Juniper Networks J-Series manual

J-series™ Services Router

Administration Guide

Release 9.1

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, California 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-023932-01, Revision 1

Contents

Main J-series Services Router Administration Guide Release 9.1 ii End User License Agreement iii iv Abbreviated Table of Contents Page Table of Contents Part 1 Configuring a Services Router for Administration Page Page Part 2 Monitoring a Services Router Part 3 Managing Services Router Software Part 4 Diagnosing Performance and Network Problems Page Part 5 Index About This Guide Objectives Audience How to Use This Guide To monitor, diagnose, and manage a router, use the J-Web interface or CLI operational mode commands. Document Conventions Table 2 on page xvii defines the notice icons used in this guide. Table 2: Notice Icons Table 3 on page xvii defines the text and syntax conventions used in this guide. Table 3: Text and Syntax Conventions Related Juniper Networks Documentation xviii Table 4: J-series Guides and Related JUNOS Software Publications Table 4: J-series Guides and Related JUNOS Software Publications (continued) xx Documentation Feedback Requesting Technical Support Page Part 1 Configuring a Services Router for Administration Page Chapter 1 Managing User Authentication and Access User Authentication Terms User Authentication Overview User Authentication User Accounts Login Classes Permission Bits Table 7: Permission Bits for Login Classes 6 Table 7: Permission Bits for Login Classes (continued) Denying or Allowing Individual Commands Template Accounts Managing User Authentication with Quick Configuration Adding a RADIUS Server for Authentication Adding a TACACS+ Server for Authentication Configuring System Authentication Adding New Users Managing User Authentication with a Configuration Editor Setting Up RADIUS Authentication Setting Up TACACS+ Authentication Page Configuring Authentication Order Controlling User Access Defining Login Classes Creating User Accounts To create user accounts: Setting Up Template Accounts 18 Creating a Remote Template Account Creating a Local Template Account Recovering the Root Password Page Securing the Console Port 1. 2. 3. 4. 1. Accessing Remote Devices with the CLI Using the telnet Command You can use the CLI telnet command to open a Telnet session to a remote device: 24 Table 19: CLI telnet Command Options Using the ssh Command Table 20: CLI ssh Command Options Configuring Password Retry Limits for Telnet and SSH Access Table 21: Configuring Password Retry Limits for Telnet and SSH Access 2. 3. 5. 4. 3. Page Chapter 2 Setting Up USB Modems for Remote Management USB Modem Terms USB Modem Overview USB Modem Interfaces How a Services Router Initializes USB Modems USB Modem Connection and Configuration Overview Connecting the USB Modem to the Services Router's USB Port Configuring USB Modem Interfaces with a Configuration Editor Configuring a USB Modem Interface (Required) 1. Navigate to the top of the interfaces configuration hierarchy in either the J-Web or CLI configuration editor. 2. 1. 2. 1. Configuring a Dialer Interface (Required) or CLI configuration editor. Configuring Dial-In (Required) USB Modem Configuration on page 42. Table 27: Configuring the Dialer Interface for Dial-In 2. 3. 3. Configuring CHAP on Dialer Interfaces (Optional) Configuration on page 42. 38 Connecting to the Services Router from the User End Configuring a Dial-Up Modem Connection at the User End Connecting to the Services Router from the User End Administering USB Modems Modifying USB Modem Initialization Commands Table 29: Modifying USB Modem Initialization Commands (continued) 1. 