Juniper MX Series - Douglas Richard Hanks Jr. Zabrze

Discover why routers in the Juniper MX Series-with their advanced feature sets and record-breaking scale-are so popular among enterprises and network service providers. This revised and expanded edition shows you step-by-step how to implement high-density, high-speed Layer 2 and Layer 3 Ethernet services, using Router Engine DDoS Protection, Multi-chassis LAG, Inline NAT, IPFLOW, and many other Juniper MX features. This second edition was written by a Senior NOC engineer, whose vast experience with the MX Series is well documented. Each chapter covers a specific Juniper MX vertical and includes review questions to help you test what youve learned. This edition includes new chapters on load balancing and vMX-Juniper MXs virtual instance. Work with Juniper MXs bridging, VLAN mapping, and support for thousands of virtual switches Examine Juniper MX high-availability features and protocols Use Trio Chipsets load balancing features for different types of traffic Explore the benefits and typical use cases of vMX Add an extra layer of security with Junos DDoS protection Create a firewall filter framework that applies filters specific to your network Discover the advantages of hierarchical scheduling Combine Juniper MX routers, using a virtual chassis or Multi-chassis LAG Install network services such as Network Address Translation (NAT) Spis treści: Preface Second Edition Notes No Apologies Book Topology Interface Names Aggregate Ethernet Assignments Layer 2 IPv4 Addressing IPv6 Addressing Whats in This Book? Conventions Used in This Book Safari Books Online How to Contact Us 1. Juniper MX Architecture Junos OS One Junos Software Releases Junos ContinuityJAM Software Architecture Management daemon Routing protocol daemon Periodic packet management daemon Device control daemon Chassis daemon (and friends) Routing Sockets Junos OS Modernization Juniper MX Chassis vMX MX80 MX80 interface numbering MX80-48T interface numbering Midrange MX104 Interface numbering MX240 Interface numbering Full redundancy No redundancy MX480 Interface numbering MX960 Interface numbering Full redundancy No redundancy MX2010 and MX2020 MX2020 architecture Switch fabric board Power supply Air flow Line card compatibility Trio Trio Architecture Trio Generations Buffering Block Lookup Block Hypermode feature Interfaces Block Dense Queuing Block Line Cards and Modules Dense Port Concentrator Modular Port Concentrator MPC1 MPC2 MPC-3D-16X10GE-SFPP MPC3E Multiple Lookup Block architecture Source MAC learning Destination MAC learning Policing MPC4E MPC5E MPC6E NG-MPC2e and NG-MPC3e MPC7e MPC8e MPC9e Packet Walkthrough MPC1 and MPC2 with enhanced queuing MPC3E Modular Interface Card Network Services Switch and Control Board Ethernet Switch Switch Fabric MX Switch Control Board MX SCB and MPC caveats MX240 and MX480 MX960 MX240 and MX480 fabric planes MX960 fabric planes Enhanced MX Switch Control Board With SCBE and redundancy mode enabled With SCBE2 and redundancy mode enabled J-Cell J-Cell format J-Cell flow Request and grant Summary Chapter Review Questions Chapter Review Answers 2. Bridging, VLAN Mapping, IRB, and Virtual Switches Isnt the MX a Router? Layer 2 Networking Ethernet II IEEE 802.1Q IEEE 802.1QinQ Junos Interfaces Interface Bridge Configuration Basic Comparison of Service Provider Versus Enterprise Style Service Provider style Enterprise style Service Provider Interface Bridge Configuration Tagging VLAN tagging vlan-id-range Stacked VLAN tagging Flexible VLAN tagging Encapsulation Ethernet bridge Extended VLAN bridge Flexible Ethernet services Service Provider Bridge Domain Configuration Enterprise Interface Bridge Configuration Interface Mode Access Trunk IEEE 802.1QinQ IEEE 802.1Q and 802.1QinQ combined VLAN Rewrite Service Provider VLAN Mapping Stack Data Structure Stack Operations Stack Operations Map input-vlan-map Tag Count Bridge Domain Requirements Example: Push and Pop Example: Swap-Push and Pop-Swap Bridge Domains Learning Domain Single learning domain Multiple learning domains Bridge Domain Modes Default None All List Single Dual VLAN Normalization and Rewrite Operations Bridge Domain Options MAC table size Global Bridge domain Interface No MAC learning mac-move Show Bridge Domain Commands show bridge domain show bridge mac-table Display bridge statistics Display details for an l2-Learning instance Clear MAC Addresses Specific MAC address Entire bridge domain MAC Accounting Integrated Routing and Bridging IRB Attributes Virtual Switch Configuration VXLAN VXLAN as a Layer 2 Overlay VXLAN on MX Series VXLAN on Trio: case study Summary Chapter Review Questions Chapter Review Answers 3. Stateless Filters, Hierarchical Policing, and Tri-Color Marking Firewall Filter and Policer Overview Stateless Versus Stateful Stateless Stateful Stateless Filter Components Stateless filter types Protocol families Standard filter modes Filter terms The implicit deny-all term Filter matching A word on bit field matching Filter actions Filters Versus Routing Policy Filter Scaling Filter optimization tips Filtering Differences for MPC Versus DPC Filter Operation Stateless Filter Processing Filter actions Terminating actions Nonterminating actions Flow control actions Policing Rate Limiting: Shaping or Policing? Shaping The leaky bucket algorithm The token bucket algorithm Policing Junos Policer Operation Policer parameters A suggested burst size Policer actions Basic policer example Bandwidth policer Logical bandwidth policer Cascaded Policers Single and Two-Rate Three-Color Policers TCM traffic parameters Single-rate traffic parameters Two-rate traffic parameters Color modes for three-color policers Configure single-rate three-color policers srTCM nonconformance Configure two-rate three-color policers trTCM nonconformance Hierarchical Policers Hierarchical policer example Applying Filters and Policers Filter Application Points Loopback filters and RE protection Input interface filters Output interface filters Aggregate or interface specific Filter chaining Filter nesting Forwarding table filters General filter restrictions Applying Policers Junos OS policer types Logical interface policers Filter-evoked logical interface policers Physical interface policers Policing aggregate interfaces (LAG) Policer Context Summary Policer Application Restrictions Advanced Filtering Features Enhanced Filter Mode flexible-match Filter Case study: count DNS query/response packets Fast Lookup Filter Fast filter case study Advanced Filtering Summary Bridge Filtering Case Study Filter Processing in Bridged and Routed Environments Monitor and Troubleshoot Filters and Policers Monitor system log for errors Bridge Family Filter and Policing Case Study Policer definition HTTP filter definition Flood filter Verify proper operation Bridge Filtering Summary Service Provider DDOS Filtering Case Study Summary Chapter Review Questions Chapter Review Answers 4. Routing Engine Protection and DDoS Prevention RE Protection Case Study IPv4 RE Protection Filter IPv6 RE Protection Filter Next-header nesting, the bane of stateless filters The sample IPv6 filter DDoS Protection Case Study The Issue of Control Plane Depletion DDoS Operational Overview Collect some figures Determine your baseline Host-bound traffic classification A gauntlet of policers DDoS Configuration and Operational Verification Disabling and tracing Configure protocol group properties Verify DDoS operation DDoS Case Study The Attack Has Begun! Analyze the nature of the DDoS threat Suspicious Control Flow Detection SCFD Vocabulary Configure Flow Detection Case Study: Suspicious Flow Detection