Junos Switching Basics

Transcription

1 Lab Guide Worldwide Education Services 1194 North Mathilda Avenue Sunnyvale, CA USA Course Number: SSEX03

2 This document is produced by Juniper Networks, Inc. This document or any part thereof may not be reproduced or transmitted in any form under penalty of law, without the prior written permission of Juniper Networks Education Services. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Junos Switching Basics Lab Guide, Revision A Copyright 2010, Juniper Networks, Inc. All rights reserved. Printed in USA. The information in this document is current as of the date listed above. The information in this document has been carefully verified and is believed to be accurate for software Release 10.0R1.8. Juniper Networks assumes no responsibilities for any inaccuracies that may appear in this document. In no event will Juniper Networks be liable for direct, indirect, special, exemplary, incidental or consequential damages resulting from any defect or omission in this document, even if advised of the possibility of such damages. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. YEAR 2000 NOTICE Juniper Networks hardware and software products do not suffer from Year 2000 problems and hence are Year 2000 compliant. The Junos operating system has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year SOFTWARE LICENSE The terms and conditions for using Juniper Networks software are described in the software license provided with the software, or to the extent applicable, in an agreement executed between you and Juniper Networks, or Juniper Networks agent. By using Juniper Networks software, you indicate that you understand and agree to be bound by its license terms and conditions. Generally speaking, the software license restricts the manner in which you are permitted to use the Juniper Networks software, may contain prohibitions against certain uses, and may state conditions under which the license is automatically terminated. You should consult the software license for further details.

3 Contents Lab 0: Introduction to the Juniper Networks Virtual Lab Part 1: Accessing the Virtual Lab Homepage Part 2: Accepting the EULA Part 3: Logging in to the TrueLab Manager Part 4: Selecting Your Time Zone Part 5: Creating an On-Demand Session Part 6: Creating a Dynamic Session (If the On-Demand Session Is Unavailable) Part 7: Starting the Session Part 8: Additional Information and Feedback Lab 1: Configuring and Monitoring Interfaces Part 1: Configuring Interfaces and Verifying Operational State Part 2: Configure an Aggregated Ethernet Interface Part 3: Deactivate and Reactivate an Interface Lab 2: Configuring and Monitoring Layer 2 Switching Part 1: Configure Access and Trunk Ports Part 2: Monitor Switching Operations Part 3: Configure an RVI Lab 3: Configuring Stateless Firewall Filters Part 1: Establish a Baseline of Operations Part 2: Configure and Monitor Stateless Firewall Filters Lab 4: Virtual Chassis Systems Part 1: Loading a Predefined Configuration Part 2: Configuring Virtual Chassis Parameters Part 3: Monitoring Virtual Chassis Operation Part 4: Restoring Standalone Switch Functionality Contents iii

4 iv Contents

5 Course Overview Objectives Intended Audience The new enterprise Ethernet switching features of the Junos OS now make it possible to operate Juniper Networks enterprise switches with the same operating system you already use to manage the routers on your network. In this course, we focus on EX Series switches and the Layer 2 configuration syntax that provides enterprises the ability to quickly configure Layer 2 features most appropriate for the enterprise environment. The course covers the following topics: Interface Configuration; Switching Configuration; Monitoring; Security; and Virtual Chassis. This program is designed to teach network engineers who have experience configuring and managing Ethernet switches using Cisco's IOS how to use the new enterprise Ethernet switching features of the Junos OS on EX Series devices.. Course Overview v

6 Document Conventions CLI and GUI Text Frequently throughout this course, we refer to text that appears in a command-line interface (CLI) or a graphical user interface (GUI). To make the language of these documents easier to read, we distinguish GUI and CLI text from chapter text according to the following table. Style Description Usage Example Franklin Gothic Courier New Normal text. Console text: Screen captures Noncommand-related syntax GUI text elements: Menu names Text field entry Most of what you read in the Lab Guide and Student Guide. commit complete Exiting configuration mode Select File > Open, and then click Configuration.conf in the Filename text box. Input Text Versus Output Text You will also frequently see cases where you must enter input text yourself. Often this will be shown in the context of where you must enter it. We use bold style to distinguish text that is input versus text that is simply displayed. Style Description Usage Example Normal CLI Normal GUI CLI Input GUI Input No distinguishing variant. Text that you must enter. Physical interface:fxp0, Enabled View configuration history by clicking Configuration > History. lab@san_jose> show route Select File > Save, and enter config.ini in the Filename field. vi Document Conventions

7 Defined and Undefined Syntax Variables Finally, this course distinguishes between regular text and syntax variables, and it also distinguishes between syntax variables where the value is already assigned (defined variables) and syntax variables where you must assign the value (undefined variables). Note that these styles can be combined with the input style as well. Style Description Usage Example CLI Variable GUI variable CLI Undefined GUI Undefined Text where variable value is already assigned. Text where the variable s value is the user s discretion and text where the variable s value as shown in the lab guide might differ from the value the user must input. policy my-peers Click my-peers in the dialog. Type set policy policy-name. ping 10.0.x.y Select File > Save, and enter filename in the Filename field. Document Conventions vii

8 Additional Information Education Services Offerings About This Publication Technical Publications Juniper Networks Support You can obtain information on the latest Education Services offerings, course dates, and class locations from the World Wide Web by pointing your Web browser to: The Junos Switching Basics Lab Guide was developed and tested using software Release 10.0R1.8. Previous and later versions of software might behave differently so you should always consult the documentation and release notes for the version of code you are running before reporting errors. This document is written and maintained by the Juniper Networks Education Services development team. Please send questions and suggestions for improvement to You can print technical manuals and release notes directly from the Internet in a variety of formats: Go to Locate the specific software or hardware release and title you need, and choose the format in which you want to view or print the document. Documentation sets and CDs are available through your local Juniper Networks sales office or account representative. For technical support, contact Juniper Networks at support/, or at JTAC (within the United States) or (from outside the United States). viii Additional Information

