Re: [j-nsp] J/SRX ICMP handling

2013-04-24 Thread Klaus Groeger
Hi Dale just give "set security flow allow-icmp-without-flow" a try Regards Klaus — Sent from Mailbox for iPhone On Thu, Apr 25, 2013 at 7:35 AM, Dale Shaw wrote: > Hi all, > This post relates to a previous post of mine on asymmetrically routed > UDP traffic: > https://puck.nether.net/

Re: [j-nsp] SNMP on logical-system fxp0

2013-04-24 Thread Saku Ytti
On (2013-04-24 20:54 -0400), Jeff Wheeler wrote: > My view is that fxp0 is an out-of-band interface for manual > intervention; not one that I ever use for SNMP. My view is that fxp0 is completely useless interface. It's not OOB, it's completely fate-sharing the freebsd/junos. In RS232 you can a

[j-nsp] J/SRX ICMP handling

2013-04-24 Thread Dale Shaw
Hi all, This post relates to a previous post of mine on asymmetrically routed UDP traffic: https://puck.nether.net/pipermail/juniper-nsp/2012-December/024878.html It seems as though a J/SRX in flow mode will drop ICMP packets such as unreachable and ttl-exceeded if, after consulting the session t

Re: [j-nsp] SNMP on logical-system fxp0

2013-04-24 Thread Jeff Wheeler
On Wed, Apr 24, 2013 at 7:17 PM, Brandon Ross wrote: > On Wed, 24 Apr 2013, Pavel Lunin wrote: >> This is what I never understood. Why people want to use fxp0 (or any >> other "dedicated management") iface for real production management? > > Are you suggesting that they should purchase a 10/100/10

Re: [j-nsp] SNMP on logical-system fxp0

2013-04-24 Thread Brandon Ross
On Wed, 24 Apr 2013, Pavel Lunin wrote: This is what I never understood. Why people want to use fxp0 (or any other "dedicated management") iface for real production management? Many operators have backbone routers with 10's of 10GbE ports and maybe even a few 40 or 100GbE ports at this point,

Re: [j-nsp] SNMP on logical-system fxp0

2013-04-24 Thread Pavel Lunin
20.04.2013 01:45, Chip Marshall write: > So, I have an MX5 with it's fxp0 management interface connect to > one network, which I've placed in a logical-system so it can have > it's own default route for out-of-band management. This is what I never understood. Why people want to use fxp0 (or any o

Re: [j-nsp] Best route reflector platform

2013-04-24 Thread Pavel Lunin
2013/4/24 Richard A Steenbergen wrote: > it either won't work at all, or won't survive for very > long. And that's after taking a lot of steps to reduce core IBGP mesh > route load. I haven't touched any of the "virtual SRX" stuff, does it > run 64-bit JUNOS? > I haven't either (it's just rumor

Re: [j-nsp] Best route reflector platform

2013-04-24 Thread Daniel Roesen
On Wed, Apr 24, 2013 at 07:24:18AM -0500, Richard A Steenbergen wrote: > In fairness I really don't think there is a "big" market for dedicated > RR's, so I'm sure it isn't on the top of anyone's radar. That said, it > is an absurdly easy problem to solve, with almost no work required (ship > JU

Re: [j-nsp] Best route reflector platform

2013-04-24 Thread Richard A Steenbergen
On Sun, Apr 21, 2013 at 02:47:58PM +0400, Pavel Lunin wrote: > 2. Branch SRX do not support more than 2G of RAM. Moreover about 700M+ is > preallocated for flow session table and it is not released even when you > switch the box into packed mode (well, at least used to be last time I > checked a ye