{"id":2009,"date":"2025-06-30T11:06:17","date_gmt":"2025-06-30T10:06:17","guid":{"rendered":"https:\/\/blog.thomarite.uk\/?p=2009"},"modified":"2025-06-30T11:06:17","modified_gmt":"2025-06-30T10:06:17","slug":"jncis-sp","status":"publish","type":"post","link":"https:\/\/blog.thomarite.uk\/index.php\/2025\/06\/30\/jncis-sp\/","title":{"rendered":"JNCIS-SP"},"content":{"rendered":"\n

JNCIS-SP
Junos Intermediate Routing On-Demand – DONE
Junos Service Provider Switching – DONE
Junos MPLS Fundamentals – DONE<\/p>\n\n\n\n

https:\/\/jlabs.juniper.net\/vlabs<\/a><\/p>\n\n\n\n

=========================================
Junos Intermediate Routing On-Demand
=========================================<\/p>\n\n\n\n

CBT Junos Tunnels<\/p>\n\n\n\n

\n\n\n\n

gr-0\/0\/0 GRE
ip-0\/0\/0 IPoverIP<\/p>\n\n\n\n

set chasis fpc 1 pic 2 tunnel-services [bandwidth X]–> enable tunnels in x-1\/2\/x<\/p>\n\n\n\n

GRE header: 24bytes = 20byes IP header + 4bytes (reserv, version, protocol type) => increase MTU !!! 0x800 = ipv4 \/ 8x86dd iv6<\/p>\n\n\n\n

frames over GRE: set chassis network-services enhanced-ip
set intefaces gr-0\/0\/0 unit 0 family bridge interface-mode trunk vlan-id-list 100 core-facing<\/p>\n\n\n\n

