Re: [j-nsp] BGP timer

2024-04-27 Thread Rolf Hanßen via juniper-nsp
Hello Lee, at least for link flapping issues (but not other session flapping reasons) you could set the hold-time: set interfaces xy hold-time up 30 This would delay the link to come up. kind regards Rolf On 27/04/2024 12:34, Sean Clarke via juniper-nsp wrote: Hi Lee Would Flap Damping

Re: [j-nsp] VRRP for IPv6

2022-01-25 Thread Rolf Hanßen via juniper-nsp
Hello Chris, do you have a loopback filter applied that could drop the packets? kind regards Rolf On 25/01/2022 20:51, Chris Adams via juniper-nsp wrote: I'm trying to add VRRP for IPv6 to a pair of MX150s (that are already running VRRP for IPv4). I've switched from VRRPv2 to VRRPv3, and the

Re: [j-nsp] Junos interface unit disable behavior

2020-12-11 Thread Rolf Hanßen
Hello Muruganandham, as long as the physical interface is up, R1 will have all units up because R1 is not aware that you shut some logical interface on R2. kind regards Rolf > Hi, > > R1 and R2 are connected directly over a xe interface with vlan tagging > enabled. Say there are 10 units in the

Re: [j-nsp] Routing Engine Protection

2020-09-17 Thread Rolf Hanßen
Hi Cristian, did you try to apply a filter on both interfaces, i.e. add some accept-all filter for lo0.0? I read that the lo0.0 filter is also used in the other instances if there is no own filter set, but not if this applies vice-versa (at least it seams to be the case). kind regards Rolf > Hi

Re: [j-nsp] MX204 vs. MX240??

2019-11-09 Thread Rolf Hanßen
Hello Gavin, no, you cannot configured Fusion fpcs that way. regards Rolf > Can't you do: > > https://www.juniper.net/documentation/en_US/junos/topics/topic-map/rate-selectability-configuring.html#id-configuring-rate-selectability-on-mx204-to-enable-different-port-speeds >

Re: [j-nsp] MX204 vs. MX240??

2019-11-09 Thread Rolf Hanßen
Hello, this is really interesting. We have a MX204 (Fusion AD, running Junos 18.4R1) + EX4300 (Fusion SD) running and found out you cannot set the port speed on the RJ45 ports of the EX4300 in that combination. We discussed this 3 months because Juniper wanted to tell us that this is by design be

Re: [j-nsp] Fusion using vMX and vQFX

2019-04-12 Thread Rolf Hanßen
Hi, at least for Fusion Provider Edge it will not. vMX (and MX150) are not supported. kind regard Rolf > Can I do Fusion using vMX and vQFX ? Will it work? > > > > > > -Aaron > ___ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.net

Re: [j-nsp] Old JunOS upgrade path

2019-03-08 Thread Rolf Hanßen
Hi, usually they say not more than 2 major releases in one step (i.e. 13 -> 15 -> 17). kind regards Rolf > Hi > Can I do direct upgrade of JunOS 13.2S to 17.4S ? > Platform is MX80 > Or should I go step by step: i.e: > 13.2 -> 14.1 > 14.1 -> 15.1 > 15.1 -> 16.1 > 16.1 -> 17.1 > 17.1 -> 17.4 > >

Re: [j-nsp] Juniper MPC2E-3D-NG-R-B vs MPC2E-3D-R-B

2018-10-19 Thread Rolf Hanßen
Hello, as far as I see the feature difference is HQoS: https://www.juniper.net/documentation/en_US/release-independent/junos/topics/reference/general/mpc-mx-series-mpc2e-features.html regards Rolf > Hi list, > > Can anyone tell me the differences in scaling or features of the > MPC2E-3D-NG-R-B v

[j-nsp] Use IGP metrics for BGP routes

2018-09-24 Thread Rolf Hanßen
Hello, we run ibgp over ISIS/MPLS (exchanging loopback IPs only) and run BGP loopback to loopback (next-hop self). Can somebody tell me if there is a possibility to use the igp metric for the bgp routes. Let's say I have 2 peerings (AMSIX/DECIX) and some kind of ring network. My network is closer

Re: [j-nsp] "set routing-options protect core" breaks local-preference

2018-09-11 Thread Rolf Hanßen
Hi Adam, I do not agree with your praise for the vm lab. When I think of the last (real) issues in our network or things that fucked up with Software-Upgrades, in most of the cases testing it with an virtual device before would not have helped at all. Some samples: We had 2x MX960 that failed dur

Re: [j-nsp] Junos version to run on EX4550 with 40g module?

2018-08-27 Thread Rolf Hanßen
Hi, we used some EX4550 switches with 40G QSFP and 15.1 software for some time and had no issues at all with them. Don't know which R Realese we used (something from end of 2017 or beginning 2018) before replacing them with 96 Port QFX some months ago. We used them for Layer2 only, so no clue if t

Re: [j-nsp] Convergence time

2018-08-08 Thread Rolf Hanßen
Hi, times will depend on the type of failure. If the upstream router fails but your link does not go down (for example if there is a switch between the routers), you will have a BGP session timeout after 3 minutes (with default config) and then the router starts to change the routes, which can tak

Re: [j-nsp] Mixing v4/v6 neighbors in BGP groups

2018-06-29 Thread Rolf Hanßen
Hi, started with a "everything configured separately" network (on Cisco/Quagga) but now I prefer both together in one group (started with it during a vendor replacement (Cisco to Juniper) and new config from scratch 2 years ago). Because it is easier to handle (shut only one group, do not forget

Re: [j-nsp] Experience with Junos 15.1 on MX960?