Suspicious Control Flow Detection Summary Mitigate DDoS Attacks BGP Flow-Specification to the Rescue Configure local flow-spec routes Flow-spec algorithm version Validating flow routes Limit flow-spec resource usage Whats New in the World of Flow-Spec? BGP Flow-Specification Case Study Let the Attack Begin! Determine attack details and define flow route Summary Chapter Review Questions Chapter Review Answers 5. Trio Class of Service MX CoS Capabilities Port Versus Hierarchical Queuing MPCs H-CoS and the MX80 CoS Capabilities and Scale Queue and scheduler scaling How many queues per port? Configure four- or eight-queue mode Increasing available bandwidth on rich-queuing MPCs Low queue warnings Trio versus I-Chip/ADPC CoS differences Trio CoS Flow Intelligent Oversubscription The Remaining CoS Packet Flow CoS Processing: Port- and Queue-Based MPCs Switch fabric priority Classification and policing Classification and rewrite on IRB interfaces Egress processing Egress queuing: port or dense capable? Ingress queuing WRED Key Aspects of the Trio CoS Model Independent guaranteed bandwidth and weight Guaranteed versus excess bandwidth and priority handling Trio buffering Trio drop profiles Trio bandwidth accounting Trio shaping granularity Trio MPLS EXP classification and rewrite defaults Trio CoS Processing Summary Hierarchical CoS The H-CoS Reference Model Level 4: Queues Explicit configuration of queue priority and rates Level 3: IFL The guaranteed rate Priority demotion and promotion G-Rate-based priority handling at nodes Per-priority shapingbased demotion at nodes Queue-level priority demotion Level 2: IFL-Sets Remaining traffic profiles Forcing a two-level scheduling hierarchy Level 1: IFD Remaining Remaining example Interface Modes and Excess Bandwidth Sharing PIR characteristics PIR/CIR characteristics Shaper burst sizes Calculating the default burst size Choosing the actual burst size Burst size example Shapers and delay buffers Delay buffer rate and the H-CoS hierarchy Sharing excess bandwidth Scheduler nodes Queues Excess none Excess handling defaults Excess rate and PIR interface mode Excess sharing example Priority-Based Shaping Fabric CoS Control CoS on Host-Generated Traffic Default Routing Engine CoS Dynamic profile overview Dynamic profile linking Dynamic CoS H-CoS Summary Per-VLAN Queuing for Non-Queuing MPCs Per-Unit Scheduler Case Study on MPC4e Per-Unit Scheduling for Non-Q MPC Summary Trio Scheduling and Queuing Scheduling Discipline Scheduler Priority Levels Scheduler to hardware priority mapping Priority propagation Priority promotion and demotion Scheduler Modes Port-level queuing Operation verification: port level Per-unit scheduler Hierarchical scheduler H-CoS and Aggregated Ethernet Interfaces Aggregated ethernet H-CoS modes Schedulers, Scheduler Maps, and TCPs Scheduler maps Configure WRED drop profiles Scheduler feature support Traffic control profiles Overhead accounting on Trio Trio Scheduling and Priority Summary MX Trio CoS Defaults Four Forwarding Classes, but Only Two Queues Default BA and Rewrite Marker Templates MX Trio CoS Defaults Summary Flexible Packet Rewrite Policy Map Summary Predicting Queue Throughput Where to Start? Trio CoS Proof-of-Concept Test Lab A word on ratios Example 1: PIR mode Example 2: CIR/PIR mode Example 3: make a small, wafer-thin configuration change Predicting Queue Throughput Summary CoS Lab Configure Unidirectional CoS Establish a CoS baseline Baseline configuration The scheduler block Select a scheduling mode Apply schedulers and shaping Verify Unidirectional CoS Confirm queuing and classification Use ping to test MF classification Confirm scheduling details Check for any log errors Confirm Scheduling Behavior Match testers layer 2 rate to Trio layer 1 shaping Compute queue throughput: L3 The Layer 3 IFL calculation: maximum The Layer 3 IFL calculation: actual throughput Add H-CoS for Subscriber Access Configure H-CoS Verify H-CoS Verify H-CoS in the data plane Trio CoS Summary Chapter Review Questions Chapter Review Answers 6. MX Virtual Chassis What Is Virtual Chassis? MX-VC Terminology MX-VC Use Case MX-VC Requirements MX-VC Architecture MX-VC kernel synchronization MX-VC Routing Engine failures VC-Mm failure VC-Mb failure VC-Bm failure VC-Bb failure VC-Lm failure VC-Lb failure MX-VC Interface Numbering MX-VC Packet Walkthrough Virtual Chassis Topology Mastership Election Preserving VCP Bandwidth Locality bias details Summary MX-VC Configuration Chassis Serial Number Member ID R1 VCP Interface Routing Engine Groups Virtual Chassis Configuration GRES and NSR R2 VCP Interface Virtual Chassis Verification Virtual chassis topology Revert to Standalone Summary VCP Interface Class of Service VCP Traffic Encapsulation VCP Class of Service Walkthrough Forwarding Classes Schedulers Classifiers Rewrite Rules Final Configuration Verification Summary Chapter Review Questions Chapter Review Answers 7. Trio Load Balancing Junos Load Balancing Overview Per-Prefix Versus Per-Flow Load Balancing Hashing Hash Computation The Next-Hop Junos Load Balancing Summary Trio Load Balancing and Backward Compatibility Host Outbound Load Balancing Configure Per-Family Load Balancing Hash options for IPv4 Increasing entropy for IP tunnels Hash computation for IPv6 Hash computation for MPLS MPLS payload discovery Entropy label support Hash options for MPLS Hash computation for multiservice traffic Family and Enhanced Hash Field Summary What About Multicast? Multicast over ECMP Enable PIM load balancing Advanced Load Balancing The Problem of Polarization Prevent polarization on nonaggregated interfaces AE interfaces have built-in randomness Symmetric Load Balancing Force symmetric balancing on AE Consistent Hashing Configure consistent hashing Verify consistent hashing Adaptive Load Balancing Adaptive load balancing case study ALB operation Configure and verify ALB on LAG interfaces Adaptive load balancing use case for ECMP True per-packet load balancing for ECMP Summary Chapter Review Questions Chapter Review Answers 8. Trio Inline Services What Are Trio Inline Services? J-Flow J-Flow Evolution Inline IPFIX Performance Inline IPFIX Software Architecture Inline IPFIX Configuration IPFIX template types supported Chassis configuration Flow monitoring Sampling instance Firewall filter mode Interface mode Inline IPFIX Verification IPFIX Summary Network Address Translation Types of NAT Services Inline Interface Service Sets Next-hop style service sets Interface style service sets Traffic directions Next-hop style traffic directions Interface style traffic directions Destination NAT Configuration Network Address Translation Summary Tunnel Services Enabling Tunnel Services A Tunneled Packet Walkthrough Tunnel Services Redundancy Inline GRE with Filter-Based Tunnel Case Study: Traffic Mitigation Based on GRE Filter-Based Tunnel Case Study: Interconnect Logical and Physical Routers Tunnel services case study final verification Tunnel Services Summary Port Mirroring Port Mirror Supported Families Port Mirroring Case Study Configuration Port Mirroring Summary Layer 2 Analyzer Layer 2 Analyzer Configuration Layer 2 Analyzer Case Study Layer 2 Analyzer Summary Summary Chapter Review Questions Chapter Review Answers 9. Multi-Chassis Link Aggregation Multi-Chassis Link Aggregation MC-LAG State Overview MC-LAG active-standby mode MC-LAG active-active mode MC-LAG state summary MC-LAG Family Support Multi-Chassis Link Aggregation Versus MX Virtual Chassis MC-LAG Summary Inter-Chassis Control Protocol ICCP Hierarchy ICCP Topology Guidelines How to Configure ICCP ICCP Configuration Guidelines Valid configurations Invalid configurations