Tag Archives: Logical Units

Notas estudo JNCIA-Junos parte 4

A tool primária de monitorização da plataforma é o CLI que inclui os comandos show e monitor. As secundarias são o J-Web , SNMP, hardware LEDS/LCDs

show system
alarms : This argument displays current system alarms;
boot-messages : This argument displays the messag es seen during the last system boot;
connections : This argument displays the status of local TCP and UDP connections;
statistics: This argument provides options for viewing various protocol statistics;
storage: This argument displays the status  of the file system storage space.

show chassis
alarms : This argument displays current chassis alarms;
environment : This argument displays component  and environmental status as well as the operational speeds of the cooling system;
hardware : This argument displays an inventory  of the installed hardware components along with the serial number of each component; and
routing-engine: This argument provides operational status and utilization details for the Routing Engine (RE).

Captura de tráfego

Capturar tráfego para ficheiro (hidden command)
monitor traffic write-file captura

Capturar em real-time especificando uma interface

[email protected]# run monitor traffic interface em5 no-resolve ?
Possible completions:
<[Enter]>            Execute this command
absolute-sequence    Display absolute TCP sequence numbers
brief                Display brief output
count                Number of packets to receive (0..1000000 packets)
detail               Display detailed output
extensive            Display extensive output
layer2-headers       Display link-level header on each dump line
matching             Expression for headers of receive packets to match
no-domain-names      Don’t display domain portion of hostnames
no-promiscuous       Don’t put interface into promiscuous mode
no-timestamp         Don’t print timestamp on each dump line
print-ascii          Display packets in ASCII when displaying in hexadecimal format
print-hex            Display packets in hexadecimal format
resolve-timeout      Period of time to wait for each name resolution (seconds)
size                 Amount of each packet to receive (bytes)
|                    Pipe through a command

[email protected]# run monitor traffic interface em5 no-resolve detail
Address resolution is OFF.
Listening on em5, capture size 1514 bytes

18:00:02.101361  In IP6 (hlim 1, next-header: UDP (17), length: 107) fe80::6101:1a73:bc24:3daf.546 > ff02::1:2.547: [udp sum ok] dhcp6 solicit(C cliaddr=8:2:189d:1:e:1:1:188a relayaddr=2145:d4be:d963:d2be:3:c:5300:5056)
18:00:02.983638 Out IP (tos 0xc0, ttl   1, id 12712, offset 0, flags [none], proto: OSPF (89), length: 64) 172.20.101.1 > 224.0.0.5: OSPFv2, Hello, length 44
Router-ID 9.9.9.9, Backbone Area, Authentication Type: none (0)
Options [External]
Hello Timer 10s, Dead Timer 40s, Mask 255.255.255.0, Priority 128
Designated Router 172.20.101.1
18:00:02.985453 Out IP (tos 0xc0, ttl   1, id 12713, offset 0, flags [none], proto: OSPF (89), length: 64) 172.20.110.1 > 224.0.0.5: OSPFv2, Hello, length 44
Router-ID 9.9.9.9, Backbone Area, Authentication Type: none (0)
Options [External]
Hello Timer 10s, Dead Timer 40s, Mask 255.255.255.0, Priority 128
Designated Router 172.20.110.1
^C
3 packets received by filter
0 packets dropped by kernel

Unified In-Service Software Upgrade (ISSU)

Permite upgrade sem disrupção no control plane, apenas e suportado com 2 Routing Engines. O Graceful Routing Engine Switchover (GRES) e NonStop Active Routing (NSR) devem estar activos. Nem todas as plataformas suportam o NSR, durante a mudança de versão não podem ser feitas operações online/offline ás PICs

Passos para efetuar um Unified ISSU:

1. activar o GRES e NSR e verificar a sincronização dos protocolos
2. efetuar no RE master request system software in-service-upgrade

Password Recovery

Durante o processo de reboot pressionar o Space

loader> boot -s (para boot em single user, similar em linux)

Ao iniciar o sistema vai perguntar pelo recovery script, apenas é necessário digitar recovery, sendo que o sistema vai iniciar permitindo fazer login sem password
Após alterada a password, sair com ‘exit‘ para fazer reboot automaticamente

