Manuals / Juniper Networks / Computer Equipment / Network Router

Juniper Networks J-Series manual Series Services Router Administration Guide

Models: J-Series

1 332

Download 332 pages 610 b

Page 6

J-series™ Services Router Administration Guide

vi■

Image 6

Juniper Networks J-Series manual Series Services Router Administration Guide

Contents

Administration Guide North Mathilda Avenue Sunnyvale, CaliforniaSeries Services Router Administration Guide Iii End User License AgreementPage Abbreviated Table of Contents Series Services Router Administration Guide Table of Contents Viii Table of Contents Using the telnet Command Using the ssh CommandModifying USB Modem Initialization Commands Management Information BaseConfiguring Autoinstallation with a Configuration Editor Verifying Autoinstallation StatusEvent Policy Overview Configuring Event Policies Part Monitoring a Services Router Part Managing Services Router Software Part Diagnosing Performance and Network Problems Xiii Part Index Audience About This GuideObjectives ObjectivesLocation of J-series Information How to Use This GuideXvi How to Use This Guide Series Tasks Location of InstructionDocument Conventions On page xvii defines the notice icons used in this guideText and Syntax Conventions Related Juniper Networks Documentation Web GUI ConventionsSeries Guides and Related Junos Software Publications Getting Started Guide for Your RouterRelated Juniper Networks Documentation Series Services Router Administration Guide Chapter in a J-series GuideXx Related Juniper Networks Documentation Documentation Feedback Requesting Technical SupportDocumentation Feedback Opening a Case with Jtac Xxii Requesting Technical SupportConfiguring a Services Router for Administration Configuring a Services Router for AdministrationPage Managing User Authentication and Access User Authentication TermsSystem Management Terms User Authentication Overview User Authentication OverviewUser Authentication User AccountsLogin Classes Predefined Login ClassesPermission Bits Permission Bits for Login Classes Denying or Allowing Individual Commands Template AccountsTo configure a Radius server with Quick Configuration Managing User Authentication with Quick ConfigurationAdding a Radius Server for Authentication Before You BeginUsers Quick Configuration for Radius Servers Summary Adding a TACACS+ Server for AuthenticationTo configure a TACACS+ server with Quick Configuration Radius ServerUsers Quick Configuration for TACACS+ Servers Summary Configuring System AuthenticationTo configure system authentication with Quick Configuration TACACS+ ServerAdding New Users To configure users with Quick ConfigurationAdd a User Quick Configuration Page Summary User InformationManaging User Authentication with a Configuration Editor Setting Up Radius AuthenticationManaging User Authentication with a Configuration Editor Setting Up TACACS+ Authentication Setting Up Radius AuthenticationSet tacplus-server address Setting Up TACACS+ Authentication172.16.98.24 Tacacssecret1Insert system authentication-order radius Configuring Authentication OrderConfiguring Authentication Order After passwordDefining Login Classes Controlling User AccessDefining Login Classes EditEdit ConfigurationRequest system reboot Operator-and-boot withOperator-and-boot Creating User AccountsCreating User Accounts Setting Up Template AccountsConfigurationView Set user cmartin class superuserCreating a Remote Template Account Creating a Remote Template AccountCreating a Local Template Account Creating a Local Template AccountRecovering the Root Password Recovering the Root PasswordOk boot -s Securing the Console Port Securing the Console PortAccessing Remote Devices with the CLI Using the telnet CommandSecuring the Console Port Using the ssh Command CLI telnet Command OptionsCLI ssh Command Options Configuring Password Retry Limits for Telnet and SSH Access Configuring Password Retry Limits for Telnet and SSH AccessEdit system login retry-options Configuring Password Retry Limits for Telnet and SSH AccessConfigurationView and EditEdit Configuration Set backoff-thresholdPage Setting Up USB Modems for Remote Management USB Modem TermsUSB Modem Terms USB Modem Overview USB Modem InterfacesUSB Modem Terminology Setting Up USB Modems for Remote Management How a Services Router Initializes USB ModemsSeries Default Modem Initialization Commands Modem Command Description S7=45On the Services Router USB Modem Connection and Configuration OverviewUSB Modem Connection and Configuration Overview At the User EndConnecting the USB Modem to the Services Routers USB Port Configuring a USB Modem Interface RequiredTo configure a USB modem interface