[j-nsp] IPv6 static default route in routing instance?

2012-06-13 Thread Gordon Smith
Hi, Just wondering if anybody's come across this before - default IPv6 static not appearing in the routing instance inet6 table... Instance is a VRF: instance-type vrf; interface ge-1/1/0.503; interface ge-1/1/0.504; route-distinguisher 56263:101; vrf-import [ reject-all ]; vrf-export [

Re: [j-nsp] Firewall best practices

2012-06-13 Thread Pavel Lunin
I have a question regarding managing policies among multiple sets of firewalls. I don't know what industry standard / best practice is for managing rules among multiple devices. My two cents. When there is really no such a standard, things to keep in mind do exist. Here are some mistakes

Re: [j-nsp] IPv6 static default route in routing instance?

2012-06-13 Thread Stacy W. Smith
Please provide the output of show route table dmz.inet6.0 :a500:0:2::1 Thanks, --Stacy On Jun 12, 2012, at 11:48 PM, Gordon Smith wrote: Hi, Just wondering if anybody's come across this before - default IPv6 static not appearing in the routing instance inet6 table... Instance is a

Re: [j-nsp] IPv6 static default route in routing instance?

2012-06-13 Thread Pavel Lunin
My guess is that the direct route to your next-hop :a500:0:2::1 is not in this instance. Check the interface address config for ge-1/1/0.503 and ge-1/1/0.504. 13.06.2012 09:48, Gordon Smith wrote: Hi, Just wondering if anybody's come across this before - default IPv6 static not appearing

Re: [j-nsp] IPv6 static default route in routing instance?

2012-06-13 Thread Gordon Smith
A downgrade from 11.4R2.14 to 11.2R7.4 fixed the problem. I now see a v6 default route in the vrf... G... Thats a pretty big bug to be in the second code revision of that train On Wed, 13 Jun 2012 08:33:26 -0600, Stacy W. Smith wrote: Please provide the output of show route table

[j-nsp] JUNOS/EX-series gripe - mirror/analyse before rewrite

2012-06-13 Thread Dale Shaw
Hi, whine mode: on Why oh why, in the name of the gods of Junos, is mirror/analyse done before DSCP rewrite? (aka why oh why is DSCP rewrite done on egress?) ..there's probably a really good architectural reason but jeez, it doesn't help when you have some brain-dead endpoints that can't make