections established 1; dropped 0
  Last reset never
Local host: 192.0.2.1, Local port: 179
Foreign host: 192.0.2.2, Foreign port: 60656
Nexthop: 192.0.2.1
Nexthop global: ::
Nexthop local: ::
BGP connection: non shared network
Read thread: on  Write thread: off 

Session is established. 599999 routes loaded from config file.
 
Other ways to BGP routes generation
Nice guide on how to generate routes from real world bgp routes dump:
http://evilrouters.net/2009/08/21/getting-bgp-routes-into-dynamips-with-video/ 

How to mitigate this 'attack'?
There is a command to change behavior after certain number of routes are received.
http://www.juniper.net/techpubs/en_US/junos12.3/topics/reference/configuration-statement/accepted-prefix-limit-edit-protocols-bgp.html

References:
[1] http://blog.glinskiy.com/2009/10/how-to-generate-lots-of-bgp-routes.html
[2] http://www.juniper.net/us/en/products-services/switching/ex-series/ex4200/#specifications
[3] http://www.juniper.net/techpubs/en_US/junos9.6/information-products/topic-collections/nog-baseline/routing-engine--memory-introduction.html

Mirroring from multiple physical interfaces to one interface

How to port mirror from multiple physical interfaces (on multiple devices) to a server with single ethernet interface?

(updated 25th March 2013)
How to differentiate between port mirroring source? You can choose netflow or sflow for switches, but not all devices can handle as much as every packet - 1:1 packet rate. In my example, I have an SRX 210. Mirrored ports are trunk ports with native vlan configured. You may know it as hybrid port. Incoming packet with no vlan tag is assigned to particular vlan (vlan 10). Other packet must have particluar vlan tag (vlan 5, vlan 6) that is configured on switch port. I did not tested port mirror on Juniper EX switches but rather Avaya switches 5000 series. Juniper EX port mirror configuration is added.

Configuration of Juniper EX switch for this type of port

# show interfaces

 ge-0/0/0 {
    unit 0 {
        family ethernet-switching {
            port-mode trunk;
            vlan {
                members [ 5 6 ];
            }
            native-vlan-id 10;
        }
    }
} 

Port mirroring of TX and RX traffic on Juniper EX switch

# show ethernet-switching-options
analyzer myportmirror {
    loss-priority high;
    input {
        ingress {
            interface ge-0/0/20.0;
        }
        egress {
            interface ge-0/0/20.0;
        }
    }
    output {
        interface {
            ge-0/0/0.0;
        }
    }
}

Avaya ERS 5600 with firmware 6.2.x

port-mirroring mode Xrx monitor-port 1 mirror-port-X 2

vlan create 5-6,10 type port 1
vlan configcontrol flexible
vlan members 1 NONE
vlan members 5-6,10 2
vlan ports 2 pvid 10
vlan configcontrol strict

Scenario

We want to mirror traffic from two devices, for example switches, but have server with single interface for pcap.
1. Turn on port mirroring on two devices.
2. Connect SRX 210 port ge-0/0/1 to server and ports from that two devices  devices to port fe-0/0/4 and fe-0/0/5.
3. Configure 802.1ad (QinQ) on SRX so ge-0/0/1 trunk port is facing a backbone and fe-0/0/4, fe-0/0/5 is facing CE. Each port connected to switch has its own S-vlan. All tagged and untagged (C-vlan) packets will now have additional L2 header (S-vlan).

Diagram

SRX 210 Configuration

interfaces {

    ge-0/0/1 {
        description "port mirror";
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ port1 port2 ];
                }
            }
        }
    }

    fe-0/0/4 {
        description "Mirror 1";
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members port1;
                }
            }
        }
    }
    fe-0/0/5 {
        description "Mirror 2";
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members port2;
                }
            }
        }
    }

}

# show vlans
port1 {
    vlan-id 1004;
    dot1q-tunneling;
}
port2 {
    vlan-id 1005;
    dot1q-tunneling;
}

To conserve MAC address table on SRX 210, disable MAC address learning on port, or vlans

ethernet-switching-options {
    interfaces {
        ge-0/0/1.0 {
            no-mac-learning;
        }
        fe-0/0/4.0 {
            no-mac-learning;
        }
        fe-0/0/5.0 {
            no-mac-learning;
        }
    }
}

I don't see a possibility to create firewall filter that drops incoming packet on port configured with family ethernet-switching.

