Re: [j-nsp] Using SRX's for BGP and Firewalling

2010-11-09 Thread Brett O'Hara
Makes sure you test them in a lab before commiting to a deployment. They don't always perform as expected and there are unusual limitations compared to the SSGs. Regards, Brett -Original Message- From: juniper-nsp-boun...@puck.nether.net [mailto:juniper-nsp-boun...@puck.nethe

[j-nsp] (no subject)

2010-11-09 Thread Jared Gull
http://eastcoastgreenenergy.com.au/to.html ___ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp

Re: [j-nsp] JunOS 10.0R3 MX960 (DPC's only)

2010-11-09 Thread Ger, Javier
Thanks all for your help. Javier Ger Hornos 690 - Buenos Aires - Argentina Tel +54.11.5530.4531 Cel +54.9.11.3926.5017 j...@cablevision.com.ar www.cablevision.com.ar -Mensaje original- De: Richard A Steenbergen [mailto:r...@e-gerbil.net] Enviado el: Martes, 02 de Noviembre de 2010 0

Re: [j-nsp] Graphing VCP Backplane

2010-11-09 Thread Phill Jolliffe
If you can find a counter for the vcp throughput then you can populate the "utility mib" with the value and snmp poll and graph it. http://www.juniper.net/techpubs/en_US/junos10.3/topics/task/operational/snmp-best-practices-utility-mib-using.html That said for all I know there might be a enterpri

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Alexander Shikoff
Thanks a lot to all who replied! On Tue, Nov 09, 2010 at 01:57:00PM +0300, Alexandre Snarskii wrote: > On Tue, Nov 09, 2010 at 12:18:37PM +0200, Alexander Shikoff wrote: > > > > Filtering of outgoing prefixes is performed via to-MHost policy: > > minot...@br1-gdr.ki# show policy-options policy-st

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Tomas Caslavsky
you have "then accept" on the of policy to-MHost so all other routes will be accepted ( the reject will announce only 178.214.192.0/19 from static ) Tomas Dne 09/11/2010 11:18, Alexander Shikoff napsal(a): Hello, On MX80-48T with JunOS 10.2R1.8 I have a BGP session with downstream confi

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Christian
I guess you want a reject instead of the last accept, rgds, Christian Le 09/11/2010 11:18, Alexander Shikoff a écrit : Hello, On MX80-48T with JunOS 10.2R1.8 I have a BGP session with downstream configured as follows: minot...@br1-gdr.ki# show routing-instances World protocols bgp group Do

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Alexandre Snarskii
On Tue, Nov 09, 2010 at 12:18:37PM +0200, Alexander Shikoff wrote: > > Filtering of outgoing prefixes is performed via to-MHost policy: > minot...@br1-gdr.ki# show policy-options policy-statement to-MHost > term Default { > from { > route-filter 0.0.0.0/0 exact; > } > then rej

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Tore Anderson
Hi Alexander, * Alexander Shikoff > Filtering of outgoing prefixes is performed via to-MHost policy: > minot...@br1-gdr.ki# show policy-options policy-statement to-MHost > term Default { > from { > route-filter 0.0.0.0/0 exact; > } > then reject; > } > term Itself { > fro

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Alexey Tolstenok
Hi Alexander, Cause any other routes are matched against the last unnamed term within the policy to-MHost (the only statement "then accept" without from means that all routes match) 2010/11/9 Alexander Shikoff > Hello, > > On MX80-48T with JunOS 10.2R1.8 I have a BGP session with downstream > co

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Tim Vollebregt
Hi Alexander, When using this policy you are doing the following: -Reject sending default route -Sending prefix 178.214.192.0/19 -Accepting all other advertisements by BGP it's default behaviour. I think this would be fine: show policy-options policy-statement to-MHost term Itself { from {

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread William Jackson
My punt would be to get rid of the last accept statement. Without it your processing should fall through to the default BGP export policy. At the moment I guess you are accepting everything. Best Regards William Jackson Technical Department Sapphire Networks -Original Message- From:

Re: [j-nsp] Using SRX's for BGP and Firewalling

2010-11-09 Thread Julien Goodwin
On 09/11/10 20:12, Keegan Holley wrote: > > On Mon, Nov 8, 2010 at 10:26 PM, Julien Goodwin > mailto:jgood...@studio442.com.au>> wrote: > > On 09/11/10 14:17, Keegan Holley wrote: > > BGP full feed on an SRX650 is fine, if you disable flow mode > (as much as > > you can, d

[j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Alexander Shikoff
Hello, On MX80-48T with JunOS 10.2R1.8 I have a BGP session with downstream configured as follows: minot...@br1-gdr.ki# show routing-instances World protocols bgp group Downstreams neighbor 178.214.196.6 description "MHost: World"; import [ Local-Pref-400 from-MHost Deny-Rest ]; export to-MHo

Re: [j-nsp] Using SRX's for BGP and Firewalling

2010-11-09 Thread Keegan Holley
On Tue, Nov 9, 2010 at 4:01 AM, Maqbool Hashim wrote: > Hmmm, that’s interesting. There were two reasons why I was considering the > SRX's over the SSG's for this setup. > > 1) I had thought that the routing functionality in JunOS would be more > mature than in the SSGs. > I think it depends on

Re: [j-nsp] Using SRX's for BGP and Firewalling

2010-11-09 Thread Maqbool Hashim
Thanks, taking the responses on board: I think 2 x SRX210s in HA Active Passive mode connected into 2 x EX2200-24T should work for us. I want to take a default and partial routing table from the ISPs. Partial as in just the routes for that ISP. I think that should be well within the capabil

Re: [j-nsp] Using SRX's for BGP and Firewalling

2010-11-09 Thread Keegan Holley
On Mon, Nov 8, 2010 at 10:26 PM, Julien Goodwin wrote: > On 09/11/10 14:17, Keegan Holley wrote: > > BGP full feed on an SRX650 is fine, if you disable flow mode (as much > as > > you can, don't forget the ALG's). > > > > > > What's the point of doing BGP on a firewall with firewallling tu

Re: [j-nsp] Using SRX's for BGP and Firewalling

2010-11-09 Thread Maqbool Hashim
Hmmm, that’s interesting. There were two reasons why I was considering the SRX's over the SSG's for this setup. 1) I had thought that the routing functionality in JunOS would be more mature than in the SSGs. 2) Getting more experience with JUNOS and the SRX's as JUNOS might be the one platfor

Re: [j-nsp] ERX route distribution via RIP

2010-11-09 Thread Tom Teeuwen
Found a solution: On my loopback interface i used for the pppoe i had to enter the following command: ip rip copy-to-dynamic Kind regards, Tom Van: Tom Teeuwen Verzonden: zaterdag 6 november 2010 17:03 Aan: juniper-nsp-boun...@puck.nether.net Onderwerp: