Juniper Networks J-Series manual

J-series™ Services Router Administration Guide

28■ Configuring Password Retry Limits for Telnet and SSH Access

Image 50

Juniper Networks J-Series manual

Contents

Administration Guide North Mathilda Avenue Sunnyvale, California Series Services Router Administration Guide Iii End User License AgreementPage Abbreviated Table of Contents Series Services Router Administration Guide Table of Contents Viii Table of Contents Using the telnet Command Using the ssh CommandModifying USB Modem Initialization Commands Management Information Base Event Policy Overview Configuring Event Policies Configuring Autoinstallation with a Configuration EditorVerifying Autoinstallation Status Part Monitoring a Services Router Part Managing Services Router Software Part Diagnosing Performance and Network Problems Xiii Part Index Audience About This GuideObjectives Objectives Location of J-series Information How to Use This GuideXvi How to Use This Guide Series Tasks Location of Instruction Text and Syntax Conventions Document ConventionsOn page xvii defines the notice icons used in this guide Related Juniper Networks Documentation Web GUI Conventions Related Juniper Networks Documentation Series Guides and Related Junos Software PublicationsGetting Started Guide for Your Router Xx Related Juniper Networks Documentation Series Services Router Administration GuideChapter in a J-series Guide Documentation Feedback Documentation FeedbackRequesting Technical Support Opening a Case with Jtac Xxii Requesting Technical Support Configuring a Services Router for Administration Configuring a Services Router for AdministrationPage System Management Terms Managing User Authentication and AccessUser Authentication Terms User Authentication Overview User Authentication OverviewUser Authentication User Accounts Permission Bits Login ClassesPredefined Login Classes Permission Bits for Login Classes Denying or Allowing Individual Commands Template Accounts To configure a Radius server with Quick Configuration Managing User Authentication with Quick ConfigurationAdding a Radius Server for Authentication Before You Begin Users Quick Configuration for Radius Servers Summary Adding a TACACS+ Server for AuthenticationTo configure a TACACS+ server with Quick Configuration Radius Server Users Quick Configuration for TACACS+ Servers Summary Configuring System AuthenticationTo configure system authentication with Quick Configuration TACACS+ Server Adding New Users To configure users with Quick ConfigurationAdd a User Quick Configuration Page Summary User Information Managing User Authentication with a Configuration Editor Managing User Authentication with a Configuration EditorSetting Up Radius Authentication Setting Up TACACS+ Authentication Setting Up Radius Authentication Set tacplus-server address Setting Up TACACS+ Authentication172.16.98.24 Tacacssecret1 Insert system authentication-order radius Configuring Authentication OrderConfiguring Authentication Order After password Defining Login Classes Controlling User AccessDefining Login Classes EditEdit Configuration Request system reboot Operator-and-boot withOperator-and-boot Creating User Accounts Creating User Accounts Setting Up Template AccountsConfigurationView Set user cmartin class superuser Creating a Remote Template Account Creating a Remote Template Account Creating a Local Template Account Creating a Local Template Account Recovering the Root Password Recovering the Root Password Ok boot -s Securing the Console Port Securing the Console Port Securing the Console Port Accessing Remote Devices with the CLIUsing the telnet Command CLI ssh Command Options Using the ssh CommandCLI telnet Command Options Configuring Password Retry Limits for Telnet and SSH Access Configuring Password Retry Limits for Telnet and SSH Access Edit system login retry-options Configuring Password Retry Limits for Telnet and SSH AccessConfigurationView and EditEdit Configuration Set backoff-thresholdPage USB Modem Terms Setting Up USB Modems for Remote ManagementUSB Modem Terms USB Modem Terminology USB Modem OverviewUSB Modem Interfaces Setting Up USB Modems for Remote Management How a Services Router Initializes USB ModemsSeries Default Modem Initialization Commands Modem Command Description S7=45 On the Services Router USB Modem Connection and Configuration OverviewUSB Modem Connection and Configuration Overview At the User End To configure a USB modem interface for the Services Router Connecting the USB Modem to the Services Routers USB PortConfiguring a USB Modem Interface Required Edit interfaces umd0 Configuring a USB Modem InterfaceConfigurationView EditEdit Configuration S0=0 V1 X4 &C1 E0 Q0 &Q8 %C0 Configuring a Dialer Interface Required Adding a Dialer Interface to a Services Router 172.20.10.2 Configuring Dial-In RequiredEdit unit 172.20.10.1 Configuring the Dialer Interface for Dial-In Configuring Chap on Dialer Interfaces OptionalTo configure Chap on the dialer interface Edit access Configuring Chap on Dialer InterfacesPpp-options chap hierarchy level Web Configuration Editor Edit interfaces dl0 unit Connecting to the Services Router from the User End Connecting to the Services Router from the User EndConfiguring a Dial-Up Modem Connection at the User End USB-modem-connect-and then click Next Advanced TCP/IP Settings page appears Connecting to the Services Router from the User EndAdministering USB Modems Administering USB Modems Modifying USB Modem Initialization Commands Modifying USB Modem Initialization Commands Modifying USB Modem Initialization Commands Resetting USB ModemsVerifying the USB Modem Configuration Configure Verifying a USB Modem Interface Verifying a USB Modem Interface Verifying Dialer Interface Configuration Verifying Dialer Interface Configuration Setting Up USB Modems for Remote Management Series Services Router Administration Guide Snmp Architecture Configuring Snmp for Network ManagementSnmp Architecture Management Information Base Snmp Communities Spoofing Snmp Traps Configuring Snmp for Network ManagementSnmp Traps Snmp Health Monitor Configuring Snmp with Quick Configuration To configure Snmp features with Quick Configuration Communities Snmp Quick Configuration SummaryIdentification Traps Health Monitoring Checks the following key indicators Defining System Identification Information Required Configuring Snmp with a Configuration EditorConfiguring Basic System Identification Set name name Configuring Snmp Agents and Communities RequiredSet description Select Engine id Configuring Snmp Agents and Communities Managing Snmp Trap Groups Required Select the Authentication , Chassis , Controlling Access to MIBs OptionalConfiguring Snmp Trap Groups Click Categories Configuring Snmp Views Verifying the Snmp ConfigurationVerifying Snmp Agent Configuration Verifying Snmp Health Monitor Configuration Verifying Snmp Health Monitor Configuration Series Services Router Administration Guide Configuring Snmp for Network Management Page Dhcp Terms Configuring the Router as a Dhcp ServerDhcp Terms Dhcp Overview Dhcp Terms Configuring the Router as a Dhcp Server Compatibility with AutoinstallationConflict Detection and Resolution Dhcp Options Configuring the Dhcp Server with Quick Configuration Dhcp Quick Configuration Main Configuring the Dhcp Server with Quick Configuration Dhcp Quick Configuration Pool To configure the Dhcp server with Quick Configuration Dhcp Quick Configuration Static Binding Lease Time Dhcp Server Quick Configuration Pages SummaryDhcp Pool Information Server Information Boot Options Dhcp Static Binding Information Settings Sample Value or Values Configuring the Dhcp Server with a Configuration EditorSample Dhcp Server Configuration Settings Dhcp Subnet Configuration Dhcp MAC Address Configuration Configuring the Dhcp Server Entry Ip address Verifying a Dhcp Server ConfigurationDisplaying a Dhcp Server Configuration Verifying the Dhcp Binding Database Verifying the Dhcp Binding Database Verifying Dhcp Server Operation Verifying Dhcp Server Operation User@host ping Displaying Dhcp Statistics Displaying Dhcp StatisticsPage Autoinstallation Terms Configuring AutoinstallationAutoinstallation Terms Autoinstallation Host-specific configuration Autoinstallation OverviewSupported Autoinstallation Interfaces and Protocols Typical Autoinstallation Process on a New Services Router Configuring Autoinstallation Before You Begin Configuring Autoinstallation with a Configuration Editor Configuring Autoinstallation with a Configuration