2. Resetting USB Modems 1. Enter operational mode in the CLI. 2. To reset the USB modem, enter the following command: Verifying the USB Modem Configuration To verify a USB modem configuration, perform the following tasks: 42 Verifying a USB Modem Interface Chapter 2: Setting Up USB Modems for Remote Management Purpose Verify that the USB modem interface is correctly configured and display the status of the modem. Action From the CLI, enter the show interfaces extensive command. Verifying Dialer Interface Configuration Meaning The output shows a summary of dialer interface information. Verify the following Chapter 2: Setting Up USB Modems for Remote Management information: Verifying Dialer Interface Configuration 45 Page Chapter 3 Configuring SNMP for Network Management SNMP Architecture Management Information Base SNMP Communities SNMP Traps Spoofing SNMP Traps SNMP Health Monitor Configuring SNMP with Quick Configuration SNMP, click Apply. click OK. click Cancel. Table 30: SNMP Quick Configuration Summary (continued) 1. 52 Table 30: SNMP Quick Configuration Summary (continued) Configuring SNMP with a Configuration Editor Defining System Identification Information (Required) Configuring SNMP Agents and Communities (Required) Table 33: Configuring SNMP Agents and Communities 2. 1. 2. 1. Managing SNMP Trap Groups (Required) 2. To configure SNMP trap groups, perform the configuration tasks described in Table 34 on page 57. 56 Controlling Access to MIBs (Optional) Table 35 on page 58. Table 35: Configuring SNMP Views 1. 2. Verifying the SNMP Configuration To verify the SNMP configuration, perform the following verification task. Verifying SNMP Agent Configuration Purpose Verify that SNMP is running and that requests and traps are being properly transmitted. Verifying SNMP Health Monitor Configuration Meaning The output shows a summary of SNMP health monitor alarms and corresponding log entries: limit. 60 Page Page Chapter 4 Configuring the Router as a DHCP Server DHCP Terms Table 36: DHCP Terms DHCP Overview 64 DHCP Options Compatibility with Autoinstallation Conflict Detection and Resolution Interface Restrictions Configuring the DHCP Server with Quick Configuration Page Page Page 3. Enter information into the DHCP Quick Configuration pages, as described in Table 37 on page 70. 4. Click one of the following buttons on the DHCP Quick Configuration page: OK. Cancel. 5. Go on to one of the following procedures: Table 37: DHCP Server Quick Configuration Pages Summary (continued) Configuring the DHCP Server with a Configuration Editor Table 38: Sample DHCP Server Configuration Settings (continued) To configure the Services Router as a DHCP server for a subnet and a single client: Configuration on page 75. 74 Table 39: Configuring the DHCP Server (continued) 1. 2. 1. 2. 3. Verifying a DHCP Server Configuration To verify a DHCP server configuration, perform the following tasks: Displaying a DHCP Server Configuration Purpose Verify the configuration of a DHCP server. Action From the J-Web interface, select Verifying the DHCP Binding Database Verifying DHCP Server Operation Page Displaying DHCP Statistics Page Chapter 5 Configuring Autoinstallation Autoinstallation Terms Autoinstallation Overview Supported Autoinstallation Interfaces and Protocols Typical Autoinstallation Process on a New Services Router Page Configuring Autoinstallation with a Configuration Editor Table 42: Configuring Autoinstallation 2. 1. 2. Verifying Autoinstallation To verify that a Services Router is configured for autoinstallation, perform the following task. Verifying Autoinstallation Status Purpose Display the status of the autoinstallation feature on a Services Router. 86 displayed are correct for the Services Router when it is deployed on the network. Verifying Autoinstallation Status 87 Page Chapter 6 Automating Network Operations and Troubleshooting Defining and Enforcing Configuration Rules with Commit Scripts Commit Script Overview Enabling Commit Scripts Disabling Commit Scripts Automating Network Management and Troubleshooting with Operation Scripts Operation Script Overview Enabling Operation Scripts Executing Operation Scripts Disabling Operation Scripts Running Self-Diagnostics with Event Policies Event Policy Overview Configuring Event Policies Table 45: Configuring Event Policies 2. 4. 