Learning IOS and JUNOS

As everyone knows that OSPFv2 is a standard routing protocol (http://www.ietf.org/rfc/rfc2328.txt), but not all vendors device will implement it exactly the same. Especially when the network scenario was not follow the standard design, then it might have different exceptional behavior in different vendor devices. In order to compare the difference behavior between Cisco and Juniper. I designed a special OSPF topology just like below, so we can see Cisco and Juniper have different result of routing exchange behavior.

A bird in the hand is worth two in the bush Day 3 - How to view or modify JUNOS configuration ? Entering Configuration Mode When you stand behind an engineer, you can identify the engineer is Cisco or Juniper guy easily.  Most cisco engineers like to use the command 'conf t' to enter configure mode of router or switch. router>  enable Password: router#  conf t Enter configuration commands, one per line.  End with CNTL/Z. router(config)# When you want to show any results, you don't need to exit to the privilege mode(#) to show it. You can leverage 'do' command to check the status. router(config)#  do sh ip int brief Interface              IP-Address      OK? Method Status                Protocol GigabitEthernet1       10.17.14.195    YES manual up                    up ...

Junos Script Automation is a powerful and flexible on-box toolset which provides customization of network behavior, adaption to what your application expects to configure, manage and diagnose if and when needed. It sits right above the Junos OS, with a northbound interface to Junos Space applications, and southbound access to Junos SDK applications and native management plane instrumentation. This customized programmable solution makes your application smarter and better in real-time. In Juniper official website provides many script samples to match part of common requests. In my company, we deployed many inter-connections EBGP/IBGP between router or layer 3 switch. So I picked one op script from the JUNOS Script Library - show bgp policy : display all routing-policies in sequential order for a selected BGP peer.

Configuration Management Day 2 - How to review router configuration ? In Cisco IOS, it has two default configuration files:  (1) startup-config: is used for initialization of router boot up process   (2) running-config.  is the real-time concurrent configuration repository whenever you type any commands in IOS. And how do you differentiate screen output is the startup-config or running-config ?

Once a use, forever a custom My first-time experience of Cisco router installation was in 1997, when I was a junior network engineer in a small company. I remembered that day I finished installing a customer router on-site for only 15 mins then I left and went back again after 2 hours to configure the router via console again..because I forgot to configure password under line vty (I told myslef I would never made such stupid mistake again like that - Password required, but none set ) After 13 years later, I started to learn JUNOS since 2010. Because I familiar Cisco IOS so much, so I knew the feeling of use behavior change from IOS to JUNOS. The hierarchical structure is not so easy to read when you see it in the first time.(especially when you have no any programming experience) However, having the use experience of Cisco IOS is a not a bad thing before you start to learn JUNOS. I believe if you can leverage your previously IOS command knowledge then map to JUNOS relative s...

In order to prepare the future migration from Juniper SSG to SRX, so I tried to use SRX GUI interface to see how its easy for operation team to sustain this. This is the first time I tried to use GUI to manage a router, and if you are not familiar with Juniper SRX features and functions, I have to say its a quick start to have a glance overview of Juniper SRX by web interface. For many junior engineers, if they can have what-you-see-what-you-get interface, they will accept new technology as fast as they can or they might refuse to try or to learn new technology if there's no time pressure or instructions from high-level managers directly . We are still using CLI to control most routing and switching network device today, but I believe someday the condition may change if the network virtualization come true.(I think no one would like to control firewall by CLI, isn't it ?)

Cloud era is coming, so its time to learn those you are not familiar with. Amazon Web Services, aka AWS, nevertheless to say is the No.1 cloud service you should know immediately now.

Learning openstack is not an easy task for me, because I don't have much linux knowledge. During the openstack setup process followed by Openstack.org official installation guide, I spent more than 3 hours to install necessary modules and modified the configuration files one by one. But I failed and I cannot figure out what the problem is...maybe I should spend more time to understand each action and verify it one-by-one. But I don't have so much time to waste on installation procedure, I need to familiar the openstack as soon as possible to test its feature. So I tried to leverage Devstack all-in-one install script to help me to learn what is openstack and see how it works. However, its still not just so simple just like Devstack.org said if you are installing openstack first time:

Juniper CLI learning is a little challenge for junior network engineers or Cisco IOS engineers, because the JUNOS modular and hierarchical structure design. Some features may need several command line which were configured under different hierarchical levels, then combined all of them together in another hierarchical level. Such kind of CLI design especially not easy to learn when apply CoS on juniper device.(I believe many Cisco IOS engineers don't want to switch to JUNOS because of this...) As above figure is my understanding about the related JUNOS command which is using in our production network.