Editor Configuring Autoinstallation Verifying AutoinstallationVerifying Autoinstallation Status ConfigurationView and Edit Edit Configuration Verifying Autoinstallation Status Page Automating Network Operations and Troubleshooting Commit Script Overview Enabling Commit Scripts Var/db/scripts/commit directory Enabling Commit Scripts Commit the configurationDisabling Commit Scripts Operation Script Overview Var/db/scripts/op directory Enabling Operation ScriptsExecuting Operation Scripts Enabling Operation Scripts Disabling Operation Scripts Running Self-Diagnostics with Event PoliciesRunning Self-Diagnostics with Event Policies Configuring Event Policies Event Policy Overview Configure or Edit Configuring Event PoliciesConfiguring Destination for Uploading Files for Analysis Configuring Event Policy Execute the show interfaces Edit then execute-commandsSet output-filename config.txt output-format text Set then Set raise-trapPage Monitoring a Services Router Monitoring a Services RouterPage Monitoring Overview Monitoring the Router and Routing OperationsMonitoring Terms Series Monitoring Terms System Monitoring Tools OverviewMonitor Option Function Chassis CoS Web Monitor Options and Corresponding CLI show CommandsRouting IPSec Corresponding CLI Commands Interfaces-show mpls interfaceShow services nat pool Rsvp Sessions-show rsvp session PPPoE Filtering Command OutputShow services rpm probe-results User@host show configuration match address Show system uptime Show system users Show system storage Using the Monitoring ToolsMonitoring System Properties Summary of Key System Properties Output Fields Set system time-zone command Set system hostname commandName-server command Users CPU Usage Summary of System Process Information Output Fields Show system processes commandsMonitoring System Process Information System Storage Summary of Key Chassis Output Fields Alarm SummaryMonitoring the Chassis Failed Field ValuesEnvironment Information Absent Monitoring the Interfaces FPC Summary Down Summary of Key Interfaces Output FieldsInterface Summary Monitoring Routing Information MTU Summary of Key Routing Information Output Fields Monitoring Route InformationShow route terse Show route detail Summary of Key BGP Routing Output Fields Monitoring BGP Routing InformationShow bgp summary Show bgp neighbor BGP Summary Down to Up BGP Neighbors Ospf Neighbors Monitoring Ospf Routing InformationSummary of Key Ospf Routing Output Fields Ospf Interfaces Summary of Key RIP Routing Output Fields Monitoring RIP Routing InformationShow rip statistics Show rip neighbors Ospf Statistics RIP Neighbors Monitoring DLSw Routing InformationSummary of Key DLSw Routing Information Output Fields DLSw Capabilities DLSw Circuits DLSw Peers Show class-of-service interface interface Monitoring Class-of-Service PerformanceShow class-of-service Monitoring CoS Interfaces Summary of Key CoS Interfaces Output Fields Show class-of-service classifierMonitoring CoS Classifiers Summary of Key CoS Classifier Output Fields Show class-of-service code-point-aliases Monitoring CoS Value Aliases Summary of Key CoS Value Alias Output Fields Show class-of-service drop-profileMonitoring CoS RED Drop Profiles Summary of Key CoS RED Drop Profile Output Fields Show class-of-service forwarding-class Monitoring CoS Forwarding Classes Summary of Key CoS Forwarding Class Output Fields Show class-of-service rewrite-rulesMonitoring CoS Rewrite Rules Summary of Key CoS Rewrite Rules Output Fields Summary of Key CoS Scheduler Maps Output Fields Show class-of-service scheduler-mapMonitoring CoS Scheduler Maps Monitoring Mpls Traffic Engineering Information Show mpls interface Monitoring Mpls InterfacesMonitoring Mpls LSP Information Show mpls lsp Transit Monitoring Mpls LSP StatisticsShow mpls lsp statistics Summary of Key Rsvp Session Information Output Fields Monitoring Rsvp Session InformationShow rsvp session Summary of Key Mpls LSP Statistics Output Fields Summary of Key Rsvp Interfaces Information Output Fields Monitoring Mpls Rsvp Interfaces InformationShow rsvp interface Monitoring Service Sets Static bandwidth X subscription factor Monitoring Firewalls Summary of Key Service Set Output FieldsService Set Summary Monitoring Stateful Firewall Statistics Summary