              set routing-instances virtsw instance-type virtual-switch\n                                           interface ge-0\/0\/2.0\n                                                     gr-0\/0\/0.0\n                                            bridge-domain C100 vlan-id 100<\/code><\/pre>\n\n\n\n
CBT Chassis HA<\/h2>\n\n\n\n
vrrp: MAC 0000.5E00.01xx (MC.18) group-id (8bit) identical, priority (8bit 1-254, def=100) or hights IP,
v3: ipv6 and <1s<\/p>\n\n\n\n
(inside interface config)
set vrrp-group 1 virtual-address VIP [priority x]<\/p>\n\n\n\n
GR: graceful restart
set routing-options graceful-restart (show ospf overview)<\/p>\n\n\n\n
GRES: Graceful Routing Engine Switchover, BUT Control Planel needs to reconverge !!!
set chassis redundancy graceful-switchover
request chassis routing-engine master switch check<\/p>\n\n\n\n
NSR: Non-stop active routing. NSR helps GRES to get CP syncronize between REs. Incompatible with GR !!!
set routing-options nonstop-routing
set systen commit syschronize
show task replication<\/p>\n\n\n\n
ISSU: in-service sw upgrade
Needs GRES+NSR
request system software in-service-upgrade \/var\/tmp\/file.tgz reboot<\/p>\n\n\n\n
virtual-chassis<\/p>\n\n\n\n
CBT IPv6<\/h2>\n\n\n\n
multicast FF00::\/8
link-local FE80::\/10 (no routable), NDP (like ARP) neighbor discovery prot (Neigh Solicitation, Neigh Adver)
unique-local FC00 or FEC8 (no internet routable – like private IP)
global unicst: 2000::\/3<\/p>\n\n\n\n
dhcp:
slaac (staless): EUI-64: use MAC 48b + FFFE (mac 24b (flip 7th) FFFE mac 24b) -> 64 bits + 64 bits from Route Solication
set interface ge-0\/0\/2 unit 0 family inet6 address 2012:db8::\/64 eui-64<\/p>\n\n\n\n
dhcpv6 (stateful)<\/p>\n\n\n\n
ospf3: needs a router-id that is ipv4!!!
set routing-options router-id ipv4<\/p>\n\n\n\n
CBT LACP<\/h2>\n\n\n\n
802.3ad
max 8 links per lacp
set chassis aggregated-devices ethernet device-count X<\/p>\n\n\n\n
set interfaces ge-0\/0\/0 ether-options 802.3ad ae0
1
set interfacce ae0 aggregated-ether-options lacp active|passive periodic fast|slow (30s) (def is fast=1sec)
unit 0 family etherent-switching port-mode trunk (EX)
interface-mode (QFX(
bridge interface-mode trunk vlan-id-list 300 (MX)<\/p>\n\n\n\n
CBT ISIS<\/h2>\n\n\n\n
level0 – ES-IS
level1 – IS-IS intra-area
level2 – IS-IS inter-area<\/p>\n\n\n\n
 intra-area AD=15  idem<\/code><\/pre>\n\n\n\n
ISIS inter-area AD=18 – metric default 10s<\/p>\n\n\n\n
IIH = Hello using MAC address. Router ID, area, Neighbor discovery
CSNP = Like DB descriptor in OSPF. After neighbor discovery
PSNP = request prefix and route info<\/p>\n\n\n\n
Border router, establish L2 adj (differnt area) -> 2x LSDB!!!
establish L1 adj (same area)<\/p>\n\n\n\n
LSPDU: sent by border router, with Attached bit. The router L1 that receives it install a default route to the originator of LSPDU<\/p>\n\n\n\n
NET address: network entity title. In lo0 !!!
49.(16b – area ID).(48b MAC).00<\/p>\n\n\n\n
Set adjacencies (no need IPs!)
1) set NET in lo0.0 under family iso
2) set protocols isis interface X.0
3) set interface x.0 family iso (NET not needed!(
4) disable the level you dont need!! (by default all links are l1\/l2)<\/p>\n\n\n\n
authentication-type simple or md5
authenticaion-key key<\/p>\n\n\n\n
Protocol Independent Routing (Static routes)<\/h1>\n\n\n\n
0 directed  connect<\/code><\/pre>\n\n\n\n
AD: 5 static routes
7 rsvp-lsp
8 sr-te
9 lsdp-lsp
10 ospf internal
15 isis l1
18 isis l2
105 pim
130 agg
150 ospf ext
160 isis ext
170 bgp<\/p>\n\n\n\n
prefernce=5
nh = ip directled connected, reject, discard
no recursive loop-up performed by default (like cisco) -> need to use “resolve”
qualified-next-hop IP preference X
no-readvertise (ie for mgmt not advertised into IGP) block exporting via policies
as-path, community, metric, preference<\/p>\n\n\n\n
ipv4: edit routing-options staic route \u2026
ipv6: edit routing-options rib inet6.0 static route \u2026<\/p>\n\n\n\n
Aggregate routes<\/h2>\n\n\n\n
preference=130
at least one contributing route active
default nh = reject
as-path, community, metric, policy, preference
show route AGG\/22 exact detail<\/p>\n\n\n\n
edit routing-optons aggregate -><\/p>\n\n\n\n
*If contributing routes don\u2019t have a next hop (i.e., are not usable), the aggregate route may still appear, but it will be hidden (inactive) \u2014 and not advertised unless you use a discard next-hop or similar workaround.<\/p>\n\n\n\n
Generated Routes<\/h2>\n\n\n\n
similar to agg routes. NH = nh of primary (lowest preference) contributing route (aggregate nh=reject)<\/p>\n\n\n\n
diff from agg:
-you can assign a next hop.
-And you don’t need the contributing route to be resolvable \u2014 it just needs to exist in the routing table (even if unusable).
-It allows more flexibility when the contributing route is unusable or when you want to inject a route into the table regardless of reachability.<\/p>\n\n\n\n
ie: advertise default into osfp if you are learning a specific prefix from your ISP.<\/p>\n\n\n\n
set policy-option policy-statement match-contributing-prefix term match-bgp from protocol bgp route-filter NET1\/16 exact then accept
term else-reject then reject
set policy-option policy-statement export-default term match-default from protocol aggregate route-filter 0.0.0.0\/0 exact then accept<\/p>\n\n\n\n
set routing-options generate route 0.0.0.0\/0 policy match-contributing-prefix
set protocol ospf export export-default<\/p>\n\n\n\n
Martia Routes<\/h2>\n\n\n\n
0.0.0.0\/8 orlonger
127.0.0.0\/8 orlonger
192.0.0.0\/24 orlonger
240.0.0.0\/4 orlonger<\/p>\n\n\n\n
ipv6: loopback, rfc 2373, link-local<\/p>\n\n\n\n
set routing-options martians x\/8 orlonger<\/p>\n\n\n\n
show route martians table inet.0<\/p>\n\n\n\n
Routing Instance (LAB)<\/h1>\n\n\n\n
show route instance -> default: master -> inet.0 inet6.0<\/p>\n\n\n\n
edit routing-instances
set instance-type x=forwarding, l2vpn, no-forwarding (make big network smaller), virtual-router (system virtualization), vpls, vrf (for l3vpn)
set interface ge-0xxxx
set routing-options static route \u2026. next-hop xxx
set protocols ospf area 0.0.0.0 interface ge-xxxxx<\/p>\n\n\n\n
show route table INSTANCE.inet.0
show interface terse routing-instance INSTANCE<\/p>\n\n\n\n
rib groups: share routes between routing tables<\/h2>\n\n\n\n
edit routing-options
rib-groups NAME
export-rib T0 (only one! – where routes should be taken from) normally omitted because it is always the primary rib
import-rib T1 T2 (severals tables – where routes should be placed) ????????\/
import-policy POLICY<\/p>\n\n\n\n
edit routing-options
rib-group test
import-rib [ inet.0 test.inet.0] ===> routes from inet.0 TO test.inet.0 ???? ^^^^ differente from aboves<\/p>\n\n\n\n
edit protocols ospf
set rib-group test
area 0.0.0.0 interface ge-0\/0\/0.0 lo0.0<\/p>\n\n\n\n
create a logical-tunnel interface between instances and route between them: lt-0\/0\/0
*requires service card<\/p>\n\n\n\n
edit interfaces lt-0\/0\/0
unit 0
encapsulation ethernet
peer-unit 1
family inet
uni t
encapsulation ethernet
peer-unit 0
family inet<\/p>\n\n\n\n
LOAD BALANCING<\/h1>\n\n\n\n
per-packet issue -> out-of-order (Junos doesnt do per-packet !!!!)<\/p>\n\n\n\n
per-flow LB:
set policy-options policy-statement LB-ALL then load-balance per-packet
set routing-options forwarding-place export LB-ALL<\/p>\n\n\n\n
show route forwarding-plane<\/p>\n\n\n\n
default flow ipv4: incoming interface, src add, dst add, protocol
ipv6: l3,l4,traffic class<\/p>\n\n\n\n
modify: set forwarding-option hash-key family inet layer-3 layer-4<\/p>\n\n\n\n
Filter-Based-Forwarding (FBF) (lab)<\/h1>\n\n\n\n
forwarding based on source IP<\/p>\n\n\n\n
1) using RIB-groups
-create match filter and apply to incomming interfaces
set firewall family inet filter F-NAME term TERM from CONDITION then routing-instance INSTANCE<\/p>\n\n\n\n