Remover/Copiar Ficheiros

[email protected]# run file ?
Possible completions:
<[Enter]>            Execute this command
archive              Archives files from the system
checksum             Calculate file checksum
compare              Compare files
copy                 Copy files (local or remote)
delete               Delete files from the system
list                 List file information
rename               Rename files
show                 Show file contents
source-address       Local address to use in originating the connection
|                    Pipe through a command

[email protected]# run file show /config/?
Possible completions:
<[Enter]>            Execute this command
<filename>           Filename to show
/config/juniper.conf.1.gz  Size: 458, Last changed: May 24 19:58:53
/config/juniper.conf.2.gz  Size: 454, Last changed: May 23 21:17:12
/config/juniper.conf.3.gz  Size: 450, Last changed: May 23 15:03:46
/config/juniper.conf.gz  Size: 452, Last changed: May 24 20:00:08
/config/juniper.conf.md5  Size: 32, Last changed: May 22 23:45:51
/config/rescue.conf.gz  Size: 454, Last changed: May 24 19:57:27

Uso de Grupos

Definir um grupo
Nota: Este grupo irá surtir efeito apenas em interfaces em*

set groups CONFIG_IF_EM interfaces <em*> description “By group”
set groups CONFIG_IF_EM interfaces <em*> vlan-tagging
set groups CONFIG_IF_EM interfaces <em*> speed 10m
set groups CONFIG_IF_EM interfaces <em*> link-mode half-duplex
set groups CONFIG_IF_EM interfaces <em*> unit 0 vlan-id 1
set groups CONFIG_IF_EM interfaces <em*> unit 0 family inet
set groups CONFIG_IF_EM interfaces <em*> unit 0 family inet6

[email protected]# set interfaces em4 apply-groups CONFIG_IF_EM;

[email protected]# show interfaces em4 | display inheritance | except #
description “By group”;
vlan-tagging;
speed 10m;
link-mode half-duplex;
unit 0 {
vlan-id 1;
family inet;
family inet6;
}

[edit]

[email protected]# show interfaces em4 | display inheritance
##
## ‘By group’ was inherited from group ‘CONFIG_IF_EM’
##
description “By group”;
##
## ‘vlan-tagging’ was inherited from group ‘CONFIG_IF_EM’
##
vlan-tagging;
##
## ’10m’ was inherited from group ‘CONFIG_IF_EM’
##
speed 10m;
##
## ‘half-duplex’ was inherited from group ‘CONFIG_IF_EM’
##
link-mode half-duplex;
##
## ‘0’ was inherited from group ‘CONFIG_IF_EM’
##
unit 0 {
##
## ‘1’ was inherited from group ‘CONFIG_IF_EM’
##
vlan-id 1;
##
## ‘inet’ was inherited from group ‘CONFIG_IF_EM’
##
family inet;
##
## ‘inet6’ was inherited from group ‘CONFIG_IF_EM’
##
family inet6;
}

[edit]

[email protected]# show interfaces ae0
apply-groups CONFIG_IF_EM;
vlan-tagging;
aggregated-ether-options {
lacp {
active;
}
}

[edit]
[email protected]# show interfaces ae0 | display inheritance
vlan-tagging;
aggregated-ether-options {
lacp {
active;
}
}

[edit]

Routing

Routing preference values can range from 0 to 4,294,967,295.

* – indica a rota activa

holddown – estão no estado pendente antes de o sistema as declarar como inativas
hidden – o sistema não pode usar por questões de invalid next-hop e/ou route policy

show route forwarding-table

Algumas das rotas são permanentes devido a sua natureza como e o caso da default (Type perm), esta entrada e usada para o router descartar tráfego quando não existe roteamento para determinado destino, após descarte envia um ICMP unreachable ao host de origem

Caso exista um default route na tabela, o router utiliza-a em vez da Type perm

Route types:

cloned (clon) – (TCP or multicast only) Cloned route.
destination (dest) – Remote addresses directly reachable through an interface.
destination down (iddn) – Destination route for which the interface is unreachable.
interface cloned (ifcl) – Cloned route for which the interface is unreachable.
route down (ifdn) – Interface route for which the interface is unreachable.
ignore (ignr) – Ignore this route.
interface (intf) – Installed as a result of configuring an interface.
permanent (perm) – Routes installed by the kernel when the routing table is initialized.
user – Routes installed by the routing protocol process or as a result of the configuration.