96 Page Page Part 2 Monitoring a Services Router Page Chapter 7 Monitoring the Router and Routing Operations Monitoring Terms Monitoring Overview Monitoring Tools Overview Page 104 Filtering Command Output Page Using the Monitoring Tools Monitoring System Properties 108 Page Monitoring System Process Information show system processes commands. Table 49 on page 110 summarizes the output fields in the system process information Table 49: Summary of System Process Information Output Fields 110 Monitoring the Chassis Table 50: Summary of Key Chassis Output Fields (continued) 112 Table 50: Summary of Key Chassis Output Fields (continued) Monitoring the Interfaces Table 51 on page 114 summarizes key output fields in interfaces displays. Table 51: Summary of Key Interfaces Output Fields 114 Table 51: Summary of Key Interfaces Output Fields (continued) Monitoring Routing Information The J-Web interface provides information about routing tables and routing protocols. Monitoring Route Information Table 52 on page 116 summarizes key output fields in the routing information display. Table 52: Summary of Key Routing Information Output Fields 116 Table 52: Summary of Key Routing Information Output Fields (continued) Monitoring BGP Routing Information Table 53 on page 117 summarizes key output fields in the BGP routing display. Table 53: Summary of Key BGP Routing Output Fields Table 53: Summary of Key BGP Routing Output Fields (continued) 118 Table 53: Summary of Key BGP Routing Output Fields (continued) Monitoring OSPF Routing Information Table 54 on page 119 summarizes key output fields in the OSPF routing display. Table 54: Summary of Key OSPF Routing Output Fields Table 54: Summary of Key OSPF Routing Output Fields (continued) Monitoring RIP Routing Information Table 55 on page 120 summarizes key output fields in the RIP routing display. Table 55: Summary of Key RIP Routing Output Fields 120 Table 55: Summary of Key RIP Routing Output Fields (continued) Monitoring DLSw Routing Information Table 56 on page 121 summarizes key routing information output fields in the DLSw routing display. Table 56: Summary of Key DLSw Routing Information Output Fields Table 56: Summary of Key DLSw Routing Information Output Fields (continued) 122 Monitoring Class-of-Service Performance Monitoring CoS Interfaces Table 57: Summary of Key CoS Interfaces Output Fields Monitoring CoS Classifiers show class-of-service classifier Table 58 on page 124 summarizes key output fields for CoS classifiers. Table 58: Summary of Key CoS Classifier Output Fields 124 Monitoring CoS Value Aliases show class-of-service code-point-aliases Table 59 on page 126 summarizes key output fields for CoS value aliases. Table 59: Summary of Key CoS Value Alias Output Fields Monitoring CoS RED Drop Profiles show class-of-service drop-profile Table 60 on page 126 summarizes key output fields for CoS RED drop profiles. Table 60: Summary of Key CoS RED Drop Profile Output Fields 126 Monitoring CoS Forwarding Classes show class-of-service forwarding-class Table 61 on page 128 summarizes key output fields for CoS forwarding classes. Table 61: Summary of Key CoS Forwarding Class Output Fields Monitoring CoS Rewrite Rules show class-of-service rewrite-rules Table 62 on page 128 summarizes key output fields for CoS rewrite rules. Table 62: Summary of Key CoS Rewrite Rules Output Fields 128 Monitoring CoS Scheduler Maps show class-of-service scheduler-map Table 63 on page 129 summarizes key output fields for CoS scheduler maps. Table 63: Summary of Key CoS Scheduler Maps Output Fields Table 63: Summary of Key CoS Scheduler Maps Output Fields (continued) Monitoring MPLS Traffic Engineering Information 130 Monitoring MPLS Interfaces Monitoring MPLS LSP Information Table 65: Summary of Key MPLS LSP Information Output Fields (continued) Monitoring MPLS LSP Statistics show mpls lsp statistics 132 Table 66: Summary of Key MPLS LSP Statistics Output Fields Monitoring RSVP Session Information show rsvp session Table 67 on page 133 summarizes key output fields in the RSVP session information Table 67: Summary of Key RSVP Session Information Output Fields Table 67: Summary of Key RSVP Session Information Output Fields (continued) Monitoring MPLS RSVP Interfaces Information show rsvp