SWITCHING

inter-vlan
- verify network settings for each user: ip, mac, gw
- verify gw reachability
- verify MAC table: 
       show ethernet-switching table (control plane)
       show route forwarding-table family ethernet-switching (forwarding plane - PFE) both should be in sync
- verify STP: show spanning-tree interface
- verify vlan-interface association: show vlans X [detail]
- verify interface config: show configuration interface XXX
- where is gw: show route table inet.0
- fw session: show security flow session protocol icmp source-prefix IP

Route "rejected" for irb => check vlan config has l3-interface configured

LAG not coming up but config looks ok -> show configuration chassis aggregated-devices => device-count!

EVPN

east-west

- verify network settings for each user: ip, mac, gw
- verify gw reachability

- evpn-vxlan:
-- underlay: IGP (ospf-isis) or eBGP (loopbacks exchanged, peers up, etc)
   ---show bgp summary / show route receive/advertised-protocol bgp IP table inet.0
   ---show evpn databases

-- overlay: iBGP up, EVPN peers up
   --- show evpn instance extensive
   --- show evpn database
   --- show route table inet.0 protocol evpn

-- VXLAN: VTEPs established, up, EVPN routes (typ2/5 exchanged?
   --- show interfaces vtep
     type source: for the locally attached networks
     type Remote: for remote networks
   --- show vlan (mapping vlan-vni)
   --- show vlan X details -> l3-irbs, mapped interfaces, etc

-- communication between same vlan/vni? vlan-vni mapping identical in all devices?, IRB using commong VGA, IRB bound to VLANs
   --- show ethernet-switching vxlan-tunnel-end-point source
   --- show ethernet-switching vxlan-tunnel-end-point remote
   --- show interfaces terse irb
   --- show configuration interfaces irb
   --- show configuration vlans
   --- show ethernet-switching table

show bgp summary
   - bgp.evpn.0 receives all EVPN routes (LE and SP)
   - default-switch.evpn.0 - typ1,2,3 copied here (only LE, no in SP)
   - default_evpn.evpn.0 - typ4 copied here (only LE, no in SP)

show route summary
   :vxlan.inet.0 - holds the routes to remote VTEPs and uses inet.0 for route selection (because it has : in the name)

OSPF

ospf operational
   show ospf neighbor
   show ospf interface (loopbacks are in??)
   show interfaces x | match mtu
   show ospf overview
   show ospf statistics
   set protocols ospf traceoptions file X size 5m files 3 flag all
   show log X
   show configuration interface Y
   monitor traffic interface Y detail matching "proto ospf"
   request system decrypt password "xxxx" (onlu for $8$ or $9$ hashes)

adj state full
   show ospf database (* = entries generated by the local router)
   show route protocol ospf table inet.0

spf stable: duplicate RID?, flapping links?

routes in RIB: lsdb, asbr over non-bb area, 0/0 in nssa and stubs, prefix export limit, import/export policies
   - show route table inet.0
   - abr: nssa no-summaries -> routes in that area dont see any summary LSA for other areas => you may need to advertise a default (set protocols ospf area X nssa default-lsa default-metric 1)
   - show configuration protocols ospf

ISIS

(initializing -> mtu issue (at least 1492)

isis operational
   show isis adjacency
   show isis interface (loopbacks are in??)
   show interfaces x | match mtu
   show isis overview (if attached bit evaluation disabled -> default route (sent by L1L2) is not installed
   show isis statistics
   set protocols isis traceoptions file X size 5m files 3 flag error detail flag hello detail
   show log X
   show configuration interface Y
   monitor traffic interface Y detail matching "proto isis"
   request system decrypt password "xxxx" (onlu for $8$ or $9$ hashes)

adj state full
   show isis database (* = entries generated by the local router)
   show isis route
   show route protocol isis table inet.0

spf stable: duplicate NET?, flapping links?

routes in RIB: lsdb, levels?, 0/0 in l1, prefix export limit, import/export policies
   show route table inet.0
   abr: nssa no-summaries -> routes in that area dont see any summary LSA for other areas => you may need to advertise a default (set protocols ospf area X nssa default-lsa default-metric 1)
   show configuration protocols ospf
   show isis hostname
   show route table iso.0 <-- NET addresses!

BGP

iBGP
-ibgp established: security policies, fw rules, IGP routing, local address, auth, logs
set protocols bgp group int-group traceoptions file X size 5m files 3 flap open detail
show system connections

-ibgp stable: IGP stable? MTU, TCP MSS

-ibgp adverts: export policy, inactive routes, no-advertise community, bgp family

-ibgp receives: BGP next-hop, recursive routing

-routes in RIB: import policy

ROUTING LOOPS

take several traceroute
check where route redistribution takes place
set cli timestamp
show bgp summary (several times to see flapping)
show route received-protocol bgp PEER_IP table x.0 (several times to see flapping)
show route NET/MASK (several times)
show route hidden detail table x.0

MPLS L3VPN

control plane:
- pe-ce routing protocols
   -- show route table inet.0 (for P and PE Lo)
   -- show isis database detail

- ldp/rsvp
   -- show route table inet.3 (table with ingress LSPs from this router
   -- show route table mpls.0 (next LSR in each LSP). Loop-up LSPs and VPN labels
   -- show ldp session/neighbor
   -- show ldp database
*RT mismatch -> drop (no stored neither hiddne => go to the other peer and show route advertisedd-protocol bgp PE-IP)

- bgp
   -- show bgp summary
   -- show route table X.inet.0 (l3vpn table)
   -- show route advertising-protocol bgp PE-IP
   -- show route receive-protocol bgp PE-IP (is bgp.l3vpn.0 table???)
   -- show route receive-protocol bgp PE-IP detail table bgp.l3vpn.0
   -- *vrf-table-lable -> a LSI logical interface label is created and mapped to the VRF routing table.

data plane:
   -- ping mpls
   -- traceroute mpls ldp PE-Lo

Stateful FW

srx -> session-based
- show security flow status -> flow/packet-based
- show security flow session
- set security flow traceoptions file X size 2m files 3 flag basic-datapath packet-filter f1 protocol icmp destination-prefix FW-IP/32
- show interface X -> check security zone (Null drops all packets)
- show interface x detail | find Flow
- show security zones NAME
- show security screen statistics zone untrust | except 0
- show log messages | match RT_SCREEN or RT_IDS
- show security screen ids-option untrust-screen
- show configuration security screen
- set security zones security-zone X host-inbound-traffic system-override traceroute ping …

CHASSIS CLUSTER

OOB

fxp0: oob mgmt interface
fxp1/em0 - cp interface
fab - dp interace
swfab - switching dp interface
reth - redundant interface

show chassis cluster status
show chassis cluster interfaces
show interfaces terse | grep fxp
show configuration | display set | match apply-groups
  set apply-groups ${node}
show system users

fabric link

show chassis cluster interfaces
show chassis cluster status
show chassis cluster statistics (sent/received??)
show interfaces terse | grep fab

data-plane

show chassis cluster status
show chassis cluster interfaces
show interfaces terse | grep reth
show configuration chassis cluster

*routing table is not running in secondary node

CoS

CoS-Based IPSec VPN

show security ike security-associations
show security ipsec security-associations
show security ipsec inactive-tunnels
show configuration security ipsec vpn X
show class-of-service forwarding-class

CoS implementation

show interfaces X detail | find Egress -> check counters in queues

show configuration firewall family inet -> check filtes
show interfaces filters | match X
show class-of-service interface Y
show class-of-service rewrite-rule type dscp
                      scheduler-map X | match "Scheduler|Transmit"
                      classifier type dscp name X