Re: [j-nsp] preventing DoS attacks

2009-02-16 Thread Stefan Fouant
On Mon, Feb 16, 2009 at 5:01 PM, Amos Rosenboim wrote: > As far as I remember firewall-filters can also combine policers within them > (not sure about this), so if I understand your requirement correctly, a > firewall filter on lo0.0 will achieve your goal. Yes absolutely, you can configure polic

Re: [j-nsp] preventing DoS attacks

2009-02-16 Thread Amos Rosenboim
Marlon, It wasn't explicitly stated below so just to clarify. A firewall filter applied to the lo0.0 interface is applied to all control plane traffic handled by the RE no matter what the destination address on the router is (i.e it also applied to the ip address assigned to the interfaces

Re: [j-nsp] IOS to JUNOS QoS

2009-02-16 Thread Andrew Jimmy
Is there any default priority of these numbered queues like if link is congested and packets are queuing in 0-8 different queues which one gonna be served first. Let's say, 3 packets are in queue 0 and 4 in queue 1 and 7 in queue 5, which one will be serialized first. From: Sean Clarke [mail

Re: [j-nsp] L2 vs L3 policing rates

2009-02-16 Thread Stefan Fouant
On Mon, Feb 16, 2009 at 12:57 PM, Marlon Duksa wrote: > The packet length is variable in my case, I have IMIX traffic coming in. > Dealing with packet length filters is not practical when you need to > include _all_ packet lengths... If you omit the packet-length match condition, you will automa

Re: [j-nsp] L2 vs L3 policing rates

2009-02-16 Thread Marlon Duksa
The packet length is variable in my case, I have IMIX traffic coming in. Dealing with packet length filters is not practical when you need to include _all_ packet lengths...Thanks, Marlon On Fri, Feb 13, 2009 at 8:36 PM, Stefan Fouant wrote: > On Fri, Feb 13, 2009 at 11:08 PM, Marlon Duksa wro

Re: [j-nsp] preventing DoS attacks

2009-02-16 Thread Marlon Duksa
It is more complicated than this. I have a bunch of subscribers (each sub on a different VLAN) and I need to protect CPU per subscriber, per mac address and such...also for protocols such as LACP, ANCP, DHCP... One rule fits all is not the best approach here. Thanks, Marlon On Fri, Feb 13, 2009 at

Re: [j-nsp] IOS to JUNOS QoS

2009-02-16 Thread Michel de Nostredame
You may use following config to enable 4 queues or 8 queues on an interface [edit chassis fpc slot-number pic pic-number] max-queues-per-interface (4 | 8); ref: http://www.juniper.net/techpubs/software/junos/junos93/swconfig-cos/enabling-eight-queues-on-interfaces.html On Tue, Feb 17, 2009 at

Re: [j-nsp] IOS to JUNOS QoS

2009-02-16 Thread Sean Clarke
You have to enable it ... by default the PIC only has 4 queues available. i.e. set chassis fpc 1 pic 0 max-queues-per-interface 8 cheers On 2/16/09 6:33 PM, Andrew Jimmy wrote: Thanks for your reply. Can you let me know the way to use 8 supported Queues instead of 4 usable queues. CoS que

Re: [j-nsp] snmp oid for polling DCU

2009-02-16 Thread Masood Ahmad Shah
This will take you on a snmp journey . ja...@r1# run show snmp mib walk 1 Regards, Masood -Original Message- From: juniper-nsp-boun...@puck.nether.net [mailto:juniper-nsp-boun...@puck.nether.net] On Behalf Of shariq qamar Sent: Monday, February 16, 2009 6:46 PM To: juniper-nsp@puck.

Re: [j-nsp] IOS to JUNOS QoS

2009-02-16 Thread Andrew Jimmy
Thanks for your reply. Can you let me know the way to use 8 supported Queues instead of 4 usable queues. CoS queues : 8 supported, 4 maximum usable queues -Original Message- From: Patrik Olsson [mailto:d...@webkom.se] Sent: Monday, February 16, 2009 3:16 PM To: Andrew Jimmy Cc: ju

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Patrik Olsson
> might be - I've never used virtual routers. a firewall input filter on > fxp0 is just in the kernel (obviously not in the PFE ASICs), but it > works well. :) I was more in the line on if I want separate routing for my RE port from the rest of the network, so that I can build a route management n

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Eric Van Tol
> From: Erdem Sener [mailto:erd...@gmail.com] > Subject: Re: [j-nsp] group re0 routing-options > > Hello, > > Although you can't put fxp in a different routing instance, you could > put it in a logical router.Of course, you'll need to copy any static > routing or relevant > stuff to that logical