Next-hop Types:

broadcast (bcst) – Broadcast.
deny – Deny.
hold – Next hop is waiting to be resolved into a unicast or multicast type.
indexed (idxd) – Indexed next hop.
indirect (indr) – Indirect next hop.
local (locl) – Local address on an interface.
routed multicast (mcrt) – Regular multicast next hop
multicast (mcst) – Wire multicast next hop (limited to the LAN).
multicast discard (mdsc) – Multicast discard.
multicast group (mgrp)  – Multicast group member.
receive (recv) – Receive.
reject (rjct) – Discard. An ICMP unreachable message was sent.
resolve (rslv) – Resolving the next hop.
unicast (ucst) – Unicast.
unilist (ulst) – List of unicast next hops. A packet sent to this next hop goes to any next hop in the list.

By default o JunOS cria a master instance e outras private instances. Estas private instances são para uso interno (comunicações entre componentes de hardware) do JunOS.

[email protected]> show route instance
Instance             Type
Primary RIB                                     Active/holddown/hidden
__juniper_private1__ forwarding
__juniper_private1__.inet.0                     0/0/1
__juniper_private1__.inet6.0                    1/0/0

__juniper_private2__ forwarding
__juniper_private2__.inet.0                     0/0/1

__master.anon__      forwarding

master               forwarding
inet.0                                          8/0/0
inet6.0                                         1/0/0

Instances Types

forwarding: Used to implement filter-based forwarding for common Access Layer applications;
l2vpn: Used in Layer 2 VPN implementations;
no-forwarding :  Used to separate large networks into smaller administrative entities;
virtual-router: Used for non-VPN-related applications such as system virtualization; “VRF-lite”
vpls:  Used for point-to-multipoint LAN implementations between a set of sites in a VPN;
vrf :  Used in Layer 3 VPN implementations.

[email protected]# set routing-instances <instance-name> instance-type <instance-type>

[email protected]>show route table new-instance.inet.0
[email protected]>show interfaces terse routing-instance new-instance
[email protected]>traceroute 2.2.2.2 routing-instance new-instance

Static Routing

O next-hop pode ser a opção de bit bucket, as opcoes de discard/reject permite descartar o trafego:

  • discard faz drop silenciosamente (nao envia ICMP)
  • reject envia ICMP unreachable

Config static routing

set routing-options
static{
route 0.0.0.0/0 next-hop 172.30.25.1;
route 172.28.102.0/24 {
next-hop 10.210.11.190;
no-readdvertise;
}
}

O nexr-hop deve estar diretamente ligado, porque by default o JunOS não faz lookups recursivos. Para possibilitar a recursividade usar o comando resolve

set routing-options static route 0.0.0.0/0 next-hop 172.30.25.1;
set routing-options static route 172.28.102.0/24 next-hop 10.210.11.190 resolve

Qualified Next hops

Permite indicar a preferência de uma rota (floating route)

qualified-next-hop x.x.x.x {
preference 7;
}

Referências:

Notas estudo JNCIA-Junos parte 1

Notas estudo JNCIA-Junos parte 2

Notas estudo JNCIA-Junos parte 3

Notas estudo JNCIA-Junos parte 3

Interface Overview

fxp0 e me0 para management

fxp1 e em0 para a internal (interligação entre o Control e Forwarding Plane)

Interface Naming

es: Encryption interface;
gr: Generic route encapsulation tunnel interface;
ip: IP-over-IP encapsulat ion tunnel interface;
ls: Link services interface;
ml: Multilink interface;
mo: Passive monitoring interface;
mt: Multicast tunnel interface;
sp: Adaptive services interface;
vt: Virtual loopback tunnel interface.
lo0 : Loopback interface;
ae: Aggregated Ethernet interface;
as : Aggregated SONET interface;
vlan : VLAN interface

Algumas das interfaces internas criadas (não configuráveis)pelo JunOS:
• gre
• mtun
• ipip
• tap

