* Forrest Christian (List Account) <lists@packetflux.com> [2020-10-08 11:39]:
I've done a bit of googling and am either finding stuff that is largely Cisco-specific or which is generic - all of which I'm rather familiar with based on my past history. Is there anything I should worry about which is Juniper-specific?
start shell pfe network fpcX (fpc0 only for MX204) Danger Zone: There are many commands on the linecard that can mess stuff up. I even managed to crash stuff with some 'show ..' commands
Some things that come to mind: * Juniper has a default ARP policer that is _shared_ between all interfaces. This will bite you if you attach the box to a large L2 segment (*cough* DE-CIX *cough*). So you should either: - configure a non-shared policer: set firewall policer my-arp-policer if-exceeding .... set interface xe-0/0/0.0 family inet policer arp my-arp-policer - disable default ARP policer for the interface (this is not recommended and a hidden command) set interface xe-0/0/0.0 family inet policer disable-arp-policer * If you do Aggregated Ethernet (Port-Channel interfaces) you need to reserve resources for the ae interface by declaring: set chassis aggregated-devices ethernet device-count X "device-count 3" would give you ae0 to ae2 as possible interfaces * For all modern MX boxes you should normally set network-services mode to enhanced-ip (this requires a reboot of the box): set chassis network-services enhanced-ip * Groups (set groups some-group ... / set <some config hierarchy> apply-group some-group) are your friend Want to see stuff that gets applied to the config trough groups? show <some config hierarchy> | display inheritance (add "no-comments" for just the config without additional information) * It is kind of hard sometimes to figure out the right encapsulation / vlan-tagging config for an interface. For most flexible use of a port (this might differ depending on your configuration) on MX you can use: set interface xe-0/0/0 encapsulation flexible-ethernet-services set interface xe-0/0/0 flexible-vlan-tagging * Physical interface MTU for Juniper includes Ethernet overhead (standard MTU is 1514, 1518 with VLAN tag). So basically coming from Cisco its Cisco-MTU+14. You can configure a separate MTU per protocol family (set interface ... family inet mtu 1500). Handy for OSPF and co. * You need to enable every protocol family on an interface that you wish to accept. So for example if you want to do IPv4(OSPF) + IPv6(ISIS) + MPLS (with LDP) you need on the interface: set interface .. family inet ... set interface .. family inet6 ... set interface .. family iso set interface .. family mpls After that you need to enable the interface separately under the relevant protocols (set protocol mpls interface ..., set protocols ldp interface ...) Yes this is a bit much but I always try to remember that the first part enables the receiving of the protocol packets on the interface and the second part enables the processing of the received packets. * I love that Juniper shows you all routes for a destination, so if a destination is reachable via BGP, OSPF and direct route a 'show route <prefix>' will show that information for all protocols. The active route is marked with a star. Routes that are hidden (for example BGP routes that are rejected by import filters) can be shown by 'show route hidden'. * You can set standard BGP parameters for the whole box under 'routing-options': set routing-options router-id 1.2.3.4 set routing-options route-distinguisher-id 1.2.3.4 set routing-options autonomous-system 65500 * You need to enable ECMP by binding a filter to the forwarding-table: set policy-options policy-statement ecmp term 10-ecmp then load-balance per-packet set routing-options forwarding-table export ecmp (Yes, per-packet means per-flow ECMP, don't ask) * Sometimes if you change config and don't see a change in behaviour a 'commit full' will fix the problem (this shouldn't be necessary normally). * Some global BGP settings I would use: set protocols bgp precision-timers (Helps with very low BGP timers to avoid timeouts) set protocols bgp log-updown set protocols bgp always-compare-med (Depends on your routing policy) * Want to look under the hood? Go to the linecard: there. * Change things and want to apply it later? Save and load the patch later: <change stuff in config> # show | diff | tee patch.txt # rollback # exit <time goes by> # configure # load patch patch.txt # commit Sebastian -- GPG Key: 0x58A2D94A93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE) 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE. -- Terry Pratchett, The Fifth Elephant