9 Lab 0 Introduction to the Juniper Networks Virtual Lab Overview This lab shows the basic procedures for how to access the Juniper Networks Virtual Lab (vlab) using a standard Web browser. The Purpose of the Virtual Labs The Virtual Labs help partners receive hands-on training through a virtual portal which is available 24 hours a day, 7 days a week. This is not a simulator, but live equipment to promote learning and development for interested partners to the Juniper Networks Partner Learning Academy. JNSS labs are an online class with a series of modules and lab exercises to assist a student to become proficient at installing, configuring, and troubleshooting Juniper products. Each course design takes approximately 8 hours to complete. Once connected to the JNSS site, you will need to register (with a valid address) and then log in. Access is granted on a first come, first served basis through the training section of the Partner Center. The Virtual Labs (vlabs) are also available for dedicated Leader Led courses on an as needed basis. The system will check to see if one of the selected labs is available. If a vlab is available, access is granted. If no lab is available, you will be asked to try again later. Each of the vlabs is duplicated multiple times. In the case of the Router/Firewall lab there are extra cross connects between the labs so that in a classroom environment they can be connected in interesting network topologies. Note We recommend that you download and read the lab details and guides associated with each of the corresponding labs. These details and guides provide passwords to access the equipment. Introduction to the Juniper Networks Virtual Lab Lab 0 1

10 Part 1: Accessing the Virtual Lab Homepage The first step in accessing the Virtual Lab is to login to the Virtual Lab homepage. To access the Virtual Lab home page, copy and paste the below URL into a browser window: Part 2: Accepting the EULA You will need to accept the End User License Agreement to log in and begin your work in the Virtual Lab. Part 3: Logging in to the TrueLab Manager If you are already logged in to the Partner Learning Academy on the Juniper Partner Center, you will not need to log in to TrueLab Manager. However, if you are not logged in to the Partner Center, you can log in on this screen. Lab 0 2 Introduction to the Juniper Networks Virtual Lab

11 Part 4: Selecting Your Time Zone Next, you must specify a time zone. Once your correct time zone has been specified, click Update in the bottom left corner of the screen. Step 4.1 You can modify your user name, password, and time zone if necessary by clicking on the Profile tab. Once you have made the updates, you must click Update to save these changes. Introduction to the Juniper Networks Virtual Lab Lab 0 3

12 Part 5: Creating an On-Demand Session You will then create a session under the Sessions tab and select the lab that you want to use. First, identify the correct row for your course under the Event heading. Next, select the course title from the Purpose drop down menu under the Session Information column and click Open. Note Click the View Event Details link under each Event description to access the course lab guide and credentials. Lab 0 4 Introduction to the Juniper Networks Virtual Lab

13 Part 6: Creating a Dynamic Session (If the On-Demand Session Is Unavailable) To reserve a dynamic session, first identify the correct row for your course under the Event heading. Next, select the course title from the Purpose drop down menu under the Session Information column and the lab you want to schedule under the Lab Option drop down menu. Click Reserve to schedule a session. Introduction to the Juniper Networks Virtual Lab Lab 0 5

14 Step 6.1 Click Start Session Now. Step 6.2 Click Finish to return to the Sessions tab. Note The system will send you a reminder prior to your session start time. Part 7: Starting the Session Once the Start Session Now link has been clicked (under the session link), you will be prompted to click OK to continue and log in. Lab 0 6 Introduction to the Juniper Networks Virtual Lab

15 Note Each session can be a maximum of 3 hours. Step 7.1 Click OK to see the following screen. Note Do not close the browser window. Closing your browser window will disconnect your Virtual Lab session connected. Introduction to the Juniper Networks Virtual Lab Lab 0 7

16 Step 7.2 Once you have an active session, you will see the following virtual desktop screen. On this virtual desktop, you must double-click on the Secure CRT icon to begin your lab. Note The Help tab also has links to the related course lab guide and vlab environment help guides. Lab 0 8 Introduction to the Juniper Networks Virtual Lab

17 Step 7.3 Choose the device you will be working with in the Secure CRT session and click Connect. Note Make sure that you consult your lab guide before opening any of the VT100 terminal sessions. Part 8: Additional Information and Feedback Connection Test You can test your ability to connect by navigating to Virtual Lab Support For support, please call ( if outside North America) Go to: Or send an to Feedback If you would like to provide feedback on ways we can improve your vlab experience, please an to STOP Introduction to the Juniper Networks Virtual Lab Lab 0 9

18 Lab 0 10 Introduction to the Juniper Networks Virtual Lab

19 Lab 1 Configuring and Monitoring Interfaces Overview In this lab, you use the CLI to perform basic interface configuration. By completing this lab, you will perform the following tasks: Perform basic interface configuration. Configure an aggregated Ethernet interface. Deactivate and reactivate an interface. Configuring and Monitoring Interfaces Lab a.10.1R1.8