interface Table 68 on page 134 summarizes key output fields in the RSVP interfaces information Table 68: Summary of Key RSVP Interfaces Information Output Fields 134 Monitoring Service Sets Table 69: Summary of Key Service Set Output Fields Monitoring Firewalls 136 Monitoring Stateful Firewall Statistics services stateful-firewall statistics. Table 70 on page 137 summarizes key output fields for stateful firewall filter statistics. Table 70: Summary of Key Stateful Firewall Statistics Output Fields Table 70: Summary of Key Stateful Firewall Statistics Output Fields (continued) Monitoring Stateful Firewall Filters Table 71 on page 138 summarizes key output fields for stateful firewall filters. Table 71: Summary of Key Stateful Firewall Filters Output Fields 138 Monitoring Firewall Intrusion Detection Services (IDS) Table 73 on page 140 summarizes key output fields for stateful firewall filter intrusion detection. Table 73: Summary of Key Firewall IDS Output Fields Monitoring IPSec Tunnels Table 74 on page 140 summarizes key output fields in IPSec displays. Table 74: Summary of Key IPSec Output Fields 140 Page Table 74: Summary of Key IPSec Output Fields (continued) Monitoring NAT Pools 142 Table 75 on page 143 summarizes key output fields in NAT displays. Monitoring DHCP In addition, you can display the globally configured DHCP settings by using the Table 76 on page 143 summarizes the output fields in DHCP displays. Table 76: Summary of DHCP Output Fields (continued) 144 Monitoring RPM Probes Table 77: Summary of Key RPM Output Fields (continued) 146 Table 77: Summary of Key RPM Output Fields (continued) Monitoring PPP Monitoring PPPoE Page 150 Monitoring the TGM550 Media Gateway (VoIP) Table 79 on page 152 summarizes key output fields in media gateway information displays. Table 79: Summary of Key Media Gateway Information Output Fields 152 Page Page Chapter 8 Monitoring Events and Managing System Log Files System Log Message Terms Table 80: System Log Message Terms (continued) System Log Messages Overview protocol adjacency or a user login into the configuration database unexpected closure of a connection to a child or peer process temperature 156 System Log Message Destinations System Log Facilities and Severity Levels Regular Expressions Table 83: Common Regular Expression Operators and the Terms They Match Before you begin configuring and monitoring system log messages, complete the following tasks: Access Configuration Guide. Configuring System Log Messages with a Configuration Editor Sending System Log Messages to a File Sending System Log Messages to a User Terminal Archiving System Logs Disabling System Logs Monitoring System Log Messages with the J-Web Event Viewer Filtering System Log Messages Table 86: Filtering System Log Messages (continued) Viewing System Log Messages Table 87: Viewing System Log Messages 164 Chapter 9 Configuring and Monitoring Alarms Alarm Terms Alarm Overview Alarm Types Alarm Severity Alarm Conditions Interface Alarm Conditions Table 89: Interface Alarm Conditions 168 Page Table 89: Interface Alarm Conditions (continued) Chassis Alarm Conditions and Corrective Actions 170 Table 90: Chassis Alarm Conditions and Corrective Actions System Alarm Conditions and Corrective Actions Configuring Alarms with a Configuration Editor Page Table 92: Configuring Interface Alarms (continued) 1. 2. 3. Checking Active Alarms Figure 13: J-Web View Alarms Summary Page ERROR: Unresolved graphic fileref="s020252.gif" not found in Table 93 on page 174 summarizes the output fields on the alarms page. Table 93: Summary of Key Alarm Output Fields Verifying the Alarms Configuration To verify alarms configuration, perform the following task. Displaying Alarm Configurations Purpose Verify the configuration of the alarms. Action From the J-Web interface, select [edit] user@host# show chassis alarms t3 { Page Page Page Chapter 10 Performing Software Upgrades and Reboots Upgrade and Downgrade Overview Upgrade Software Packages Recovery Software Packages Downloading Software Upgrades from Juniper Networks Installing Software Upgrades with