of Key Stateful Firewall Statistics Output Fields Bytes Monitoring Stateful Firewall FiltersSummary of Key Stateful Firewall Filters Output Fields Narrow Search Box Entry or Selection Monitoring Firewall Intrusion Detection Services IDSIDS Search-Narrowing Characteristics Summary of Key Firewall IDS Output Fields Monitoring IPSec TunnelsOn page 140 summarizes key output fields in IPSec displays Summary of Key IPSec Output Fields IKE Security AH+ESPIPSec Statistics Monitoring NAT Pools Hmac-sha1 On page 143 summarizes key output fields in NAT displays Show services nat poolMonitoring Dhcp Summary of Key NAT Output Fields Dhcp Conflicts Dhcp Statistics On page 145 summarizes key output fields in RPM displays Show services rpm probe-resultsMonitoring RPM Probes Summary of Key RPM Output Fields RTT Round-Trip Time for a Probe Monitoring PPP Cumulative Jitter for a Probe PPPoE Interfaces Monitoring PPPoESummary of Key PPPoE Output Fields PPPoE Statistics PPPoE Version Monitoring the TGM550 Media Gateway VoIP Telephony Gateway Module Information Summary of Key Media Gateway Information Output FieldsDynamic Call Admission Control Information DSP Page System Log Message Terms Monitoring Events and Managing System Log FilesSystem Log Message Terms System Log Messages Overview System Logging Facilities System Log Message DestinationsSystem Log Facilities and Severity Levels Regular Expressions System Logging Severity Levels Common Regular Expression Operators and the Terms They Match Regular Expression Operator Matching Terms Sending System Log Messages to a File Configuring System Log Messages with a Configuration EditorSending System Log Messages to a File Edit system syslog Sending Messages to a User Terminal Sending System Log Messages to a User TerminalArchiving System Logs Set user frank any critical Filtering System Log Messages Disabling System LogsMonitoring System Log Messages with the J-Web Event Viewer Filtering System Log Messages CLI command-show system processes Installation and Upgrade Guide Viewing System Log Messages Viewing System Log Messages Configuring and Monitoring Alarms Alarm Terms Alarm Terms Alarm OverviewAlarm Types Interface alarm Interface Alarm Conditions Alarm SeverityAlarm Conditions Configuring and Monitoring Alarms Interface Alarm Conditions Hw-down Pic-hold-resetPic-reset Linkdown Chassis Alarm Conditions and Corrective Actions Corrective Action Alarm Severity Chassis Alarm Conditions and Corrective ActionsComponent Alarm Conditions System Alarm Conditions and Corrective Actions Configuring Alarms with a Configuration EditorSystem Alarm Conditions and Corrective Actions Alarm Type Alarm Condition Corrective Action Configuring Interface Alarms On page 174 summarizes the output fields on the alarms Checking Active AlarmsShow chassis alarms Show system alarms Summary of Key Alarm Output Fields To verify alarms configuration, perform the following task Verifying the Alarms ConfigurationDisplaying Alarm Configurations Edit User@host# show chassis alarms t3 Displaying Alarm Configurations Managing Services Router Software Managing Services Router SoftwarePage Upgrade and Downgrade Overview Performing Software Upgrades and RebootsUpgrade and Downgrade Overview Upgrade Software Packages Recovery Software Packages Performing Software Upgrades and Reboots Downloading Software Upgrades from Juniper NetworksSecondary Storage Devices for Backup Installing Software Upgrades with the J-Web Interface Installing Software Upgrades with the J-Web InterfaceInstalling Software Upgrades from a Remote Server Upload Package Summary Installing Software Upgrades by Uploading FilesInstall Remote Summary User@host request system software add unlink no-copy source Installing Software Upgrades with the CLIInstalling Software Upgrades with the CLI Var/tmp/junos-j-series8.5R2.1.tar.gz Downgrading the Software with the CLI Downgrading the SoftwareDowngrading the Software with the J-Web Interface Downgrading the Software Configuring Boot Devices Configuring Boot DevicesUser@host request system reboot User@host request system software rollback Click OK Snapshot Summary Partitions the boot medium Configuring a Boot Device for Backup with the CLI CLI request system snapshot Command Options Swap-size size