Re: [j-nsp] MX204 Tunnel Services

2018-12-27 Thread Aaron1
I see you using ... lt-0/0/0.100 lt-0/0/0.101 You might be hitting something I found a while back with lsys, same MAC address on both sides of tunnel link , issues with that If you are hitting up against that problem, Try either sitting MAC address on one side OR sitting a static arp entry on

Re: [j-nsp] MX204 Tunnel Services

2018-12-27 Thread Fraser McGlinn
Further to this, and to clarify I do already have tunnel-services enabled and after configuring I get output packets on each unit, but no input packets. It seems like the PFE is just eating the packets. fraser@> show configuration chassis | display set | match tunnel-services set chassis fpc

Re: [j-nsp] EX4650 or QFX5120 Use Case

2018-12-27 Thread Eduardo Schoedler
https://www.juniper.net/documentation/en_US/junos/topics/reference/general/mpls-limitations-qfx-series.html Em qua, 26 de dez de 2018 às 21:08, Giuliano C. Medalha escreveu: > > Hello, > > Does anyone uses EX4650 or QFX5120 (new products) with JUNOS 18.3 or 18.4 ? > > Any update for share about t

Re: [j-nsp] MX204 Tunnel Services

2018-12-27 Thread Tim Jackson
I've done LT interfaces on MX204 with multiple LSYS' to build some lab topologies without issue. This was back in beta and worked fine, haven't run it on newer code, but I do run GRE tunnels in 18.1R3 without issue. -- Tim On Wed, Dec 26, 2018, 5:43 PM Fraser McGlinn Hey Everyone, > > Yet anot

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-27 Thread Chris Morrow
At Thu, 27 Dec 2018 11:57:54 +0100, Bjørn Mork wrote: > > Chris Morrow writes: > > > tls brings with it cert issues. > > Well. How bad does it have to be? Yes, you have to manage private > keys. That's the same for TCP-AO, SSH and TLS. Or any other transport > security protocol. No real diff

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-27 Thread Chris Morrow
At Thu, 27 Dec 2018 11:43:58 +0100, Bjørn Mork wrote: > > Chris Morrow writes: > > On Wed, 26 Dec 2018 14:11:19 -0500, > > sth...@nethelp.no wrote: > >> > >> Now if Juniper could implement TCP-AO and then donate the implementation > >> to FreeBSD? :-) > > > > This was sort of my point, yes. > >

Re: [j-nsp] IPAM like tool/DB for managing communities

2018-12-27 Thread adamv0025
Yes that's what I was thinking too, use RD as merely an arbitrary VPN ID. And then I realized that even though I could use these tools for documenting the VRF config after the fact But I can't use these with automated service provisioning. I need my automated service provisioning tool to query th

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-27 Thread Bjørn Mork
Chris Morrow writes: > tls brings with it cert issues. Well. How bad does it have to be? Yes, you have to manage private keys. That's the same for TCP-AO, SSH and TLS. Or any other transport security protocol. No real difference. I assume the perceived issue with TLS is that private keys have

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-27 Thread Bjørn Mork
Chris Morrow writes: > On Wed, 26 Dec 2018 14:11:19 -0500, > sth...@nethelp.no wrote: >> >> Now if Juniper could implement TCP-AO and then donate the implementation >> to FreeBSD? :-) > > This was sort of my point, yes. > Thanks, as always for your cogent point(s). I don't follow FreeBSD develop

Re: [j-nsp] About Secure Transport for RPKI on JUNOS

2018-12-27 Thread Gert Doering
Hi, On Thu, Dec 27, 2018 at 01:02:17PM +0800, Pyxis LX wrote: > BTW, I'll consider the Fortinet CLI inconsistency as a software bug that > shall be fixed. Yes, totally so. But it's not the first time and won't be the last time that SSH setups stop working "mysteriously" due to vendor decisions a