20 Part 1: Configuring Interfaces and Verifying Operational State Step 1.1 The objective of this lab part is to perform interface configuration and verify the operational state of interfaces using the Junos OS CLI. Access the CLI using SecureCRT. Double click on the SecureCRT 5.0 icon located on the desktop to open the connection manager. Highlight EX1 and click the connect button. Step 1.2 Log in as user lab with the password lab123. switch1-d (ttyu0) login: lab Password: --- JUNOS 10.1R2.8 built :08:08 UTC {master:0 Step 1.3 Issue the show interfaces terse CLI command to check the state of your device s interfaces. {master:0 lab@switch1-d> show interfaces terse Interface Admin Link Proto Local Remote ge-0/0/0 up down ge-0/0/1 up down ge-0/0/2 up down ge-0/0/3 up down ge-0/0/4 up down ge-0/0/5 up down Lab 1 2 Configuring and Monitoring Interfaces

21 ge-0/0/6 up up ge-0/0/7 up up ge-0/0/8 up up ge-0/0/9 up up ge-0/0/10 up up ge-0/0/11 up up ge-0/0/12 up up ge-0/0/13 up up ge-0/0/14 up up ge-0/0/15 up up ge-0/0/16 up down ge-0/0/17 up down ge-0/0/18 up down ge-0/0/19 up down ge-0/0/20 up down ge-0/0/21 up down ge-0/0/22 up down ge-0/0/23 up down xe-0/1/0 up down vcp-0 down down vcp up down vcp-1 down down vcp up down bme0 up up bme up up inet / / /2 tnp 0x10 dsc up up gre up up ipip up up lo0 up up lsi up up me0 up up me0.0 up up inet /27 mtun up up pimd up up pime up up tap up up vlan up up vme up down Notice that several interfaces are up, but only the me0 interface has been configured. The bme0 interface is an internal interface an can safely be ignored. Your output may vary. Step 1.4 Enter configuration mode and navigate to the [edit interfaces] hierarchy. {master:0 configure Entering configuration mode {master:0[edit] edit interfaces Configuring and Monitoring Interfaces Lab 1 3

22 {master:0[edit interfaces] Step 1.5 Configure the lo0.0 interface for layer 3 operations using the IP address referenced in the network diagram for this lab. {master:0[edit interfaces] lab@switch1-d# set lo0 unit 0 family inet address /32 Step 1.6 Configure the ge-0/0/6.0 interface for layer 2 operations. Specify a link-speed of 1Gbps and a duplex setting of full. {master:0[edit interfaces] lab@switch1-d# set ge-0/0/6 unit 0 family ethernet-switching {master:0[edit interfaces] lab@switch1-d# set ge-0/0/6 ether-options link-mode full-duplex {master:0[edit interfaces] lab@switch1-d# set ge-0/0/6 ether-options speed 1g {master:0[edit interfaces] lab@switch1-d# show ge-0/0/6 ether-options { link-mode full-duplex; speed { 1g; unit 0 { family ethernet-switching; Step 1.7 Use the copy command to replicate the configuration associated with the ge-0/0/6 interface to the ge-0/0/7 and ge-0/0/8 interfaces. {master:0[edit interfaces] lab@switch1-d# copy ge-0/0/6 to ge-0/0/7 {master:0[edit interfaces] lab@switch1-d# copy ge-0/0/6 to ge-0/0/8 {master:0[edit interfaces] lab@switch1-d# show ge-0/0/6 { ether-options { link-mode full-duplex; speed { 1g; Lab 1 4 Configuring and Monitoring Interfaces

23 unit 0 { family ethernet-switching; ge-0/0/7 { ether-options { link-mode full-duplex; speed { 1g; unit 0 { family ethernet-switching; ge-0/0/8 { ether-options { link-mode full-duplex; speed { 1g; unit 0 { family ethernet-switching; lo0 { unit 0 { family inet { address /32; me0 { unit 0 { family inet { address /27; Step 1.8 Activate the configuration and issue the run show interfaces terse CLI command to verify the state of the configured interfaces. {master:0[edit interfaces] lab@switch1-d# commit configuration check succeedscommit complete {master:0[edit interfaces] lab@switch1-d# run show interfaces terse Interface Admin Link Proto Local Remote ge-0/0/0 up down Configuring and Monitoring Interfaces Lab 1 5

24 ge-0/0/1 up down ge-0/0/2 up down ge-0/0/3 up down ge-0/0/4 up down ge-0/0/5 up down ge-0/0/6 up up ge-0/0/6.0 up up eth-switch ge-0/0/7 up up ge-0/0/7.0 up up eth-switch ge-0/0/8 up up ge-0/0/8.0 up up eth-switch ge-0/0/9 up up ge-0/0/10 up up ge-0/0/11 up up ge-0/0/12 up up ge-0/0/13 up up ge-0/0/14 up up ge-0/0/15 up up ge-0/0/16 up down ge-0/0/17 up down ge-0/0/18 up down ge-0/0/19 up down ge-0/0/20 up down ge-0/0/21 up down ge-0/0/22 up down ge-0/0/23 up down xe-0/1/0 up down vcp-0 down down vcp up down vcp-1 down down vcp up down bme0 up up bme up up inet / / /2 tnp 0x10 dsc up up gre up up ipip up up lo0 up up lo0.0 up up inet > 0/0 lsi up up me0 up up me0.0 up up inet /27 mtun up up pimd up up pime up up tap up up vlan up up vme up down Lab 1 6 Configuring and Monitoring Interfaces