Option Description PartitionRoot-size size CLI set system dump-device Command Options Recovering Primary Boot DevicesWhy Compact Flash Recovery Might Be Necessary Recommended Recovery Hardware and Software Recommended Recovery Hardware and SoftwareConfiguring Internal Compact Flash Recovery Recovery Hardware \ physdiskwrite -u junos-jseries-7.0-20041028.0-export-cf512 Rebooting or Halting a Services Router Rebooting or Halting a Services Router Option Description Rebooting a Services Router with the CLICLI Request System Reboot Command Options Halting a Services Router with the CLI CLI Request System Halt Command Options This option is a synonym for the at + minutes option Page Managing Files with the J-Web Interface Cleaning Up FilesManaging Files Downloading Files Managing Files with the J-Web Interface Deleting the Backup Software Image Deleting the Backup Software ImageCleaning Up Files with the CLI Managing Files Managing Accounting Files Managing Accounting Files Gz.jc-for example, juniper.conf.gz.jc Encrypting and Decrypting Configuration FilesEncrypting and Decrypting Configuration Files CLI Command Description Encrypting Configuration FilesRequest system set-encryption-key Commands For example To begin the decryption process, commit the configuration Decrypting Configuration FilesTo begin the encryption process, commit the configuration Modifying the Encryption Key At the second prompt, reenter the new encryption key Diagnosing Performance and Network Problems Diagnosing Performance and Network ProblemsPage Series Diagnostic Terms Using Services Router Diagnostic ToolsDiagnostic Terms Web Interface Diagnose and Manage Options Diagnostic Tools OverviewWeb Diagnostic Tools Overview CLI Diagnostic Commands Overview Manage Options CLI Diagnostic Command Summary Diagnosis and Troubleshooting Options for Checking Mpls Connections Command Function StartMpls Connection Checking Quit VPN prefix Locate LSP usingPing LSP to Layer Ping mpls l3vpn Interface name Instance to which this Ping Mpls Preparation Mpls EnabledGeneral Preparation Loopback Address Web Ping Host Field Summary Using the J-Web Ping Host ToolPinging Hosts from the J-Web Interface Pinging Hosts from the J-Web Interface Ping Host Results Ping Host Result Ping Host Results and Output SummaryWeb Ping Host Results and Output Summary Icmpseq=0 Icmpseq=number Checking Mpls Connections from the J-Web Interface Using the J-Web Ping Mpls ToolChecking Mpls Connections from the J-Web Interface Web Ping Mpls Field Summary Ping LDP-signaled LSPLocate LSP using interface name Ping LSP to Layer 3 VPN prefix Locate LSP from virtual circuit information Instance to which this connection belongsLocate LSP from interface name Ping end point of LSP Field Description Ping Mpls Results and OutputWeb Ping Mpls Results and Output Summary Time To use the traceroute tool Using the J-Web Traceroute ToolTracing Unicast Routes from the J-Web Interface Tracing Unicast Routes from the J-Web Interface Traceroute Traceroute Field Summary Traceroute Results and Output Summary Web Traceroute Results and Output Summary To use J-Web packet capture Using J-Web Packet CaptureCapturing and Viewing Packets with the J-Web Interface Capturing and Viewing Packets with the J-Web Interface Advanced Options Packet Capture Field SummaryGe-0/0/0 Addresses Into hostnames in the packet headers displayed Packet Capture Results and Output Summary Web Packet Capture Results and Output Summary CLI ping Command Options Using CLI Diagnostic CommandsTo quit the ping command, press Ctrl-C Pinging Hosts from the CLI Do-not-fragment Following is sample output from a ping command Checking Mpls Connections from the CLI Pinging RSVP-Signaled LSPs and LDP-Signaled LSPs Following is sample output from a ping mpls command Pinging Layer 3 VPNs Following is sample output from a ping mpls l3vpn commandCLI ping mpls l3vpn Command Options Pinging Layer 2 VPNs Following is sample output from a ping mpls l2vpn commandCLI ping mpls l2vpn Command Options CLI ping mpls l2circuit Command Options Pinging Layer 2 Circuits CLI traceroute Command Options Using the traceroute CommandTo quit the traceroute command, press Ctrl-C Tracing Unicast Routes from the CLI Gateway address Using the traceroute monitor CommandFollowing