Observing results. PC with Wireshark is connected to port ge-0/0/1. Please notice text under pictures.

Packet from fe-0/0/4, tagged to vlan 1004, packet was received untagged on fe-0/0/4.

Packet from fe-0/0/4, double tagged with additional vlan 1004, and original vlan 5.

Packet from fe-0/0/4, double tagged with additional vlan 1004, and original vlan 6. Difference between this and previous picture is vlan 6.

Mirrored port fe-0/0/5

Packet from fe-0/0/5, double tagged with additional vlan 1005, and original vlan 5.

Packet from fe-0/0/4, double tagged with additional vlan 1004, and original vlan 5.

Packet from fe-0/0/5, double tagged with additional vlan 1004, and original vlan 6. Difference between this and previous picture is vlan 6.

Note: You can see packets tagged with S-vlan as configured. Each port has its own S-vlan.

Bear in mind that packets received on server could be in wrong order because of SRX internal processing.

Jozef Klacko

References

Application note: J Series and branch SRX series ethernet switching configuration guide (pdf)
Avaya support documentation webpage: http://support.avaya.com/downloads/

Interface-range - IOS Vs Junos

To edit multiple interfaces at once. In config mode - IOS "(config)#", Junos "#"

Purpose	IOS	Junos
go to multiple interfaces configuration (define range)	interface range fastethernet0/1 – 9	set interfaces interface-range myshutdown-ed member ge-0/0/0 set interfaces interface-range myshutdown-ed member ge-0/0/1 ... or set interfaces interface-range myshutdown-ed member-range ge-0/0/0 to ge-0/0/9 ... or set interfaces interface-range myshutdown-ed member ge-0/0/[0-9]
apply some (e.g . shutdown) command to interface range	shutdown	set interfaces interface-range myshutdown-ed disable

showing configuration
use show or show interfaces interface-range myshutdown-ed

interfaces {
    interface-range myshutdown-ed {
        member "ge-0/0/0";
        member "ge-0/0/1";
        ...
        disable;
    }

... or

interfaces {
    interface-range myshutdown-ed {
        member-range ge-0/0/0 to ge-0/0/9;
        disable;
    }

... or 

interfaces {
    interface-range myshutdown-ed {
        member "ge-0/0/[0-9]";
        disable;
    }

How the configuration is actually applied

show interfaces | display inheritance | except #

ge-0/0/0 {
    disable;
}
ge-0/0/1 {
    disable;
}
...
ge-0/0/9 {
    disable;
}

or you can see from what is configuration applied (e.g. from interface-range or even from apply-groups

show interfaces | display inheritance

ge-0/0/0 {
    ##
    ## 'disable' was expanded from interface-range 'shutdown-ed'
    ##
    disable;
}
...

Junos: Don't forget to commit.

This contribution is also listed in forums.juniper.net - IOS to Junos (I2J) Tips Contest
Interface range - IOS Vs Junos

Cisco Flex Links vs. Juniper Redundant Trunk Group (RTG)

Hi,

Flex Links are much same as RTG (Redundant Trunk Group). It is mostly used when you want to avoid using Spanning Tree and on access switches connecting to two aggregation switches.
See a picture on page http://www.juniper.net/techpubs/en_US/junos12.1/topics/concept/cfm-redundant-trunk-groups-understanding.html

Requirements:

• Juniper EX series switch with Junos 10.4 or later
• Ports configured with family ethernet-switching

RTG ports could be "simple ports" like ge-0/0/0 or it could be also aggregated ingerfaces (ae0) with family ethernet-switching Primary and backup need not to be of same type. By setting aggregated interfaces "set interfaces ae0 aggregated-ethernet-options minimum-links X" you could specify when is aggregated interface treated like not working.