25 Question: What is the Admin and Link state of the recently configured interfaces? Answer: All configured interfaces should show an Admin and Link state of up, as shown in the sample capture. Step 1.9 Issue the run show interfaces ge-0/0/6 command and answer the question that follows. {master:0[edit interfaces] run show interfaces ge-0/0/6 Physical interface: ge-0/0/6, Enabled, Physical link is Up Interface index: 135, SNMP ifindex: 118 Link-level type: Ethernet, MTU: 1514, Speed: 1000mbps, Duplex: Full-Duplex, BPDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled, Flow control: Enabled, Auto-negotiation: Enabled, Remote fault: Online Device flags : Present Running Interface flags: SNMP-Traps Internal: 0x0 Link flags : None CoS queues : 8 supported, 8 maximum usable queues Current address: 00:19:e2:51:65:86, Hardware address: 00:19:e2:51:65:86 Last flapped : :37:39 UTC (00:02:29 ago) Input rate : 0 bps (0 pps) Output rate : 0 bps (0 pps) Active alarms : None Active defects : None Logical interface ge-0/0/6.0 (Index 65) (SNMP ifindex 509) Flags: SNMP-Traps Encapsulation: ENET2 Input packets : 0 Output packets: 0 Protocol eth-switch Flags: Is-Primary Question: What are the speed and duplex settings according to the displayed output? Answer: The link and speed and duplex settings should show 1000mbps and Full-Duplex respectively. By default, interfaces on EX Series switches auto negotiate speed and duplex as shown in the following output: {master:0[edit interfaces] lab@switch1-d# run show interfaces ge-0/0/0 Physical interface: ge-0/0/0, Enabled, Physical link is Down Configuring and Monitoring Interfaces Lab 1 7

26 Interface index: 129, SNMP ifindex: 125 Link-level type: Ethernet, MTU: 1514, Speed: Auto, Duplex: Auto, BPDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled, Flow control: Enabled, Auto-negotiation: Enabled, Remote fault: Online Device flags : Present Running Interface flags: Hardware-Down SNMP-Traps Internal: 0x0 Link flags : None CoS queues : 8 supported, 8 maximum usable queues Current address: 00:19:e2:51:65:80, Hardware address: 00:19:e2:51:65:80 Last flapped : Never Input rate : 0 bps (0 pps) Output rate : 0 bps (0 pps) Active alarms : LINK Active defects : LINK Part 2: Configure an Aggregated Ethernet Interface Step 2.1 In this part you will use the Junos CLI to configure an aggregated Ethernet interface. Issue the run show interfaces terse match ae command to determine if any aggregated Ethernet interfaces currently exist on your device. {master:0[edit interfaces] lab@switch1-d# run show interfaces terse match ae {master:0[edit interfaces] lab@switch1-d# Question: Does your device currently show any aggregated Ethernet interfaces? Step 2.2 Answer: As indicated in the sample output, your device should not currently show any aggregated Ethernet interfaces. We create a single aggregated Ethernet interface in a subsequent step. Navigate to the [edit chassis] configuration hierarchy and create a single aggregated Ethernet interface. {master:0[edit interfaces] lab@switch1-d# top edit chassis {master:0[edit chassis] lab@switch1-d# set aggregated-devices ethernet device-count 1 {master:0[edit chassis] Lab 1 8 Configuring and Monitoring Interfaces

27 Step 2.3 Activate the configuration and issue the run show interfaces terse match ae command to determine if an aggregated Ethernet interface now exists on your device. {master:0[edit chassis] commit configuration check succeedscommit complete {master:0[edit chassis] run show interfaces terse match ae ae0 up down Question: Does your device show an aggregated Ethernet interface? If so, what is the current link state of that interface? Step 2.4 Answer: As indicated in the sample output, your device should now show a single aggregated Ethernet interface named ae0. The current link state of ae0 should be down. Once you actually define the ae0 interface in the configuration file and associate active member links with ae0, the link state should change to up. You perform these tasks in a subsequent lab step. Return to the [edit interfaces] hierarchy level and configure the ae0.0 interface for layer 2 operations then configure ge-0/0/12 and ge-0/0/13 as member links for the ae0 interface. Activate the configuration changes and issue the run show interfaces terse match ae command. {master:0[edit chassis] lab@switch1-d# top edit interfaces {master:0[edit interfaces] lab@switch1-d# set ae0 unit 0 family ethernet-switching {master:0[edit interfaces] lab@switch1-d# set ge-0/0/12 ether-options 802.3ad ae0 {master:0[edit interfaces] lab@switch1-d# set ge-0/0/13 ether-options 802.3ad ae0 {master:0[edit interfaces] lab@switch1-d# commit configuration check succeedscommit complete {master:0[edit interfaces] lab@switch1-d# run show interfaces terse match ae ge-0/0/12.0 up up aenet --> ae0.0 ge-0/0/13.0 up up aenet --> ae0.0 Configuring and Monitoring Interfaces Lab 1 9

28 ae0 up up ae0.0 up up eth-switch {master:0[edit interfaces] Question: What is the current link state of the ae0 interface? Answer: As indicated in the sample output, the current link state of the ae0 interface should now show up. Part 3: Deactivate and Reactivate an Interface Step 3.1 In this part you will use the Junos OS CLI to deactivate and reactivate an interface. Issue the set ae0 disable command followed by the commit command to administratively disable the referenced interface. {master:0[edit interfaces] set ae0 disable {master:0[edit interfaces] commit configuration check succeedscommit complete Step 3.2 Issue the run show interface ae0 terse command to verify the current state of the referenced interface. {master:0[edit interfaces] run show interfaces ae0 terse Interface Admin Link Proto Local Remote ae0 down down ae0.0 up down eth-switch Question: What is the Admin and Link state of the ae0 interface? Step 3.3 Answer: The ae0 interface should show an Admin and Link state of down, as shown in the sample capture. Re-enable the ae0 interface. Next activate the configuration change and return to operational mode using the commit and-quit command. {master:0[edit interfaces] Lab 1 10 Configuring and Monitoring Interfaces