FPC – Flexible PIC Concentrator
Line card (FPC) slot number
Interface card (PIC) slot number
Nota: A numberacao dos slots/portas comeca em 0
ge-0/2/3 = porta 3 na PIC slot 2 na PFC slot 0

Logical Units

Consideradas como subinterfaces, podem ter mais do que uma family pexemplo inet e inet6

Configurar Autenticação

Suporta Radius e Tacacs+

Definir uma class com privilégios

Existem 4 class por defeito operator,read-only,super-user e unauthorized
Um user só pode ser atribuído a uma class

set system login class juniper permissions reset permissions view permissions view-configuration
set system login user walter class juniper

Nota: A permissão de reset permite reiniciar processos, mas não fazer reboot pexemplo

[email protected]> show configuration
## Last commit: 2014-05-25 17:11:18 WEST by root
version /* ACCESS-DENIED */;
/* nao mudem o NTP */
system { /* ACCESS-DENIED */ };
/* n mudem interface */
interfaces { /* ACCESS-DENIED */ };
protocols { /* ACCESS-DENIED */ };

Definição do Radius Server

[email protected]#  set system radius-server 10.10.10.10  secret  Juniper
[edit]
[email protected]#  set system authentication-order radius tacplus+
[edit]
[email protected]#  commit

Pelo menos um dos métodos de authentication-order deve responder (alive), caso contrário é feita autenticação local

R1 (ttyp0)

login: nancy
Password:
Local password:

Logging

By default o ficheiro de logging primário e /var/messages

O syslog pode ser definido através dos comandos:

edit system syslog
edit routing-options options syslog

set system syslog user * any emergency
set system syslog file messages any any
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands any
set system syslog file config-changes change-log info
set system syslog host 10.1.1.1 any notice
set system syslog host 10.1.1.1 authorization info

Interpretar as mensagens do syslog

Timestamp, Host , Process ou PID , message code, message text

May 26 14:27:17  R1 mgd[1366]: UI_COMMIT_PROGRESS: Commit operation in progress:  notifying eventd(80)
commit complete

Para incluir a Severity é necessário configurar o comando explicit-priority
set system syslog file messages explicit-priority

May 26 14:38:13  R1 mgd[1366]: %INTERACT-6-UI_COMMIT_PROGRESS: Commit operation in progress: notifying daemons of new configuration

É possível obter ajuda na interpretação de uma mensagem de log através da própria CLI

[email protected]# help syslog UI_COMMIT_PROGRESS
Name:          UI_COMMIT_PROGRESS
Message:       Commit operation in progress:
Help:          mgd recorded step in commit operation
Description:   As it performed a commit operation, the management process (mgd)
recorded its execution of the indicated step.
Type:          Event: This message reports an event, not an error
Severity:      info

Traceoptions

*Equivalente ao Debug em Cisco*

O JunOS permite enviar o tracing para ficheiro/syslog

Para redefinir um syslog server diferente usar:

set system tracing destination-override syslog host 10.1.1.2

Exemplo Tracing Hello OSPF

O size pode ser representado por K,M,G indicando (KB, MB e GB)
Cao o trace exceda o size, o ficheiro é divido no numero de ficheiros indicados começando em trace-file.0 trace-file.1 …

set protocols ospf traceoptions file ospf-trace
set protocols ospf traceoptions file size 128m
set protocols ospf traceoptions file files 10
set protocols ospf traceoptions file world-readable
set protocols ospf traceoptions flag hello detail
set protocols ospf traceoptions flag error detail
set protocols ospf traceoptions flag event detail

