Juniper: vpls, l2 point-multipoint

Задача: есть 2 маршрутизатора Cisco и один маршрутизатор Juniper MX-80, собрать на втором уровне трафик на джунипере, третий уровень клиент себе настроит так как захочет.

Cisco маршрутизаторы rc0 и rc1. Juniper маршрутизатор rj0.

Конфигурация rc0 (xx.xx.171.185), Gi0/1.2222:

rc0#sh run int Gi0/1.2222
interface GigabitEthernet0/1.2222
 description junos vpls test
 encapsulation dot1Q 2222
 xconnect xx.xx.120.69 2222 encapsulation mpls
end

Конфигурация rc1 (xx.xx.171.187), Gi0/1.2222:

rc1#sh run int Gi0/1.2222
interface GigabitEthernet0/1.2222
 description junos vpls test
 encapsulation dot1Q 2222
 xconnect xx.xx.120.69 2222 encapsulation mpls
end

Конфигурация rj0 (xx.xx.120.69):

rj0> show configuration interfaces ge-1/1/0.2222
set interfaces ge-1/1/0 unit 2222 description "vpls test"
set interfaces ge-1/1/0 unit 2222 encapsulation vlan-vpls
set interfaces ge-1/1/0 unit 2222 vlan-id 2222
set interfaces ge-1/1/0 unit 2222 family vpls
rj0> show configuration routing-instances vpls_test | display set
set routing-instances vpls_test instance-type vpls
set routing-instances vpls_test vlan-id all
set routing-instances vpls_test interface ge-1/1/0.2222
set routing-instances vpls_test protocols vpls no-tunnel-services
set routing-instances vpls_test protocols vpls mtu 2000
set routing-instances vpls_test protocols vpls mesh-group l2ccc vpls-id 2222
set routing-instances vpls_test protocols vpls mesh-group l2ccc local-switching
set routing-instances vpls_test protocols vpls mesh-group l2ccc neighbor xx.xx.171.187 encapsulation-type ethernet-vlan
set routing-instances vpls_test protocols vpls mesh-group l2ccc neighbor xx.xx.171.185 encapsulation-type ethernet-vlan

Juniper: аналог cisco global в vrf.

Задача: вывести маршрут из vrf в глобальную таблицу (например для живущих внутри vrf sip-абонентов). Например, из vrf необходимо получить доступ к внешним ресурсам 2xx.xx.xx1.0/28, 2xx.xx.xx0.2/32 и 2xx.xx.xx0.27/32.

Описываем routing-instances:

routing-instances {
    ANOTHER_CLIENT {
        description "ANOTHER CLIENT";
        instance-type vrf;
        interface ge-1/0/1.210;
        interface ge-1/0/7.207;
        interface ge-1/1/0.209;
        route-distinguisher xxxxx:10008;
        vrf-target target:xxxxx:10008;
        vrf-table-label;
        routing-options {
            static {
                route 0.0.0.0/0 next-hop 10.255.xxx.6;
                route 2xx.xx.xx1.0/28 next-table inet.0;
                route 2xx.xx.xx0.2/32 next-table inet.0;
                route 2xx.xx.xx0.27/32 next-table inet.0;
            }
            auto-export {
                family inet {
                    unicast {
                        rib-group Export_VRF_VoiceDevice_to_inet.0;
                    }
                }
            }
        }
    }
}

На маршрут 0.0.0.0/0 не обращаем внимания, это из другой оперы, не относящейся к теме данной статьи.
После этого нарисуем policy-options который затем будет использоваться в rib-groups-е:

policy-options {
    policy-statement VoiceDevice_in_VRF {
        term vd {
            from {
                route-filter 10.255.xxx.4/30 exact;
            }
            then accept;
        }
        then reject;
    }
}

И завершающий штрих, рисуем rib-groups:

routing-options {
    rib-groups {
        Export_VRF_VoiceDevice_to_inet.0 {
            import-rib inet.0;
            import-policy VoiceDevice_in_VRF;
        }
    }
    router-id 9x.xxx.xxx.x9;
    autonomous-system xxxxx;
}

Обновить все установленные модули Perl с CPAN

Обновить с CPAN-а все установленные в системе perl-модули можно одной командой:

sudo perl -MCPAN -e 'CPAN::Shell->notest(install => CPAN::Shell->r)'

при этом останется лишь ответить на ряд вопросов и дождаться окончания процесса ;)

JunOS: архивирование конфигурации при внесении изменений

set system archival configuration transfer-on-commit
set system archival configuration archive-sites user@backup.host:/backup/juniper/

Cisco vs Juniper - команды

Сравнительная таблица команд Cisco IOS и Juniper OS.