29 delete ae0 disable {master:0[edit interfaces] commit and-quit configuration check succeedscommit complete Exiting configuration mode {master:0 Step 3.4 Issue the show interfaces ae0 terse command. {master:0 show interfaces ae0 terse Interface Admin Link Proto Local Remote ae0 up up ae0.0 up up eth-switch Question: What is the Admin and Link state of the ae0 interface? Answer: The ae0 interface should once again show an Admin and Link state of up, as shown in the capture. STOP Configuring and Monitoring Interfaces Lab 1 11

30 Lab 1 12 Configuring and Monitoring Interfaces

31 Lab 2 Configuring and Monitoring Layer 2 Switching Overview In this lab, you use the CLI to perform basic VLAN configuration. By completing this lab, you will perform the following tasks: Configure access and trunk ports. Monitor switching operations. Configure a routed VLAN interface (RVI). Configuring and Monitoring Layer 2 Switching Lab a.10.1R1.8

32 Part 1: Configure Access and Trunk Ports Step 1.1 The objective of this lab part is to configure switch ports as access or trunk ports and assign them to their designated VLANs using the Junos OS CLI. Access the CLI using SecureCRT. Double click on the SecureCRT 5.0 icon located on the desktop to open the connection manager. Highlight EX1 and click the connect button. Step 1.2 Log in as user lab with the password lab123. switch1-d (ttyu0) login: lab Password: --- JUNOS 10.1R2.8 built :08:08 UTC {master:0 Step 1.3 Enter Configuration mode using the configure command. {master:0 configure Entering configuration mode {master:0[edit] Lab 2 2 Configuring and Monitoring Layer 2 Switching

33 Step 1.4 Using the load override command, load the file switch1-x_l4_exena.config from the /root/ directory. This will load the basic configuration needed to complete the lab. Use the commit and-quit command to apply the changes and exit configuration mode. {master:0[edit] load override /root/switch1-x_l4_exena.config {master:0[edit] commit configuration check succeedscommit complete {master:0[edit] Step 1.5 Open a new SecureCRT tab and connect to the EX2 device. Enter configuration mode and load the switch2-x_l4_exena.config file from the /root/ directory. Commit the changes and exit when complete. Click File > Connect in Tab from the SecureCRT window. Configuring and Monitoring Layer 2 Switching Lab 2 3

34 Select EX2 from the available devices and click connect Log in as user lab with the password lab123. switch2-d (ttyu0) login: lab Password: --- JUNOS 10.1R2.8 built :08:08 UTC {master:0 Enter configuration mode. {master:0 configure Entering configuration mode {master:0[edit] Load the configuration file and then exit. Exit the device and close the tab and return to the SRX1 device. {master:0[edit] load override /root/switch2-x_l4_exena.config {master:0[edit] commit and-quit configuration check succeedscommit complete Exiting configuration mode {master:0 exit switch2-d (ttyu0) login: Lab 2 4 Configuring and Monitoring Layer 2 Switching

35 Step 1.6 Enter configuration mode and navigate to the [edit vlans] hierarchy level. Consult the network diagram for this lab and define the VLANs designated for your switch. {master:0 configure Entering configuration mode {master:0[edit] edit vlans {master:0[edit vlans] set v10 vlan-id 10 {master:0[edit vlans] set v11 vlan-id 11 {master:0[edit vlans] show v10 { vlan-id 10; v11 { vlan-id 11; {master:0[edit vlans] lab@switch1-d# Step 1.7 Navigate to the [edit interfaces] hierarchy level and deactivate the ae0 interface. {master:0[edit vlans] lab@switch1-d# top edit interfaces {master:0[edit interfaces] lab@switch1-d# deactivate ae0 {master:0[edit interfaces] lab@switch1-d# Step 1.8 Define the ge-0/0/6.0 and ge-0/0/7.0 interfaces as access ports for their respective VLANs. Consult the network diagram as needed for the VLAN names and VLAN-IDs. {master:0[edit interfaces] lab@switch1-d# set ge-0/0/6 unit 0 family ethernet-switching port-mode access {master:0[edit interfaces] lab@switch1-d# set ge-0/0/6 unit 0 family ethernet-switching vlan members v10 {master:0[edit interfaces] lab@switch1-d# set ge-0/0/7 unit 0 family ethernet-switching port-mode access Configuring and Monitoring Layer 2 Switching Lab 2 5

36 {master:0[edit interfaces] set ge-0/0/7 unit 0 family ethernet-switching vlan members v11 {master:0[edit interfaces] lab@switch1-d# show ge-0/0/6 ether-options { link-mode full-duplex; speed { 1g; unit 0 { family ethernet-switching { port-mode access; vlan { members v10; {master:0[edit interfaces] lab@switch1-d# show ge-0/0/7 ether-options { link-mode full-duplex; speed { 1g; unit 0 { family ethernet-switching { port-mode access; vlan { members v11; {master:0[edit interfaces] lab@switch1-d# Step 1.9 Define the ge-0/0/8.0 interface as a trunk port and associate both VLANs defined under the [edit vlans] hierarchy level to this interface. Activate the configuration changes and return to operational mode using the commit and-quit command. {master:0[edit interfaces] lab@switch1-d# set ge-0/0/8 unit 0 family ethernet-switching port-mode trunk {master:0[edit interfaces] lab@switch1-d# set ge-0/0/8 unit 0 family ethernet-switching vlan members v10 {master:0[edit interfaces] lab@switch1-d# set ge-0/0/8 unit 0 family ethernet-switching vlan members v11 Lab 2 6 Configuring and Monitoring Layer 2 Switching