Go to configuration mode
cisco >configure terminal "Switch(conf)#
Juniper >configure "user@switch#"

Purpose	IOS	Junos
disable spanning tree on port	Spanning tree is turned off automatically on flex links	user@host# set protocols rstp interfaces ge-0/0/5 disable user@host# set protocols rstp interfaces ge-0/0/6 disable
Set Flex Links / RTG	Switch(conf)# interface gigabitethernet0/1 Switch(conf-if)# switchport backup interface gigabitethernet0/2	user@host#  set ethernet-switching-options redundant-trunk-group group rtg1 interface ge-0/0/5.0 primary user@host# set ethernet-switching-options redundant-trunk-group group rtg1 interface ge-0/0/6.0
Configure preemption (optional)	"preemption modes: forced, bandwidth, off. For preempion to work, set forced or bandwidth." Switch(conf-if)# switchport backup interface gigabitethernet0/2 preemption mode [forced | bandwidth ] Switch(conf-if)# switchport backup interface gigabitethernet0/2 preemption delay 60	"Change the length of time (from the default 120 seconds) that a re-enabled primary link waits to take over for an active secondary link." user@host# set redundant-trunk-group group tg1 preempt-cutover-timer 60
Show Flex Link/RTG status	Switch(conf-if)# exit Switch(conf)# exit Switch# show interface switchport backup Switch# show interface switchport backup detail	user@host# run show redundant-trunk-group
Save configuration / apply and save configuration	Switch# copy running-config startup-config	user@host# commit

This contribution is also listed in forums.juniper.net - IOS to Junos (I2J) Tips Contest
Flex Links vs RTG

Juniper CLI - make your work faster

In this next lines you are going to read about some commands that can make your work with Junos easier
(Simple RegExp and Junos examples) 
This list is mainly for thought memorizing.

1. show interfaces in two lines list with MTU

show interfaces | match "mtu|interface:" |trim 19

 2. show interfaces without second line with logical interface with family
before:
[edit]
user@switch# run show interfaces terse                 
Interface               Admin Link Proto    Local                 Remote
ge-0/0/0                up    up  
ge-0/0/0.0              up    up   eth-switch
ge-0/0/1                up    up  
ge-0/0/1.0              up    up   eth-switch
ge-0/0/2                up    down
ge-0/0/2.0              up    down eth-switch
... output truncated

after:
[edit]
user@switch# run show interfaces terse |except "\."   
Interface               Admin Link Proto    Local                 Remote
ge-0/0/0                up    up 
ge-0/0/1                up    up 
ge-0/0/2                up    down
... output truncated


3. show ipv4 address on your switch or router, show only interfaces:
{master:2}
user@switch> show interfaces terse |match "inet "
ge-0/0/12.3212          up    up   inet     10.32.1.41/30  
ge-0/0/13.3200          up    up   inet     10.32.1.245/30 
ge-0/0/13.3202          up    up   inet     10.32.1.1/30   
ge-1/0/1.107            up    up   inet     xx.yyy.zz.1/30 
ge-1/0/13.3201          up    up   inet     10.32.1.249/30 
ge-1/0/13.3203          up    up   inet     10.32.1.5/30   
...

{master:2}
user@switch> show interfaces terse |match "inet " |trim 44
10.32.1.41/30  
10.32.1.245/30 
10.32.1.1/30   
xx.yyy.zz.1/30 
10.32.1.249/30 
10.32.1.5/30   
...

You could then save it to text file (add | save filename ad the end of command
show interfaces terse |match "inet " |trim 44 | save ipv4.txt

) and transfer your linux.Then do some things with it. For example calculate subnet address from ip address with ipcalc i.e.

ipcalc 10.32.1.41/30 | grep Network

...