As Juniper FIREFLY-PERIMETER is an ideal candidate of virtual router solution for RTBH router, because its just need control plane and memory(it will not be limited by hardware) for BGP exchange route with community. No much data forwarding plane packet process was needed. So I rebuild the lab with Juniper firefly to see the difference with physical routers as below topology. In my vmware workstation lab, I assigned two interface to each firefly, ge-0/0/0 was used for BGP connections and ge-0/0/1 was used for SSH purpose only(to be more easier for config copy/paste. The most obviously advantage of firefly is the response time of commit action, it was almost done immediately after you press Enter key when I initialized the configuration clean-up, its great! ...But after I copy & paste all my configurations to it then the response time still became longer. [edit] lab@FIREFLY-PERIMETER-1# run show chassis hardware Hardware inventory: Item     ...

Since our company current RTBH router was EOL(Cisco 1800), and our security team would like to expand the RTBH scope to all office SSL VPN all over the world(more than 100s), so we are trying to survey a good candidate for this position. We have a spare Juniper M10i and I believe it can meet the requirement for sure, but its too big so our operation team tried to leverage the lab device - Juniper SRX100H for this purpose. That's why I did this POC to prove the BGP scalability of SRX100H. As below is the Juniper SRX100H hardware features , as a such small device but has 1GB RAM so it can do much more than my expectation in its control plane: DDR Memory: 1 GB Power supply adapter: 30 watts AC input voltage: 100 to240 VAC FastEthernetports: 8 Consoleport: 1 USB port: 1 LEDs: 4 NAND flash: 1 GB  My POC topology as below is very simple and straight, I used a single cable connect between two SRX100H, then setup a trunk w/ 120 VLANs between them, each VLAN will have a dire...

GMPLS extends MPLS functionality with the enhancement of forwarding, traffic engineering, and quality-of-service (QoS) capabilities of packet-based networks by creating virtual label-switched paths (LSPs) across a network of label switching routers (LSRs) to optical network devices utilizing time-division multiplexing (TDM), fiber switching, and lambda switching. In a GMPLS network it is therefore possible to find and provision end-to-end paths that traverse different networks. For example, a packet/cell-based LSP can be nested in a TDM-based LSP for transport over a SONET network. The TDM-based LSP can similarly be nested in a lambda-based LSP for transport over a wavelength network. Multiple lambda switch-capable LSPs can be nested within a fiber switch-capable set up between two fiber switching elements. This forwarding hierarchy of nested LSPs allows service providers to transparently send different types of traffic over various types of network segments. GMPLS introduces Link...

DPT/RPR uses two symmetric bi-directional counter-rotating fiber rings. Each fiber ring can be concurrently utilized to pass both data and control packets. Data can be sent on both rings simultaneously. The rings are referred to as “bi-directional counter-rotating” rings, because traffic travels in opposite directions on the rings. To distinguish between the two rings, one fiber ring is referred to as the “inner” ring and the other as the “outer” ring. Notice the outer ring sends traffic clockwise while the inner ring sends traffic counter-clockwise.  At the same time as data is sent (downstream) on one ring, a corresponding control packet is sent (upstream) around on the other ring. Having control packets traveling in the opposite direction on a separate ring makes it possible to restore service more quickly in the event of a failure.  DPT/RPR uses the entire concatenated payload at the specified line rate. For example, at OC48 or STM16 both fiber rings use the entire 2.5...

SONET Transport Hierarchy Each level of the hierarchy terminates its corresponding fields in the SONET payload, as such: Section A section is a single fiber run that can be terminated by a network element (Line or Path) or an optical regenerator. The main function of the section layer is to properly format the SONET frames, and to convert the electrical signals to optical signals. Section Terminating Equipment (STE) can originate, access, modify, or terminate the section header overhead. (A standard STS-1 frame is nine rows by 90 bytes. The first three bytes of each row comprise the Section and Line header overhead.) Line Line-Terminating Equipment (LTE) originates or terminates one or more sections of a line signal. The LTE does the synchronization and multiplexing of information on SONET frames. Multiple lower-level SONET signals can be mixed together to form higher-level SONET signals. An Add/Drop Multiplexer (ADM) is an example of LTE. Path Path-Terminating Equipm...