37 {master:0[edit interfaces] show ge-0/0/8 ether-options { link-mode full-duplex; speed { 1g; unit 0 { family ethernet-switching { port-mode trunk; vlan { members [ v10 v11 ]; {master:0[edit interfaces] lab@switch1-d# commit and-quit configuration check succeedscommit complete Exiting configuration mode {master:0 lab@switch1-d> Part 2: Monitor Switching Operations Step 2.1 In this part you will use the Junos CLI to monitor switching operations. Issue the show vlans command to determine the current VLAN designations and which interfaces are assigned to the configured VLANs. {master:0 lab@switch1-d> show vlans Name Tag Interfaces default None v10 10 ge-0/0/6.0*, ge-0/0/8.0* v11 11 ge-0/0/7.0*, ge-0/0/8.0* Question: Which VLANs are listed in the output? Answer: As shown in the output, there are three VLANs listed; the default VLAN and the user-defined VLANs. Your VLANs might vary from those shown in the sample output. Configuring and Monitoring Layer 2 Switching Lab 2 7

38 Question: Which interfaces are associated with the various VLANs? Answer: No interfaces should be associated with the default VLAN. The ge-0/0/6.0 and ge-0/0/8.0 interfaces should be associated with the v10 VLAN. The ge-0/0/7.0 and ge-0/0/8.0 interfaces should be associated with the v11. Question: Why is the ge-0/0/8.0 interface associated with both of the user-defined VLANs? Answer: Remember that the ge-0/0/8.0 interface was defined as a trunk interface and associated with both user-defined VLANs. Question: What does the asterisk (*) next to the listed interfaces indicate? Answer: The asterisk (*) next to the listed interfaces indicates that those interfaces are up and operational. If an interface is down the asterisk is omitted as shown with the ge-0/0/0.0 interface in the following capture: {master:0 lab@switch1-d> show vlans Name Tag Interfaces default None v10 10 ge-0/0/0.0, ge-0/0/6.0*, ge-0/0/8.0* v11 11 ge-0/0/7.0*, ge-0/0/8.0* Step 2.2 Issue the show ethernet-switching interfaces command and answer the question that follows: {master:0 lab@switch1-d> show ethernet-switching interfaces Interface State VLAN members Tag Tagging Blocking ge-0/0/6.0 up v10 10 untagged unblocked ge-0/0/7.0 up v11 11 untagged unblocked ge-0/0/8.0 up v10 10 tagged unblocked v11 11 tagged unblocked Lab 2 8 Configuring and Monitoring Layer 2 Switching

39 Question: What is the current blocking state of the listed interfaces? Answer: The listed interfaces should all be in the unblocked state. If you see a different state, check your configuration. Step 2.3 Issue the show ethernet-switching table command and answer the question that follows: {master:0 lab@switch1-d> show ethernet-switching table Ethernet-switching table: 4 entries, 2 learned VLAN MAC address Type Age Interfaces v10 * Flood - All-members v10 00:26:88:02:74:86 Learn 0 ge-0/0/6.0 v11 * Flood - All-members v11 00:26:88:02:74:87 Learn 0 ge-0/0/7.0 Question: What entries currently exist in your devices Ethernet switching table? Step 2.4 Answer: The answer may vary but you should see at least one Flood entry for each of the listed VLANs. Open a new SecureCRT tab and connect to the SRX1 device. Log in using the lab user account and the password lab123. host1-d (ttyu0) login: lab Configuring and Monitoring Layer 2 Switching Lab 2 9

40 Password: --- JUNOS 10.1R2.8 built :02:14 UTC Step 2.5 From your assigned host, ping both virtual routers attached to your designated switch. Use the Ctrl+C key sequence to stop the ping operation. ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=1.731 ms 64 bytes from : icmp_seq=1 ttl=64 time=7.313 ms 64 bytes from : icmp_seq=2 ttl=64 time=6.238 ms 64 bytes from : icmp_seq=3 ttl=64 time=6.250 ms 64 bytes from : icmp_seq=4 ttl=64 time=6.243 ms ^C ping statistics packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.731/5.555/7.313/1.956 ms lab@host1-d> ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=1.731 ms 64 bytes from : icmp_seq=1 ttl=64 time=7.313 ms 64 bytes from : icmp_seq=2 ttl=64 time=6.238 ms 64 bytes from : icmp_seq=3 ttl=64 time=6.250 ms 64 bytes from : icmp_seq=4 ttl=64 time=6.243 ms ^C ping statistics packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.731/5.555/7.313/1.956 ms Question: Do the ping tests succeed? Step 2.6 Answer: As indicated in the sample output, the ping tests should succeed. If your ping tests do not succeed, check your configuration. Return to the session opened to EX1 and issue the show ethernet-switching table command. {master:0 lab@switch1-d> show ethernet-switching table Ethernet-switching table: 6 entries, 4 learned VLAN MAC address Type Age Interfaces v10 * Flood - All-members v10 00:26:88:02:74:86 Learn 0 ge-0/0/6.0 v10 00:26:88:02:74:90 Learn 0 ge-0/0/8.0 v11 * Flood - All-members v11 00:26:88:02:74:87 Learn 0 ge-0/0/7.0 Lab 2 10 Configuring and Monitoring Layer 2 Switching

