Re: [j-nsp] Limitations of MPLS support on EX4200

2014-05-01 Thread Gordon Smith
Label depth - EX4200 only supports a single MPLS label on a packet. See http://www.juniper.net/techpubs/en_US/junos13.3/topics/concept/mpls-label-operations-ex-series.html On Thu, 1 May 2014 14:15:36 +0700, Victor Sudakov wrote: Colleagues, Is MPLS support on EX4200 not complete? It is

Re: [j-nsp] MX960 ARP issues

2014-01-28 Thread Gordon Smith
On Tue, 28 Jan 2014 08:27:13 -0700, John Neiberger wrote: I'll preface this question by saying that I don't think this is a problem on the router, but I'm stumped and I'm curious if anyone else has run into this. We have a Cisco 4948 with two uplinks to different MX960s we'll call RouterA and

Re: [j-nsp] Power issues on 10Gig link

2014-01-23 Thread Gordon Smith
That's a fault. Grab an OTDR and test from each end to determine where it is (and test the optics, of course) Could be dirty optics, dirty / damaged connector, damaged fibre On Fri, 24 Jan 2014 00:14:19 +1100, Ali Sumsam wrote: Hi All, I am using a SFP-10GBase-ER for my Cisco3750X

Re: [j-nsp] BOOTP helper on MX vrf

2013-06-13 Thread Gordon Smith
It's the same on the MX series I ended up with an open JTAC case because I'd configured bootp under vrf's, but it wasn't working. It needed to be configured under the base instance, as you've shown here. Perhaps something that Juniper should look at clarifying or expanding on in the docs.

Re: [j-nsp] SSH - Firewall Filter - MX80

2013-06-04 Thread Gordon Smith
If you want to only block specific ports, rather than all traffic to the RE, something like this may suit you: term permit-ssh-ssl { from { source-address { 0.0.0.0/0; E.F.G.H/20 except; }

Re: [j-nsp] SRX Remote log denied traffic

2013-02-25 Thread Gordon Smith
This (remote syslog) works for me on SRX550's running 12.1R1.9 This will apply a default deny log to the end of your security policies, so you don't need to reorder policies after adding a new one. I have had issues logging locally where the box will stop logging after a while. Not a big

Re: [j-nsp] Framing Errors

2013-02-14 Thread Gordon Smith
Hi Paul, First, I'd fix up the MTU on those interfaces. If the base mtu is 1500, you won't fit a full frame in a dot1q interface under it. To fix it, set the base interface mtu high specify the mtu you want at the subinterface level. e.g. interfaces { ge-1/0/0 { vlan-tagging;

Re: [j-nsp] MX5 with bras?

2012-12-09 Thread Gordon Smith
office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk On 8 Dec 2012, at 13:07, Gordon Smith gor...@gswsystems.com

[j-nsp] Nextgen Multicast on MX boxes

2012-09-12 Thread Gordon Smith
Hi all, I'm after some advice on setting up nextgen multicast on an RSVP based MPLS network. The network is quite simple - MX5's with static lsp's, rsvp signalling fast reroute. But setting up multicast over this is not something I'm very familiar with. I've looked at the Juniper

[j-nsp] DHCP relay between VRF's on an MX5?

2012-09-03 Thread Gordon Smith
Hi all, I'm not too sure what I'm doing wrong here I have several VRF's, and want to pass dhcp requests to another vrf... VRF config: instance-type vrf; interface ge-1/1/0.512; interface ge-1/1/0.602; interface ge-1/1/0.2064; interface ge-1/1/0.2068; interface ge-1/1/0.2072; interface

Re: [j-nsp] Logical Systems Interconnection by Physical Interface

2012-07-28 Thread Gordon Smith
Pays to set the mtu of the interface as well... e.g. R1) fe-0/0/0 { vlan-tagging; mtu 9192; unit 1 { vlan-id 111; family inet { mtu 1500; address 10.0.5.1/24; } } } -Original Message- From:

Re: [j-nsp] Quick Question About HA Setup

2012-07-18 Thread Gordon Smith
Commit confirmed does not work in 12.1 (SRX550 cluster), and is a known issue. Apparently it will be fixed, but no timeframe has been given :-( It will accept a commit confirmed, but when you decide to keep the changes made and do a commit, you'll get a file not found error, and the config will

[j-nsp] IPv6 static default route in routing instance?

2012-06-13 Thread Gordon Smith
Hi, Just wondering if anybody's come across this before - default IPv6 static not appearing in the routing instance inet6 table... Instance is a VRF: instance-type vrf; interface ge-1/1/0.503; interface ge-1/1/0.504; route-distinguisher 56263:101; vrf-import [ reject-all ]; vrf-export [

Re: [j-nsp] IPv6 static default route in routing instance?

2012-06-13 Thread Gordon Smith
dmz.inet6.0 :a500:0:2::1 Thanks, --Stacy On Jun 12, 2012, at 11:48 PM, Gordon Smith wrote: Hi, Just wondering if anybody's come across this before - default IPv6 static not appearing in the routing instance inet6 table... Instance is a VRF: instance-type vrf; interface ge-1/1/0.503; interface

Re: [j-nsp] proxy arp C vs J

2012-02-07 Thread Gordon Smith
Proxy ARP can be useful while sorting out a broken (misconfigured) network, but can also cause you a lot of grief. If the network is configured correctly, it's just a hindrance. Most definitely turn it off, then fix any routing issues it was masking. I see someone mentioned turning off gratuitous

Re: [j-nsp] Odd issue with ARP in different subnet

2011-03-09 Thread Gordon Smith
Check the default router config. When the server sends the arp request, the router should reply with it's own MAC address Does it not have a route back to the switch? On Wed, 9 Mar 2011 09:43:43 -0600, Chris Adams wrote: I have run into an odd issue with ARP on an EX switch that I think is

Re: [j-nsp] Odd issue with ARP in different subnet

2011-03-09 Thread Gordon Smith
wrote: Once upon a time, Gordon Smith gor...@gswsystems.com said: Check the default router config. When the server sends the arp request, the router should reply with it's own MAC address Does it not have a route back to the switch? No, the router isn't proxy ARPing. Let me put some IPs

Re: [j-nsp] JUNOS POLICER

2010-09-02 Thread Gordon Smith
The accept is what is allowing full bandwidth - you never hit the policer. firewall { family inet { filter policer { term 10 { from { source-address { 192.168.10.35/32;