[j-nsp] Multiple destinations for inet6-backup-router

2012-06-26 Thread Ihsan Junaidi Ibrahim
Hi folks, Is anyone able to install multiple destinations into their inet6-backup-router stanza? No matter what i do, I can't seem to install more than one destinations into the backup router. It's an SRX240H running 11.4S3. ihsan@acs01-kul-node0# set system inet6-backup-router

Re: [j-nsp] Whats the best way to announce an IP range in BGP? Doesn't physically exist anywhere.

2012-06-26 Thread Pavel Lunin
25.06.2012 16:06, Scott T. Cameron: 1. First, sorry for writing this once again, but it's just not the case. Any more or less smart stateful device, whether SRX or anything else, must not create session states for packets falling under a discard route. And SRX does not,

[j-nsp] root-login via ssh and 11.x

2012-06-26 Thread Nick Kritsky
FYI: It looks like in version 11 Juniper has changed default settings for system services ssh root-login. Now if you want to login as root via ssh, you have to explicitly allow it. in 10.X it was allowed by default. Tested on EX-4200, SRX-100. Funny thing is that documentation is still claiming

Re: [j-nsp] root-login via ssh and 11.x

2012-06-26 Thread Julien Goodwin
On 26/06/12 22:09, Nick Kritsky wrote: FYI: It looks like in version 11 Juniper has changed default settings for system services ssh root-login. Now if you want to login as root via ssh, you have to explicitly allow it. in 10.X it was allowed by default. Tested on EX-4200, SRX-100. Funny

Re: [j-nsp] IS-IS MT transition mode?

2012-06-26 Thread Jeff Aitken
On Mon, Jun 25, 2012 at 09:48:20PM -0700, Michael Sinatra wrote: That's the JunOS equivalent of 'multi-topology'. It is NOT the equivalent of 'multi-topology transition'. My understanding is that neither IOS-XR nor JUNOS support the equivalent of the transition mode, unfortunately. I would

Re: [j-nsp] root-login via ssh and 11.x

2012-06-26 Thread Wayne Tucker
On Tue, Jun 26, 2012 at 5:09 AM, Nick Kritsky nick.krit...@gmail.comwrote: FYI: It looks like in version 11 Juniper has changed default settings for system services ssh root-login. Now if you want to login as root via ssh, you have to explicitly allow it. in 10.X it was allowed by default.

Re: [j-nsp] IS-IS MT transition mode?

2012-06-26 Thread Jared Gull
After digging into this a bit more, I believe Jeff is right w/r/t Junos OS not supporting the transition feature. From: Jeff Aitken jait...@aitken.com To: Michael Sinatra mich...@rancid.berkeley.edu Cc: Jared Gull jmg...@yahoo.com;

[j-nsp] SRX DNS Forwarding - helpers domain

2012-06-26 Thread f...@flipstar.net
Hey everybody, I wonder if anybody is successfully using forwarding-options helpers domain (DNS) [1] on branch SRX? In my setup the client queries the srx which forwards the request to the dns server. The dns sends a reply that never passes the srx back to the client. Client

Re: [j-nsp] SRX DNS Forwarding - helpers domain

2012-06-26 Thread Tim Eberhard
A quick search on that error message says it's a return routing issue. http://kb.juniper.net/InfoCenter/index?page=contentid=KB21363cat=JUNOSactp=LIST -Tim Eberhard On Tue, Jun 26, 2012 at 8:03 AM, f...@flipstar.net f...@flipstar.net wrote: Hey everybody, I wonder if anybody is successfully

Re: [j-nsp] root-login via ssh and 11.x

2012-06-26 Thread Nick Kritsky
On Tue, Jun 26, 2012 at 4:51 PM, Wayne Tucker wa...@tuckerlabs.com wrote: Are you using a RADIUS server?  What setting are you using for system/authentication-order, if any? I am using TAC+. settings are: system authentication-order tacplus root user is local. There is no user root in

Re: [j-nsp] root-login via ssh and 11.x

2012-06-26 Thread Nick Kritsky
To all: sorry for misinformation. It looks like change in root authentication behavior was caused not by JunOS upgrade, but by change from system authentication-order [ tacplus password ] to system authentication-order tacplus I have to be more careful. Still, I can't understand the logic behind

Re: [j-nsp] IS-IS MT transition mode?

2012-06-26 Thread Felix Schueren
One possible workaround in this scenario might be (obviously depends on IGP complexity etc): Run OSPF temporarily, carry v6 routes in there, then you can reconfigure IS-IS as you see fit. Once you're done, disable OSPF again. Regards, Felix On 26.06.12 15:18, Jared Gull wrote: After digging

Re: [j-nsp] root-login via ssh and 11.x

2012-06-26 Thread Wayne Tucker
On Tue, Jun 26, 2012 at 8:32 AM, Nick Kritsky nick.krit...@gmail.comwrote: To all: sorry for misinformation. It looks like change in root authentication behavior was caused not by JunOS upgrade, but by change from system authentication-order [ tacplus password ] to system

Re: [j-nsp] IS-IS MT transition mode?

2012-06-26 Thread Michael Sinatra
On 06/26/12 11:22, Felix Schueren wrote: One possible workaround in this scenario might be (obviously depends on IGP complexity etc): Run OSPF temporarily, carry v6 routes in there, then you can reconfigure IS-IS as you see fit. Once you're done, disable OSPF again. Yep, that's my current

Re: [j-nsp] forwarding-options helpers bootp vs. forwarding-options dhcp-relay?

2012-06-26 Thread Saku Ytti
On (2012-06-26 16:29 -0400), Clarke Morledge wrote: Warning: 'dhcp-relay' statement cannot be included along with 'forwarding-options helpers bootp' statement This appears to be the case even if the statements are used in different routing-instances. Helpers aren't supported in RIs, only

Re: [j-nsp] forwarding-options helpers bootp vs. forwarding-options dhcp-relay?

2012-06-26 Thread Tarko Tikan
hey, Does anyone know why Juniper developed a different, incompatible syntax logic for extended DHCP? Why didn't they just expand the logic under helpers bootp? dhcp-relay is totally different implementation mainly used to support subscriber management. It's (somewhat) stateful, inspects

Re: [j-nsp] forwarding-options helpers bootp vs. forwarding-options dhcp-relay?

2012-06-26 Thread sthaug
I would avoid DHCP relay like plaque, unless you absolutely positively need it. It is implemented in very silly way, if it is configured all DHCP, even transit, is punted in every interface. Yep, this is a horrible misfeature IMHO. Unfortunately some features require it, like unnumbered