the J-Web Interface Installing Software Upgrades from a Remote Server Table 95: Install Remote Summary Installing Software Upgrades by Uploading Files Figure 15: Upload Package Page ERROR: Unresolved graphic fileref="s020260.gif" not found in To install software upgrades by uploading files: 1. Download the software package as described in Downloading Software Upgrades Installing Software Upgrades with the CLI Downgrading the Software Downgrading the Software with the J-Web Interface Downgrading the Software with the CLI Configuring Boot Devices Configuring a Boot Device for Backup with the J-Web Interface Figure 16 on page 187 shows the Snapshot page. Figure 16: Snapshot Page ERROR: Unresolved graphic fileref="s020261.gif" not found in To create a boot device: Table 97 on page 187. 188 Configuring a Boot Device for Backup with the CLI Table 98: CLI request system snapshot Command Options Configuring a Boot Device to Receive Software Failure Memory Snapshots Recovering Primary Boot Devices Why Compact Flash Recovery Might Be Necessary Recommended Recovery Hardware and Software Table 100: Recommended Recovery Hardware and Software Configuring Internal Compact Flash Recovery 192 Page Rebooting or Halting a Services Router Rebooting or Halting a Services Router with the J-Web Interface Rebooting a Services Router with the CLI Table 101: CLI Request System Reboot Command Options (continued) Halting a Services Router with the CLI You can use the request system halt CLI command to halt the Services Router: Table 102: CLI Request System Halt Command Options 196 Table 102: CLI Request System Halt Command Options (continued) Page Chapter 11 Managing Files Managing Files with the J-Web Interface Cleaning Up Files Downloading Files Deleting the Backup Software Image Cleaning Up Files with the CLI Managing Accounting Files Encrypting and Decrypting Configuration Files Encrypting Configuration Files Decrypting Configuration Files Modifying the Encryption Key Page Page Page Chapter 12 Using Services Router Diagnostic Tools Diagnostic Terms Diagnostic Tools Overview J-Web Diagnostic Tools Overview CLI Diagnostic Commands Overview Table 106: CLI Diagnostic Command Summary 212 MPLS Connection Checking Table 107: Options for Checking MPLS Connections (continued) 214 General Preparation Ping MPLS Preparation MPLS Enabled Loopback Address Source Address for Probes Pinging Hosts from the J-Web Interface Using the J-Web Ping Host Tool Table 108: J-Web Ping Host Field Summary (continued) Figure 21: Ping Host Results Page ERROR: Unresolved graphic fileref="s020254.gif" not found in Ping Host Results and Output Summary Checking MPLS Connections from the J-Web Interface Using the J-Web Ping MPLS Tool 220 Page Ping MPLS Results and Output Table 111: J-Web Ping MPLS Results and Output Summary 222 Tracing Unicast Routes from the J-Web Interface Using the J-Web Traceroute Tool 5. To stop the traceroute operation before it is complete, click OK while the results of the traceroute operation are being displayed. Figure 23: Traceroute Page ERROR: Unresolved graphic fileref="s020256.gif" not found in Table 112: Traceroute Field Summary 224 Traceroute Results and Output Summary Capturing and Viewing Packets with the J-Web Interface Using J-Web Packet Capture Figure 24: Packet Capture Page ERROR: Unresolved graphic fileref="s020267.gif" not found in Table 114: Packet Capture Field Summary 1. 2. 3. 4. 1. 2. Table 114: Packet Capture Field Summary (continued) 228 Table 114: Packet Capture Field Summary (continued) Packet Capture Results and Output Summary Figure 25: Packet Capture Results Page ERROR: Unresolved graphic fileref="s020268.gif" not found in Table 115: J-Web Packet Capture Results and Output Summary Using CLI Diagnostic Commands Pinging Hosts from the CLI Table 116: CLI ping Command Options (continued) Checking MPLS Connections from the CLI Pinging RSVP-Signaled LSPs and LDP-Signaled LSPs Pinging Layer 3 VPNs Pinging Layer 2 VPNs Table 119: CLI ping mpls l2vpn Command Options Following is sample output from a ping mpls l2vpn command: Pinging Layer 2 Circuits Tracing