Re: [j-nsp] EX4200 1000baseT SFP unsupported in 9.4

2009-02-16 Thread Jeff S Wheeler
On Sat, 2009-02-14 at 20:43 -0800, Ariff Premji wrote: > Try using the latest 9.4 release. A revision was made to address > unknown SFPs the same way as it was back in 9.1. It may or may not > work for you but its worth a try. My SFPs will not function on 9.4R1.8 :( -- Jeff S Wheeler +1-21

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Erdem Sener
Hello, Although you can't put fxp in a different routing instance, you could put it in a logical router.Of course, you'll need to copy any static routing or relevant stuff to that logical router too. HTH, Erdem On Mon, Feb 16, 2009 at 3:27 PM, Eric Van Tol wrote: >> So probably its is better t

[j-nsp] GRE Tunnel Termination Device

2009-02-16 Thread Scott Wolfe
Good Morning, Does anyone know of any router that could handle 10k+ GRE tunnels? I'm looking to offload GRE off of our ERXs onto a dedicated box. Thanks, Scott Wolfe Cybera, Inc 615-301-2346 ___ juniper-nsp mailing list juniper-nsp@puck.nether.net ht

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Eric Van Tol
> So probably its is better to set up a virtual router instance and move > the fxp0 interface into it and use that for management and get the > rib/fib separated from the global instance? > Unfortunately, you can't do this. :-( You can't even put it into a separate routing instance. I imagine

[j-nsp] snmp oid for polling DCU

2009-02-16 Thread shariq qamar
Dear Techies , I m done with QPPB configuration on my Juniper M320 box junos 8.5R3.4 and successfully able to get counters for the destination calss i want to see the plot of counters via SNMP server . will anybody explain me how to get OID's values in juniper . what is the way to get OID's valu

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Felix Schueren
>> Incidentally, I highly recommend placing a spoof-protect filter on your >> fxp0 interface (something like: from source-address fxp0-network; >> dest-addr fxp0-network; then accept; rest then reject), because all >> packets entering fxp0 (e.g., broadcasts) with a non-fxp0-network >> destination w

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Patrik Olsson
> It uses the same path as the control traffic, i.e. OSPF, BGP, IS-IS > packets, FPC health monitoring etc. Fantastic. > Incidentally, I highly recommend placing a spoof-protect filter on your > fxp0 interface (something like: from source-address fxp0-network; > dest-addr fxp0-network; then accep

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Felix Schueren
Patrik Olsson wrote: > Silly me. Yes of course, if the route points to fxp0, the route will be > used for forwarding, but no packets can transit from the PFE there. But > Felix, are you sure packets go in the other direction? yup. We've had it happen. >How does the connection between PFE and RE ha

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Patrik Olsson
Silly me. Yes of course, if the route points to fxp0, the route will be used for forwarding, but no packets can transit from the PFE there. But Felix, are you sure packets go in the other direction? How does the connection between PFE and RE handle this? Patrik > It'll try to use it, but it shou

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Felix Schueren
It'll try to use it, but it shouldn't work for actual forwarding - you can't get packets from the PFE towards fxp0 (but be warned: you can get packets from fxp0 to the PFE...). Kind regards, Felix Patrik Olsson wrote: > Hi, > > sorry for typing faster than thinking :-) > > If you see the rout

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Nilesh Khambal
It won't be used to forward any transit traffic since it pointing to fxp0. Fxp0 can not be used to forward any transit traffic. The route will still be used for routing the return traffic on fxp0 network. This is mainly the traffic directed to fxp0 interface itself. If you don't want routin

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Bit Gossip
of course: apply-groups [ re0 re1 ]; Bit. On Mon, 2009-02-16 at 12:15 +0100, Patrik Olsson wrote: > Do you apply the group? > > Patrik > > > Bit Gossip wrote: > > Experts, > > is the default route generated by the following config used for general > > forwarding? I see that it is installed in

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Patrik Olsson
Hi, sorry for typing faster than thinking :-) If you see the route in inet.0, it will be used for forwarding in the global instance. Does that solve your issue? Cheers Patrik Bit Gossip wrote: > Experts, > is the default route generated by the following config used for general > forwarding? I

Re: [j-nsp] group re0 routing-options

2009-02-16 Thread Patrik Olsson
Do you apply the group? Patrik Bit Gossip wrote: > Experts, > is the default route generated by the following config used for general > forwarding? I see that it is installed in inet.0. > > Thanks, > bit. > > groups { > re0 { > interfaces { > fxp0 { > u

Re: [j-nsp] IOS to JUNOS QoS

2009-02-16 Thread Patrik Olsson
class-of-service { schedulers { FTP { transmit-rate percent 20; } HTTP { transmit-rate percent 20; } } scheduler-map test-policy {

[j-nsp] group re0 routing-options

2009-02-16 Thread Bit Gossip
Experts, is the default route generated by the following config used for general forwarding? I see that it is installed in inet.0. Thanks, bit. groups { re0 { interfaces { fxp0 { unit 0 { family inet { address 1.