Overview Selective Packet Discard (SPD) is a mechanism to manage the process level input queues on the Route Processor (RP). The goal of SPD is to provide priority to routing protocol packets and other important traffic control Layer 2 keepalives during periods of process level queue congestion. Historically, on platforms such as the Cisco 7x00 and non-Cisco Express Forwarding (CEF) 7500 systems, significant numbers of transit packets were forwarded by the Route Processor in order to populate the fast switching cache. Consequently, SPD was required in this case to prioritize the routing protocol packets over the transit packets which share the same queue. Currently, on the Cisco 12000 Series Internet Router and on the 7500 running CEF, only traffic destined to the router itself is sent to process level. In this case, SPD is used to prioritize routing protocol packets when management traffic such as Simple Network Management Protocol (SNMP) is present or when a Denial of Service...

Incoming-Call-Request (ICRQ) Incoming-Call-Request (ICRQ) is the control message sent by an LCCE to a peer when an incoming call is detected (although the ICRQ may also be sent as a result of a local event).  It is the first in a three-message exchange used for establishing a session via an L2TP control connection. The ICRQ is used to indicate that a session is to be established between an LCCE and a peer.  The sender of an ICRQ provides the peer with parameter information for the session.  However, the sender makes no demands about how the session is terminated at the peer (i.e., whether the L2 traffic is processed locally, forwarded, etc.).    The following AVPs MUST be present in the ICRQ:     Message Type     Local Session ID     Remote Session ID     Serial Number     Pseudowire Type     Remote End ID     Circuit Status

When a router that is capable of BGP Graceful Restart loses connectivity, the following happens to the restarting router: 1. The router establishes BGP sessions with other routers and relearns the BGP routes from other routers that are also capable of Graceful Restart. The restarting router waits to receive updates from the neighboring routers. When the neighboring routers send end-of-Routing Information Base (RIB) markers to indicate that they are done sending updates, the restarting router starts sending its own updates. 2. The restarting router accesses the checkpoint database to find the label that was assigned for each prefix. If it finds the label, it advertises it to the neighboring router. If it does not find the label, it allocates a new label and advertises it. 3. The restarting router removes any stale prefixes after a timer for stale entries expires. When a peer router that is capable of BGP Graceful Restart encounters a restarting router, it does the following:...

The signaling requirements of VPLS: The virtual circuit setup uses the same LDP signaling mechanism defined for point-to-point services. Using a directed LDP session, each provider edge advertises a virtual circuit label mapping that is used as part of the label stack imposed on the Ethernet frames by the ingress provider edge during packet forwarding. The reachability information distributed in a VPLS Cisco VPLS does not require the exchange of reachability (MAC addresses) information via a signaling protocol. This information is learned from the data plane using standard address learning, aging, and filtering mechanisms defined for Ethernet bridging. However, the LDP signaling used for setting up and tearing down the virtual circuits can be used to indicate to a remote provider edge that some or all MAC addresses learned over a virtual circuit need to be withdrawn from the VSI. This mechanism provides a convergence optimization over the normal address aging that would eventual...

Optical Data Unit (ODU) The ODU overhead is broken into several fields: RES, PM, TCMi, TCM ACT, FTFL, EXP, GCC1/GCC2 and APS/PCC. The reserved (RES) bytes are undefined and are set aside for future applications. The path monitoring (PM) field is similar to the SM field described above. It contains the TTI, BIP-8, BEI, BDI and Status (STAT) sub-fields. There are six tandem connection monitoring (TCMi) fields that define the ODU TCM sub-layer, each containing TTI, BIP-8, BEI/BIAE, BDI and STAT sub-fields associated to each TCM level (i=1 to 6). The STAT sub-field is used in the PM and TCMi fields to provide an indication of the presence or absence of maintenance signals. The tandem connection monitoring activation/deactivation (TCM ACT) field is currently undefined in the standards. The fault type and fault location reporting communication channel (FTFL) field is used to create a message spread over a 256-byte multiframe. It provides the ability to send forward and backward pa...

Reasons for ATM CRC Errors The following are some potential reasons for ATM CRC errors: Dropped cells due to traffic policing in the ATM cloud on one or more VCs attached to the ATM interface. Noise, gain hits, or other transmission problems on the data-link equipment. A faulty or failing ATM interface. The show interfaces command output displays the CRC error count. These errors suggest that when the SAR reassembles the packet and checks the CRC, the calculated CRC value does not match the value in the assembled packet's CRC field.