Unicast Routes from the CLI Using the traceroute Command Table 121: CLI traceroute Command Options (continued) Following is sample output from a traceroute command: Using the traceroute monitor Command 238 To quit the traceroute monitor command, press Q. Table 122: CLI traceroute monitor Command Options Following is sample output from a traceroute monitor command: Table 123 on page 240 summarizes the output fields of the display. Table 123: CLI traceroute monitor Command Output Summary Tracing Multicast Routes from the CLI Use CLI mtrace commands to trace information about multicast paths. The from-source command displays information about a multicast path from a source to 240 Using the mtrace from-source Command Table 124: CLI mtrace from-source Command Options Table 124: CLI mtrace from-source Command Options (continued) DescriptionOption (Optional) Forces the responses to use multicast. multicast-response Following is sample output from the mtrace from-source command: 242 Table 125: CLI mtrace from-source Command Output Summary Using the mtrace monitor Command To monitor and display multicast trace operations, enter the mtrace monitor command: Displaying Log and Trace Files from the CLI Monitoring Interfaces and Traffic from the CLI Using the monitor interface Command Table 128: CLI monitor interface traffic Output Control Keys (continued) ActionKey Displays the Delta column instead of the rate columnin bps or packets per second (pps). r Using the monitor traffic Command 246 Table 129: CLI monitor traffic Command Options Page Page Table 130: CLI monitor traffic Match Conditions (continued) Table 131: CLI monitor traffic Logical Operators Table 132: CLI monitor traffic Arithmetic, Binary, and Relational Operators 250 Table 132: CLI monitor traffic Arithmetic, Binary, and Relational Operators (continued) DescriptionOperator A match occurs if the first expression is not equal to the second. Following is sample output from the monitor traffic command: Page Chapter 13 Configuring Packet Capture Packet Capture Terms Table 133: Packet Capture Terms 1. 2. Packet Capture Overview Packet capture is used by network administrators and security engineers for the following purposes: 254 Packet Capture on Router Interfaces Firewall Filters for Packet Capture Packet Capture Files Analysis of Packet Capture Files Configuring Packet Capture with a Configuration Editor Enabling Packet Capture (Required) Table 134: Enabling Packet Capture 2. 3. 258 Configuring Packet Capture on an Interface (Required) Capture (Optional) on page 259. Configuring a Firewall Filter for Packet Capture (Optional) To configure a firewall filter and apply it to the logical interface: 260 Disabling Packet Capture Deleting Packet Capture Files Changing Encapsulation on Interfaces with Packet Capture Configured Verifying Packet Capture Displaying a Packet Capture Configuration Displaying a Firewall Filter for Packet Capture Configuration Verifying Captured Packets that supports libpcap format. Page Chapter 14 Configuring RPM Probes RPM Terms RPM Overview RPM Probes RPM Tests Probe and Test Intervals Jitter Measurement with Hardware Timestamping RPM Statistics Table 139: RPM Statistics 270 RPM Thresholds and Traps RPM for BGP Monitoring Configuring RPM with Quick Configuration Page Page 274 Page Configuring RPM with a Configuration Editor Configuring Basic RPM Probes Probes on page 279. 278 Configuring TCP and UDP Probes Page Page Tuning RPM Probes 282 Configuring RPM Probes to Monitor BGP Neighbors Configuring RPM Probes for BGP Monitoring Table 144: Configuring RPM Probes to Monitor BGP Neighbors 2. 4. 284 Directing RPM Probes to Select BGP Routers Verifying an RPM Configuration Verifying RPM Services Meaning The output shows the values that are configured for RPM on the Services Router. Verifying RPM Statistics Purpose Verify that the RPM probes are functioning and that the RPM statistics are within expected values. Page Verifying RPM Probe Servers Page Page Index Symbols A B C 292 Page D 294 E F G H 296 I J K L M 298 Page N O 300 P Q R 302 Page S 304 Page 306 T U 308 V W X Y 310