41 v11 00:26:88:02:74:90 Learn 0 ge-0/0/8.0 Question: How many table entries are listed on your switch for each of the defined VLANs? Answer: Your switch should show three MAC entries for each of the configured VLANs. You should see a Flood entry and two learned entries for each VLAN. Note that the learned entries do time out so you may need to return to your assigned host device and perform the ping tests again to repopulate the Ethernet switching table. You can consult the network diagram for this lab to view the MAC addresses assigned to the interfaces of the directly connected host and virtual routers. Part 3: Configure an RVI Step 3.1 In this part you will use the Junos OS CLI to configure two RVIs to allow for inter-vlan routing operations. You will then perform some basic verification steps to ensure the RVIs work properly. Return to the session SRX1. From your assigned host device attempt a ping operation to verify reachability between the two virtual routers attached to your switch. Make sure you reference the correct routing instance and use the Ctrl+C key sequence to stop the ping operation. lab@host1-d> show configuration routing-instances vr10 { instance-type virtual-router; interface ge-0/0/6.0; routing-options { static { route /0 next-hop ; vr11 { instance-type virtual-router; interface ge-0/0/7.0; routing-options { static { route /0 next-hop ; lab@host1-d> ping routing-instance vr PING ( ): 56 data bytes ^C ping statistics --- Configuring and Monitoring Layer 2 Switching Lab 2 11

42 5 packets transmitted, 0 packets received, 100% packet loss Question: Does the ping operation between the two virtual routers succeed? If not, can you explain why? Step 3.2 Answer: As shown in the sample capture the ping operation should not succeed. Although the virtual routers have a default gateway defined, as shown in the preceding capture, the gateway address is not yet configured. You will configure two routed VLAN interfaces in the subsequent steps and apply the required gateway addresses to those VLAN interfaces. Return to the EX1 session. On your assigned switch, enter configuration mode and navigate to the [edit interfaces] hierarchy level. {master:0 lab@switch1-d> configure Entering configuration mode {master:0[edit] lab@switch1-d# edit interfaces {master:0[edit interfaces] lab@switch1-d# Step 3.3 Define two RVIs named vlan.<vlan-id>, where <vlan-id> represents the VLAN-ID values assigned to the two user-defined VLANs. Use the IP addresses shown on this lab s network diagram for the RVIs. {master:0[edit interfaces] lab@switch1-d# set vlan unit 10 family inet address /24 {master:0[edit interfaces] lab@switch1-d# set vlan unit 11 family inet address /24 {master:0[edit interfaces] lab@switch1-d# show vlan unit 10 { family inet { address /24; unit 11 { family inet { address /24; Lab 2 12 Configuring and Monitoring Layer 2 Switching

43 Step 3.4 Navigate to the [edit vlans] hierarchy and associate the recently defined RVIs with their respective VLANs. Next activate the configuration changes and return to operational mode using the commit and-quit command. {master:0[edit interfaces] top edit vlans {master:0[edit vlans] set v10 l3-interface vlan.10 {master:0[edit vlans] set v11 l3-interface vlan.11 {master:0[edit vlans] show v10 { vlan-id 10; l3-interface vlan.10; v11 { vlan-id 11; l3-interface vlan.11; {master:0[edit vlans] lab@switch1-d# commit and-quit configuration check succeedscommit complete Exiting configuration mode {master:0 lab@switch1-d> Step 3.5 Issue the show interfaces vlan terse command. {master:0 lab@switch1-d> show interfaces vlan terse Interface Admin Link Proto Local Remote vlan up up vlan.10 up up inet /24 vlan.11 up up inet /24 Question: What is the Admin and Link state of the vlan interfaces? Answer: The vlan interfaces should show an Admin and Link state of up, as shown in the capture. Configuring and Monitoring Layer 2 Switching Lab 2 13

44 Step 3.6 Return to the session SRX1. Use the ping utility to verify reachability between the two virtual routers attached to your switch. Make sure you reference the correct routing instance and use the Ctrl+C key sequence to stop the ping operation. ping routing-instance vr PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=63 time= ms 64 bytes from : icmp_seq=1 ttl=63 time=0.893 ms 64 bytes from : icmp_seq=2 ttl=63 time=0.874 ms 64 bytes from : icmp_seq=3 ttl=63 time=0.889 ms 64 bytes from : icmp_seq=4 ttl=63 time=0.896 ms ^C ping statistics packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.874/30.060/ / ms Question: Does the ping operation between the two virtual routers succeed? Step 3.7 Answer: As shown in the sample capture the ping operation should succeed. Use the exit command to log out of your assigned host device and switch. lab@host1-d> exit {master:0 lab@switch1-d> exit STOP Lab 2 14 Configuring and Monitoring Layer 2 Switching

45 Lab 3 Configuring Stateless Firewall Filters Overview In this lab, you use the CLI to configure and monitor stateless firewall filters. By completing this lab, you will perform the following tasks: Establish a baseline of operations. Configure and monitor stateless firewall filters. Configuring Stateless Firewall Filters Lab a.10.1R1.8

46 Part 1: Establish a Baseline of Operations Step 1.1 The objective of this part is to establish a baseline of operations prior to configuring and applying stateless firewall filters. Access the CLI using SecureCRT. Double click on the SecureCRT 5.0 icon located on the desktop to open the connection manager. Highlight EX1 and click the connect button. Step 1.2 Log in as user lab with the password lab123. switch1-d (ttyu0) login: lab Password: --- JUNOS 10.1R2.8 built :08:08 UTC {master:0 lab@switch1-d> Step 1.3 Enter Configuration mode using the configure command. {master:0 lab@switch1-d> configure Entering configuration mode {master:0[edit] lab@switch1-d# Lab 3 2 Configuring Stateless Firewall Filters