So. I did a batch file
from file like this:
10.32.1.41/30  
10.32.1.245/30 


to file like this:

ipcalc 10.32.1.41/30 | grep Network >> networks.out
ipcalc 10.32.1.245/30 | grep Network >> networks.out

with this two commands:
sed -e 's/^/ipcalc /' ipv4.txt > networks.sed1
sed -e 's/$/| grep Network >> networks.out/' networks.sed1 > networks.sed2

chmod a+x networks.sed1
bash networks.sed1
hopefuly gives you

10.32.1.40/30

10.32.1.244/30


4. just another tidily  output for sflow interfaces (EX4200 Junos 10.0S10)
show interfaces terse |match "eth-switch|aenet" | match "ge|xe" | no-more
ge-0/0/0.0              up    up   eth-switch
ge-0/0/1.0              up    up   eth-switch
ge-0/0/2.0              up    up   eth-switch
ge-0/0/3.0              up    up   eth-switch
ge-0/0/4.0              up    up   eth-switch
ge-0/0/5.0              up    up   eth-switch
ge-0/0/6.0              up    up   eth-switch
ge-0/0/8.0              up    up   aenet    --> ae6.0
ge-0/0/10.0             up    up   eth-switch
... And you need to throw it edit it with spreadsheet or via bash or something else.
Remove text after space, then add string to beginning of line.
sed 's/ .*//;s/, .*//' sflow01.txt | sed s/^/"set protocols sflow interfaces "/

Why I like Junos CLI

Why I like Junos CLI

hierarchical configuration to make it easier to read configurationshttp://www.juniper.net/techpubs/software/junos/junos93/swconfig-cli/understanding-the-JUNOS-CLI-command-modes.html#id-10184964


load .. to load yours configuration (load merge <url-file,www,...>, load merge terminal relative,
http://juniper.tw/techpubs/en_US/junos11.1/topics/example/junos-software-config-file-loading.html#id-10728250
... or just use bunch of set just like any other OS
to see it like that ^ from configuration mode use show | display set

commiting configuration to apply it at right time and avoid late night drive to work (candidate configuration, rollback, commit confirmed, ...)
http://kb.juniper.net/InfoCenter/index?page=content&id=KB1572

annotations to comment your configuration
http://www.juniper.net/techpubs/en_US/junos11.1/topics/reference/command-summary/annotate.html

configuration groups, interface-ranges to inherit your configuration
http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-collections/swconfig-cli/id-11182486.html
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16354&actp=RSS

pipe to make configuration easier to read and do other stuff
http://www.juniper.net/techpubs/software/junos/junos94/swconfig-cli/pipe-filter-functions-in-JUNOS-CLI.html

junoscript, junos automation to make network management easier
http://www.juniper.net/in/en/community/junos/script-automation/ and http://www.juniper.net/us/en/community/junos/training-certification/day-one/automation-series/
I am using only basic scripts.

netconf to configure and manage it remotely, possibly through your own web management

http://www.juniper.net/support/products/netconf/

[j-nsp] JUNOS and 128.0.0.0 martian (JFYI), IANA

INANA allocated new addresses. These are martians for Juniper.
for example
https://apps.db.ripe.net/whois/lookup/ripe/inetnum/128.0.0.0-128.0.7.255.html
Take a look at RFC5735 which obsoletes RFC3330.


So if you have it as martians, you possibly cannot route to that remote subnets. Also transit ISPs should change this if they dont route them.

Workaround - Deleting Martian Addresses:
http://www.juniper.net/techpubs/en_US/junos10.2/topics/usage-guidelines/routing-configuring-martian-addresses.html#id-10349412

source: http://puck.nether.net/lists/juniper-nsp/0319.html


UPDATE!!!:

> https://apps.db.ripe.net/whois/lookup/ripe/inetnum/128.0.0.0-128.0.7.255.html


skip


> p.s. set routing-options martians 128.0.0.0/16 orlonger allow
> fixes it.



Couple updates about it.

martians are per table in Junos, so if you run internet in vrf (yes,
there are such people!) you need to use that command per routing instance.

RIPE NCC was awared about this issue and now reallocate blocks to those
who got addrs from 128.0.0.0/16

https://apps.db.ripe.net/whois/lookup/ripe/inetnum/128.0.0.0-128.0.7.255.html
IANA changed it. there was mail.ru now there is nothing