2017-12-12 Thread Rolf Hanßen
Hello, we run a pair of MX960/RE-S-X6-64G (without MC-LAG) since a year now with 16.1. In first release we hit 2 bugs, 16.1R4-S2.2 works fine since 6 months. Here also everybody was weeping about the evil new software, in the last year we had several situations we wanted to use working code from t

Re: [j-nsp] EX3400 experiences / software recommendation

2017-12-05 Thread Rolf Hanßen
Hi, we run 6 of them with 15.1X53-D56 (pure layer2 stanmdalone boxes, no specials, out of band management with external firewalling, i.e. without local firewall filters). In opposite to the older releases (first steps with them were cruel, first release was more some kind of "pre-alpha early acce

Re: [j-nsp] RE-S-X6 experience

2017-08-22 Thread Rolf Hanßen
Hello Andrey, we use one pair since December for an new installation running 16.1R4-S2.2 currently. The setup is quite basic stuff without curiosities (full table in inet.0, 3.6M routes in rib, ISIS+BGP, a few VPLS instances, a bit VRRP and a few interface filters). We hit one major bug (PR1240960

Re: [j-nsp] reinject traffic from DDoS filtering device

2017-05-05 Thread Rolf Hanßen
Hello, we (Alex and I work for the same company) are speaking about 2 routers + 1 scrubbing device each location/setup and separated ip aggregates each location. So all routers will have a direct connection to the scrubbing center (in and out) as well as external connections (2-5 logical interface

Re: [j-nsp] reinject traffic from DDoS filtering device

2017-05-05 Thread Rolf Hanßen
Hello, does anyone have experience with a non-VRF solutions? I think about redirecting with an interface filter and a prefix-list to change the routing based on the incoming interface: set firewall family inet filter border-filter term scrubbing from destination-prefix-list redirect-to-scrubbing

Re: [j-nsp] Using IPv4/IPv6 combined filter/policy with layer4 filtering

2017-05-04 Thread Rolf Hanßen
Hello, thank you both for your feedback. Both versions work for me as far as I see. If the 200MBit are included in the total bandwidth does not matter in my case, I just want to make sure a 15GBit ddos to a 1 GBit customer does not impact the 10GBit uplink of the access switch, so I will it be se

[j-nsp] Using IPv4/IPv6 combined filter/policy with layer4 filtering

2017-05-03 Thread Rolf Hanßen
Hello, I am wondering how to combine IPv4 and IPv6 traffic in a single policer together with protocol-specific filtering. Let's say I want to limit ntp traffic to 200MBit and the total logical interface bandwidth to 1GBit. As far as I see I cannot use a single filter for IPv4 and IPv6 because I

Re: [j-nsp] Match multiple bgp communities in a policy with AND condition

2017-04-06 Thread Rolf Hanßen
Hello Serge, this works, but that is exactly the config I would like to avoid. In case of 2 communities this adds a third one, but in case of 2x 10 communities that can be combined this adds 100 additional communities. kind regards Rolf > Hello, > > Have you tried this? > > set policy-options co

Re: [j-nsp] Match multiple bgp communities in a policy with AND condition

2017-04-06 Thread Rolf Hanßen
Hello, please show me an example, maybe I understood wrong. If I just create multiple policies and add them to the import/export statement, they are processed indiviually one after another. This would result in the same OR-behaviour. If this match was the whole policy I could combine 2 terms that

[j-nsp] Match multiple bgp communities in a policy with AND condition

2017-04-06 Thread Rolf Hanßen
Hello, I wanted to match 2 named communities in a policy and I am interested how you solve such things. policy-options { policy-statement xy { from { community [a b]; } } community a members 123:1; community b

[j-nsp] QinQ + STP transport between MX and Catalyst

2016-12-02 Thread Rolf Hanßen
Hello Guys, has anybody out there QinQ running between a MX and a Cisco Catalyst? I need some help with such a setup. We got some MX960 and EX3400 boxes to replace some Cisco 6500. On the EX3400 I got tagged and untagged frames forwarded but no STP packets because EX3400 does not support Layer2 Pr

Re: [j-nsp] Cisco vs Juniper confused

2016-04-16 Thread Rolf Hanßen
Hi, just an idea for networks with small budget that do not want to blackhole the destination but also do not want attack traffic to enter their network: Rent 1 additional ports from each upstream provider and convince the upstream provider to accept /32 routes without exporting them (I know not

[j-nsp] MX480 + RE-S-1300 with more than 1024 VRRP instances possible?

2015-11-26 Thread Rolf Hanßen
Hi, just ran into that issue after creating a customer vlan on a MX480 with RE-S-1300-2048: "Too many VRRP instances on ae0. Maximum allowed is 1024." According to what I can find this looks to me like a global limit and not an ae-specific or RE-specific value: "Note: A maximum of 1024 VRRP inst

[j-nsp] SRX asymmetric routing on WAN side

2015-11-13 Thread Rolf Hanßen
Hi, I have a quite simple setup, SRX with a WAN connection and some LAN stuff. WAN is single-homed. I now want to add a second uplink interface and put it into the existing WAN/untrust zone. So the traffic may flow async (interface point of view) but sync (zone point of view). Will this require an