47 Step 1.4 Using the load override command, load the file switch1-x_l7_exena.config from the /root/ directory. This will load the basic configuration needed to complete the lab. Use the commit command to apply the changes. {master:0[edit] load override /root/switch1-x_l7_exena.config {master:0[edit] commit configuration check succeedscommit complete {master:0[edit] Step 1.5 Open a new SecureCRT tab and connect to the EX2 device. Enter configuration mode and load the switch2-x_l7_exena.config file from the /root/ directory. Commit the changes and exit when complete. Click File > Connect in Tab from the SecureCRT window. Configuring Stateless Firewall Filters Lab 3 3

48 Select EX2 from the available devices and click connect Log in as user lab with the password lab123. switch2-d (ttyu0) login: lab Password: --- JUNOS 10.1R2.8 built :08:08 UTC {master:0 Enter configuration mode. {master:0 configure Entering configuration mode {master:0[edit] Load the configuration file and then exit. Exit the device and close the tab. {master:0[edit] load override /root/switch2-x_l7_exena.config {master:0[edit] commit and-quit configuration check succeedscommit complete Exiting configuration mode {master:0 exit switch2-d (ttyu0) login: Lab 3 4 Configuring Stateless Firewall Filters

49 Step 1.6 Open a new SecureCRT tab and connect to the SRX1 device. Log in using the lab user account and the password lab123. Enter configuration mode and load the host1-x_l7_exena.config file from the /cf/root/ directory. Commit the changes when complete. host1-d (ttyu0) login: lab Password: --- JUNOS 10.1R2.8 built :02:14 UTC lab@host1-d> Enter configuration mode. lab@host1-d> configure Entering configuration mode [edit] lab@host1-d# Load the configuration file, then commit the changes and exit configuration mode. [edit] lab@host1-d# load override /cf/root/host1-x_l7_exena.config [edit] lab@host1-d# commit-and quit commit complete Exiting configuration mode lab@host1-d> Step 1.7 Open a new SecureCRT tab and connect to the SRX2 device. Log in using the lab user account and the password lab123. Configuring Stateless Firewall Filters Lab 3 5

50 host2-d (ttyp0) login: lab Password: --- JUNOS 10.1R2.8 built :02:14 UTC Enter configuration mode. configure Entering configuration mode [edit] Load the configuration file and then exit. Exit the device and close the tab and return to the SRX1 device. [edit] load override /cf/root/host2-x_l7_exena.config [edit] commit and-quit commit complete Exiting configuration mode exit host2-d (ttyu0) login: Step 1.8 From your assigned SRX host device, ping both virtual routers attached to your designated switch. Use the IP addresses listed on the network diagram for this lab as the destination addresses. Lab 3 6 Configuring Stateless Firewall Filters

51 ping count 5 PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=1.197 ms 64 bytes from : icmp_seq=1 ttl=64 time=0.861 ms 64 bytes from : icmp_seq=2 ttl=64 time=0.913 ms 64 bytes from : icmp_seq=3 ttl=64 time=1.083 ms 64 bytes from : icmp_seq=4 ttl=64 time=1.105 ms ping statistics packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.861/1.032/1.197/0.125 ms lab@host1-d> ping count 5 PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=3.066 ms 64 bytes from : icmp_seq=1 ttl=64 time=0.903 ms 64 bytes from : icmp_seq=2 ttl=64 time=0.879 ms 64 bytes from : icmp_seq=3 ttl=64 time=0.924 ms 64 bytes from : icmp_seq=4 ttl=64 time=0.925 ms ping statistics packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.879/1.339/3.066/0.863 ms Question: Do the ping tests succeed? Step 1.9 Answer: Yes, the ping tests from your assigned host to the virtual routers attached to your switch should succeed as shown in the sample output. From your assigned host device, attempt to open a telnet session to each of the virtual routers attached to your designated switch. Use the Ctrl+C key sequence to close each session once connectivity is verified. Use the same destination addresses as used in the previous step. lab@host1-d> telnet Trying Connected to Escape character is '^]'. host1-d (ttyp0) login: ^CClient aborted login Connection closed by foreign host. lab@host1-d> telnet Trying Connected to Escape character is '^]'. host1-d (ttyp0) Configuring Stateless Firewall Filters Lab 3 7

52 login: ^CClient aborted login Connection closed by foreign host. Question: Do the telnet sessions connect? Step 1.10 Answer: Yes, the telnet sessions should connect as shown in the sample output. From your assigned host device, attempt to open a SSH session to each of the virtual routers attached to your designated switch. Use the Ctrl+C key sequence to close each session once connectivity is verified. Use the same destination addresses as used in the previous step. lab@host1-d> ssh lab@ 's password: lab@host1-d> ssh lab@ 's password: Question: Do the SSH sessions connect? Answer: Yes, the SSH sessions should connect as shown in the sample output. Note that you may see a slightly different result than that shown in the sample capture. Part 2: Configure and Monitor Stateless Firewall Filters Step 2.1 In this part you will use the Junos CLI to configure and monitor stateless firewall filters. Return to the EX1 device tab. Enter configuration mode and navigate to the [edit firewall family ethernet-switching filter my-filter] hierarchy level in preparation to define a new Layer 2 filter named my-filter. {master:0 lab@switch1-d> configure Entering configuration mode {master:0[edit] lab@switch1-d# edit firewall family ethernet-switching filter my-filter {master:0[edit firewall family ethernet-switching filter my-filter] lab@switch1-d# Lab 3 8 Configuring Stateless Firewall Filters