is sample output from a traceroute command Inet6 On page 240 summarizes the output fields of the display To quit the traceroute monitor command, press QCLI traceroute monitor Command Options CLI traceroute monitor Command Output Summary Tracing Multicast Routes from the CLI Using the mtrace from-source Command CLI mtrace from-source Command Options On page 243 summarizes the output fields of the display Using the mtrace monitor Command CLI mtrace from-source Command Output Summary CLI mtrace monitor Command Output Summary Displaying Log and Trace Files from the CLI CLI monitor interface Output Control Keys Using the monitor interface CommandMonitoring Interfaces and Traffic from the CLI CLI monitor interface traffic Output Control Keys Using the monitor traffic Command User@host monitor interface fe-0/0/0 CLI monitor traffic Command Options Extensive CLI monitor traffic Match ConditionsOption Description Brief Match Condition Description Directional Binary Operator CLI monitor traffic Logical OperatorsArithmetic Operator Relational Operator Following is sample output from the monitor traffic command Page Packet Capture Terms Configuring Packet CapturePacket Capture Terms Packet Capture Overview Packet Capture Terms Firewall Filters for Packet Capture Configuring Packet CapturePacket Capture on Router Interfaces Packet Capture Files Analysis of Packet Capture Files Configuring Packet Capture with a Configuration Editor Enabling Packet Capture Required Enabling Packet Capture Navigate to the Forwarding options Configuring Packet Capture on an Interface Configuring Packet Capture on an Interface RequiredConfiguring a Firewall Filter for Packet Capture Optional 259 192.168.1.1/32 Configuring a Firewall Filter for Packet CaptureEdit firewall Deleting Packet Capture Files Enter set packet-capture disableDisabling Packet Capture 261 Cd /var/tmp Return to the CLI operational modeUser@host start shell Rm pcap-file.fe.0.0.0 Mv pcap-file.fe.0.0.0 pcap-file.fe.0.0.0.chdsl Displaying a Packet Capture ConfigurationVerifying Packet Capture Verifying Packet Capture Verifying Captured Packets Ftp bye Goodbye Edit User@host# Return to the CLI configuration modeFtp lcd /var/tmp Local directory now /cf/var/tmp Verifying Captured Packets Meaning Verify that the output shows the intended packets Configuring RPM Probes RPM Terms RPM target RPM OverviewRPM Probes RPM test Probe and Test Intervals Configuring RPM ProbesRPM Tests Jitter Measurement with Hardware Timestamping Round-Trip Times RPM StatisticsRPM Statistics Inbound and Outbound Times Icmp Timestamp Probes Only RPM for BGP Monitoring Configuring RPM with Quick ConfigurationRPM Thresholds and Traps Performance Probe Owners RPM Quick Configuration SummaryConfiguring RPM with Quick Configuration Router Advanced WAN Access Configuration Guide Maximum Probe Thresholds Generates Snmp traps when the threshold for standard Configuring RPM with a Configuration Editor Configuring RPM with a Configuration EditorConfiguring Basic RPM Probes Performance Probe Server Click Configure Configuring Basic RPM ProbesEdit services rpm Set probe customerA Set test icmp-test probe-frequency Edit services rpm probe customerA192.178.16.5 Set test icmp-test probe-type icmp-ping-timestamp Configuring TCP and UDP Probes Configuring TCP and UDP Probes Router a Configuration Router B Configuration CustomerA Tuning RPM ProbesTuning RPM Probes Set probe-limit Configuring RPM Probes to Monitor BGP Neighbors Configuring RPM Probes for BGP Monitoring Configuring RPM Probes to Monitor BGP Neighbors Directing RPM Probes to Select BGP Routers Verifying an RPM ConfigurationDirecting RPM Probes to Select BGP Routers Add new entry Verifying RPM Statistics Verifying RPM ServicesVerifying RPM Services Verifying RPM Statistics Verifying RPM Probe Servers Verifying RPM Probe Servers Index IndexIndex on Series Services Router Administration Guide Index Symbols 112 Chassis Dd utility, for compact flash recovery 192 Snmp health monitor System logs Dhcp Snmp Junos Internet software Diagnosing problems from 210 Monitoring from 102 See also Snmp Permissions Radius CLI See also RPM probes Preparation Serial number Chassis components BGP TACACS+ Routing Engine, too warm Upgrades Version Hardware, displaying