[email protected]# run file show /var/log/ospf-trace
May 26 14:52:47 trace_on: Tracing to “/var/log/ospf-trace” started
May 26 14:52:47.821578 Interface em5.101 area 0.0.0.0 event NeighborChange
May 26 14:52:47.835103 IFL em5.32767 iflchange 0x0
May 26 14:52:47.836167 IFL em5.110 iflchange 0x0
May 26 14:52:47.836334 IFL em5.102 iflchange 0x0
May 26 14:52:47.836498 IFL em5.101 iflchange 0x0
May 26 14:52:47.836643 IFL em5.0 iflchange 0x0
May 26 14:52:47.836793 IFL lo0.16385 iflchange 0x0
May 26 14:52:47.836891 IFL lo0.16384 iflchange 0x0
May 26 14:52:47.837115 IFL lo0.0 iflchange 0x0
*
*(omitido)
*
May 26 14:52:47.867410 OSPF updated PPM interface IFL 84, addr 172.20.110.1, area 0.0.0.0, ID 0.0.0.0, rtbl idx 0
May 26 14:52:47.867614 OSPF cannot stop xmit from 172.20.101.1 to 224.0.0.5 (IFL 82, area 0.0.0.0, ID 0.0.0.0, rtbl idx 0)
May 26 14:52:47.867816 OSPF cannot stop xmit from 172.20.110.1 to 224.0.0.5 (IFL 84, area 0.0.0.0, ID 0.0.0.0, rtbl idx 0)
May 26 14:52:47.868182 OSPF cannot stop xmit from 172.20.101.1 to 224.0.0.5 (IFL 82, area 0.0.0.0, ID 0.0.0.0, rtbl idx 0)
May 26 14:52:47.873156 OSPF cannot stop xmit from 172.20.110.1 to 224.0.0.5 (IFL 84, area 0.0.0.0, ID 0.0.0.0, rtbl idx 0)

Operadores AND e OR

Operador AND
[email protected]# run show log messages | find “May 26” | match “error”

Operador OR
[email protected]# run show log messages | match “May 26” | match “error|kernel”

Monitorizar as mensagens de log
[email protected]>  monitor start messages | match fail

Parar de receber mensagens
[email protected]>  monitor stop

NTP

set system ntp server 10.10.10.10
set system ntp boot-server 10.10.10.10

[email protected]# run show ntp associations
remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*10.10.10.10         .INIT.          16 –  395 1024    0    0.000    0.000 4000.00

O * significa que é o host selecionado para sincronização
Archiving

Realizar backups via FTP/SCTP da configuração após commit, o uso de vários destinos permite  que caso o site primário falhe seja usado o 2 site e assim em diante

set system archival configuration transfer-on-commit
set system archival configuration archive-sites “ftp://[email protected]:/archive” password #FAZER!SEMPRE_BACKUP#
set system archival configuration archive-sites “sctp://[email protected]:/archive” password #FAZER!SEMPRE_BACKUP#

[email protected]# commit
[email protected]# run show log messages | match ftp
May 26 16:11:40  R1 fetch: %DAEMON-3: fetch: ftp://[email protected]:*: No route to host

As copias dos ficheiros são guardadas em /var/transfer/config

[email protected]# run file list /var/transfer/config/ detail

/var/transfer/config/:
total 28
-rw-r—–  1 root  wheel       1101 May 26 16:10 R1_juniper.conf.gz_20140526_151053
-rw-r—–  1 root  wheel       1101 May 26 16:11 R1_juniper.conf.gz_20140526_151127
-rw-r—–  1 root  wheel       1101 May 26 16:12 R1_juniper.conf.gz_20140526_151206
-rw-r—–  1 root  wheel       1101 May 26 16:12 R1_juniper.conf.gz_20140526_151254
-rw-r—–  1 root  wheel       1187 May 26 16:23 R1_juniper.conf.gz_20140526_152319

Para realizar backups regulares da config usar:

Nota: A cada 24 Horas (1440 minutos)

set system archival configuration transfer-interval 1440

SNMP

set snmp location LISDC-Rack122
set snmp contact “ip@cocheno.com”
set snmp community JUNIPER
set snmp trap-options source-address lo0
set snmp trap-group group-SNMP categories link
set snmp trap-group group-SNMP categories routing
set snmp trap-group group-SNMP targets 10.10.10.10
set snmp trap-group group-SNMP targets 10.10.10.11
set snmp trap-group group-SNMP version v2
set snmp community JUNIPER clients 192.168.20.0/24

Efetuar uma snmp walk (permite fazer decimal e ascii)

[email protected]> show snmp mib walk jnxOperatingDescr
jnxOperatingDescr.1.1.0.0 = midplane
jnxOperatingDescr.2.1.0.0 = PEM 0
jnxOperatingDescr.4.1.0.0 = SRX240 PowerSupply fan 1

Referências:

Notas estudo JNCIA-Junos parte 1

Notas estudo JNCIA-Junos parte 2