for the Services Router Edit interfaces umd0 Configuring a USB Modem InterfaceConfigurationView EditEdit Configuration S0=0 V1 X4 &C1 E0 Q0 &Q8 %C0Configuring a Dialer Interface Required Adding a Dialer Interface to a Services Router172.20.10.2 Configuring Dial-In RequiredEdit unit 172.20.10.1Configuring Chap on Dialer Interfaces Optional To configure Chap on the dialer interfaceConfiguring the Dialer Interface for Dial-In Edit access Configuring Chap on Dialer InterfacesPpp-options chap hierarchy level Web Configuration Editor Edit interfaces dl0 unitConnecting to the Services Router from the User End Connecting to the Services Router from the User EndConfiguring a Dial-Up Modem Connection at the User End USB-modem-connect-and then click NextAdvanced TCP/IP Settings page appears Connecting to the Services Router from the User EndAdministering USB Modems Administering USB ModemsModifying USB Modem Initialization Commands Modifying USB Modem Initialization CommandsModifying USB Modem Initialization Commands Resetting USB ModemsVerifying the USB Modem Configuration ConfigureVerifying a USB Modem Interface Verifying a USB Modem InterfaceVerifying Dialer Interface Configuration Verifying Dialer Interface ConfigurationSetting Up USB Modems for Remote Management Series Services Router Administration Guide Configuring Snmp for Network Management Snmp ArchitectureSnmp Architecture Management Information Base Snmp CommunitiesSpoofing Snmp Traps Configuring Snmp for Network ManagementSnmp Traps Snmp Health MonitorConfiguring Snmp with Quick Configuration To configure Snmp features with Quick ConfigurationCommunities Snmp Quick Configuration SummaryIdentification TrapsHealth Monitoring Checks the following key indicators Configuring Snmp with a Configuration Editor Configuring Basic System IdentificationDefining System Identification Information Required Set name name Configuring Snmp Agents and Communities RequiredSet description Select Engine idConfiguring Snmp Agents and Communities Managing Snmp Trap Groups RequiredSelect the Authentication , Chassis , Controlling Access to MIBs OptionalConfiguring Snmp Trap Groups Click CategoriesVerifying the Snmp Configuration Verifying Snmp Agent ConfigurationConfiguring Snmp Views Verifying Snmp Health Monitor Configuration Verifying Snmp Health Monitor ConfigurationSeries Services Router Administration Guide Configuring Snmp for Network Management Page Configuring the Router as a Dhcp Server Dhcp TermsDhcp Terms Dhcp Overview Dhcp TermsConfiguring the Router as a Dhcp Server Compatibility with AutoinstallationConflict Detection and Resolution Dhcp OptionsConfiguring the Dhcp Server with Quick Configuration Dhcp Quick Configuration Main Configuring the Dhcp Server with Quick ConfigurationDhcp Quick Configuration Pool To configure the Dhcp server with Quick Configuration Dhcp Quick Configuration Static BindingLease Time Dhcp Server Quick Configuration Pages SummaryDhcp Pool Information Server InformationBoot Options Dhcp Static Binding InformationSettings Sample Value or Values Configuring the Dhcp Server with a Configuration EditorSample Dhcp Server Configuration Settings Dhcp Subnet ConfigurationDhcp MAC Address Configuration Configuring the Dhcp Server EntryVerifying a Dhcp Server Configuration Displaying a Dhcp Server ConfigurationIp address Verifying the Dhcp Binding Database Verifying the Dhcp Binding DatabaseVerifying Dhcp Server Operation Verifying Dhcp Server OperationUser@host ping Displaying Dhcp Statistics Displaying Dhcp StatisticsPage Autoinstallation Terms Configuring AutoinstallationAutoinstallation Terms AutoinstallationAutoinstallation Overview Supported Autoinstallation Interfaces and ProtocolsHost-specific configuration Typical Autoinstallation Process on a New Services Router Configuring AutoinstallationBefore You Begin Configuring Autoinstallation with a Configuration Editor Configuring Autoinstallation with a Configuration EditorConfiguring Autoinstallation Verifying AutoinstallationVerifying Autoinstallation Status ConfigurationView and Edit Edit ConfigurationVerifying Autoinstallation Status Page Automating Network Operations and Troubleshooting Commit Script OverviewEnabling Commit Scripts Var/db/scripts/commit directoryCommit the configuration Disabling Commit ScriptsEnabling Commit Scripts Operation Script Overview Var/db/scripts/op directory Enabling Operation ScriptsExecuting Operation Scripts Enabling Operation ScriptsRunning Self-Diagnostics with Event Policies Running Self-Diagnostics with Event PoliciesDisabling Operation Scripts Configuring Event Policies Event Policy OverviewConfigure or Edit Configuring Event PoliciesConfiguring Destination for