ICCP Split Brain ICCP Summary MC-LAG Modes Active-Standby Active-Active ICL configuration MAC address synchronization MC-LAG Modes Summary Case Study Logical Interfaces and Loopback Addressing Layer 2 Loop prevention Input feature Output feature Loop prevention verification R1 and R2 Bridging and IEEE 802.1Q IEEE 802.3ad S1 and S2 Bridging and IEEE 802.1Q IEEE 802.3ad Layer 3 Interior gateway protocolIS-IS Bidirectional forwarding detection Virtual Router Redundancy Protocol MC-LAG Configuration ICCP R1 and R2 R3 and R4 ICCP verification Multi-chassis aggregated ethernet interfaces R1 and R2 R3 and R4 Connectivity Verification Intradata center verification Interdata center verification Case Study Summary Summary Chapter Review Questions Chapter Review Answers 10. Junos High Availability on MX Routers Junos High-Availability Feature Overview Graceful Routing Engine Switchover The GRES Process Synchronization Routing Engine switchover What can I expect after a GRES? Configure GRES GRES options Disk fail Process failure-induced switchovers Verify GRES operation GRES, before and after GRES and software upgrade/downgrades GRES Summary Graceful Restart GR Shortcomings Graceful Restart Operation: OSPF Restarting router Grace LSA Helper router Aborting GR A graceful restart, at last A fly in the ointmentand an improved GR for OSPF OSPF restart signalingRFCs 4811, 4812, and 4813 Graceful Restart and Other Routing Protocols Junos GR support by release Configure and Verify OSPF GR Enable graceful restart globally OSPF GR options Verify OSPF GR An ungraceful restart A graceful restart Graceful Restart Summary Nonstop Routing and Bridging Replication, the Magic That Keeps Protocols Running Nonstop Bridging NSB only replicates Layer 2 state NSB and other Layer 2 functions Current NSR/NSB Support BFD and NSR/GRES support BFD and GRthey dont play well together NSR and BGP NSR and PIM PIM supported features PIM unsupported features NSR and RSVP-TE LSPs This NSR Thing Sounds Cool: So What Can Go Wrong? NSR, the good . . . . . . And the bad Practicing safe NSRs The preferred way to induce switchovers Other switchover methods Tips for a hitless (and happy) switchover Configure NSR and NSB NSR and graceful restart: not like peanut butter and chocolate General NSR debugging tips Verify NSR and NSB Confirm pre-NSR protocol state Confirm pre-NSR replication state BGP replication IS-IS replication Confirm BFD replication Layer 2 NSB verification Perform an NSR Troubleshoot an NSR/NSB problem NSR Summary In-Service Software Upgrades ISSU Operation ISSU dark windows BFD and the dark window ISSU Layer 3 Protocol Support ISSU Layer 2 Support ISSU: A Double-Edged Knife ISSU restrictions ISSU troubleshooting tips ISSU Summary ISSU Lab Verify ISSU Readiness Perform an ISSU Confirm ISSU Summary Chapter Review Questions Chapter Review Answers 11. The Virtual MX Why Use vMX and for What Purpose? Physical or Virtual Benefits of Using vMX Assure service agility Design for cost-effective redundancy Capture more sales and market opportunities Independently scale functions and upgrade capacity without disruption Routers and appliances are hardware bound Expand while containing risk Putting it all together Deployments to Use with vMX A Technical Overview of vMX Several vMX Instances per Server Network Virtualization Techniques for vMX vMX Licensing Summary vMX and the Virtual World Virtualization Concepts What is virtualization? Hardware virtualization versus paravirtualization The virtual network interfaces Software acceleration for dataplane Summary Resources for Installing vMX for Lab Simulation vMX Initial Configuration Technical Details of the vMX VCP/VFP Architecture A word about CPU pinning and CPU affinity vMX Packet Walkthrough The vMX QoS Model Summary Chapter Review Questions Chapter Review Answers Index