Cisco Command	Juniper Command	Co-Ordinating Definition
show run	sh configuration	Show running configuration
sh ver	sh ver	Show version
show ip interface brief	show interface terse	displays the status of interfaces configured for IP
show interface [intfc]	show interfaces [intfc] detail	displays the interface configuration, status and statistics.
show controller intfc	show interfaces intfc extensive	displays information about a physical port device
show interface | incl (proto|Desc)	show interfaces description	displays the interface configuration, status and statistics
show ip route	show route	displays summary information about entries in the routing table
show ip bgp summary	show bgp summary	displays the status of all Border Gateway Protocol (BGP) connections
show ip bgp net mask	show route protocol bgp prefix	will show you how that route is being advertised, look for the first line
show ip bgp net mask longer-prefixes	show route range prefix	will show you how that route is being advertised, look for the first line
show ip bgp regexp AS-regexp	show route aspath-regexp "AS-regexp"	displays routes matching the autonomous system (AS) path regular expression
show ip bgp neighbors neigh received-routes	show route receive-protocol bgp neigh show route source-gateway neigh protocol bgp	Shows whether a neighbor supports the route refresh capability
show ip bgp neighbor neigh advertised-routes	show route advertising-protocol bgp neigh	Shows whether a neighbor supports the route refresh capabilty
show clns neighbors	show isis adjacency	displays both ES and IS neighbors
show clns interface	show isis interface	shows specific information about each interface
show ip route isis	show isis routes	displays the current state of the the routing table
show isis topology	show isis spf	displays a list of all connected routers in all areas
show ip ospf interface	show ospf neighbor	shows neighbor ID, Priority, IP, & State if the neighbor router, dead time.
show ip ospf interface	show ospf interface	shows neighbor id, pri, state, dead time, address and interface
show ip route ospf	show ospf route	display the current state of the routing table
show ip ospf database	show ospf database	display list of information related to the OSPF database for a specific communication server
show version	show version, show system uptime	display the system hardware config., software version, and name and source of configuration files and boot images
show diags	show chasis hardware	displays power-on diagnostics status
show processes cpu	show system process	displays utilization statistics
show tech-support	request support info	displays the current software image, configuration, controllers, counters, stacks, interfaces, memory and buffers
show logging	show log messages	display the state of logging to the syslog
show route-map name	show policy name	displayall route-maps configured or only the one specified
show ip prefix-list name	show policy name	display information about a prefix list or prefix list entries
show ip community-list list	configure,  show policy-options community name	display routes that are permitted by BGP community list
show environment all	show chassis  environment	displays temperature and voltage information on the console
ping dest	ping dest rapid (for cisco like output) ping dest (for unix like output)	to check to see if a destination is alive
ping (setting source int)	ping dest bypass-routing	to check to see if a destination is alive
terminal monitor	monitor start messages	Change console terminal settings
terminal no monitor	monitor stop	Change console terminal settings
terminal length 0	set cli screen-length 0	sets the length for displaying command output

Слямзил туточки networking.ringofsaturn.com.

JunOS: BGP маршруты - advertised и received

Как это делается в Cisco IOS:

IOS# show ip bgp neighbor x.x.x.x advertised-routes
IOS# show ip bgp neighbor x.x.x.x received-routes

Как это делается в JunOS:

JUNOS> show route receive-protocol bgp x.x.x.x
JUNOS> show route advertising-protocol bgp x.x.x.x

netfilter ip conntrack: переполнение

Что делать если вдруг в syslog вывалится такое сообщение об ошибке?

ip_conntrack: table full, dropping packet.

Для начала не помешает проверить величину максимального количества записей которое может отследить ip conntrack:

$ sysctl net.ipv4.netfilter.ip_conntrack_max

если значение мало или по каким либо причинам вам кажется, что оно мало, то имеет смысл его увеличить:

$ sudo sysctl -w net.ipv4.netfilter.ip_conntrack_max=65535

Чтобы при следующей перезагрузке это значение было восстановлено не забудьте добавить его в /etc/sysctl.conf.