Uploading Files for Analysis Configuring Event PolicyExecute the show interfaces Edit then execute-commandsSet output-filename config.txt output-format text Set then Set raise-trapPage Monitoring a Services Router Monitoring a Services RouterPage Monitoring Overview Monitoring the Router and Routing OperationsMonitoring Terms Series Monitoring TermsSystem Monitoring Tools OverviewMonitor Option Function ChassisWeb Monitor Options and Corresponding CLI show Commands RoutingCoS IPSec Corresponding CLI Commands Interfaces-show mpls interfaceShow services nat pool Rsvp Sessions-show rsvp sessionFiltering Command Output Show services rpm probe-resultsPPPoE User@host show configuration match address Show system uptime Show system users Show system storage Using the Monitoring ToolsMonitoring System Properties Summary of Key System Properties Output FieldsSet system time-zone command Set system hostname commandName-server command UsersCPU Usage Summary of System Process Information Output Fields Show system processes commandsMonitoring System Process Information System StorageAlarm Summary Monitoring the ChassisSummary of Key Chassis Output Fields Failed Field ValuesEnvironment Information AbsentMonitoring the Interfaces FPC SummarySummary of Key Interfaces Output Fields Interface SummaryDown Monitoring Routing Information MTUMonitoring Route Information Show route terse Show route detailSummary of Key Routing Information Output Fields Summary of Key BGP Routing Output Fields Monitoring BGP Routing InformationShow bgp summary Show bgp neighbor BGP SummaryDown to Up BGP NeighborsOspf Neighbors Monitoring Ospf Routing InformationSummary of Key Ospf Routing Output Fields Ospf InterfacesSummary of Key RIP Routing Output Fields Monitoring RIP Routing InformationShow rip statistics Show rip neighbors Ospf StatisticsRIP Neighbors Monitoring DLSw Routing InformationSummary of Key DLSw Routing Information Output Fields DLSw CapabilitiesDLSw Circuits DLSw PeersShow class-of-service interface interface Monitoring Class-of-Service PerformanceShow class-of-service Monitoring CoS InterfacesSummary of Key CoS Interfaces Output Fields Show class-of-service classifierMonitoring CoS Classifiers Summary of Key CoS Classifier Output FieldsShow class-of-service code-point-aliases Monitoring CoS Value AliasesSummary of Key CoS Value Alias Output Fields Show class-of-service drop-profileMonitoring CoS RED Drop Profiles Summary of Key CoS RED Drop Profile Output FieldsShow class-of-service forwarding-class Monitoring CoS Forwarding ClassesSummary of Key CoS Forwarding Class Output Fields Show class-of-service rewrite-rulesMonitoring CoS Rewrite Rules Summary of Key CoS Rewrite Rules Output FieldsShow class-of-service scheduler-map Monitoring CoS Scheduler MapsSummary of Key CoS Scheduler Maps Output Fields Monitoring Mpls Traffic Engineering Information Show mpls interface Monitoring Mpls InterfacesMonitoring Mpls LSP Information Show mpls lspMonitoring Mpls LSP Statistics Show mpls lsp statisticsTransit Summary of Key Rsvp Session Information Output Fields Monitoring Rsvp Session InformationShow rsvp session Summary of Key Mpls LSP Statistics Output FieldsMonitoring Mpls Rsvp Interfaces Information Show rsvp interfaceSummary of Key Rsvp Interfaces Information Output Fields Monitoring Service Sets Static bandwidth X subscription factorSummary of Key Service Set Output Fields Service Set SummaryMonitoring Firewalls Monitoring Stateful Firewall Statistics Summary of Key Stateful Firewall Statistics Output FieldsMonitoring Stateful Firewall Filters Summary of Key Stateful Firewall Filters Output FieldsBytes Monitoring Firewall Intrusion Detection Services IDS IDS Search-Narrowing CharacteristicsNarrow Search Box Entry or Selection Summary of Key Firewall IDS Output Fields Monitoring IPSec TunnelsOn page 140 summarizes key output fields in IPSec displays Summary of Key IPSec Output FieldsAH+ESP IPSec StatisticsIKE Security Monitoring NAT Pools Hmac-sha1On page 143 summarizes key output fields in NAT displays Show services nat poolMonitoring Dhcp Summary of Key NAT Output FieldsDhcp Conflicts Dhcp StatisticsOn page 145 summarizes key output fields in RPM displays Show services rpm probe-resultsMonitoring RPM Probes Summary of Key RPM Output FieldsRTT Round-Trip Time for a ProbeMonitoring PPP Cumulative Jitter for a ProbeMonitoring PPPoE Summary of Key PPPoE Output FieldsPPPoE Interfaces PPPoE Statistics PPPoE Version Monitoring the TGM550 Media Gateway VoIP Summary of Key Media Gateway Information Output Fields Dynamic Call Admission Control InformationTelephony Gateway Module Information DSP Page Monitoring Events and Managing System Log Files System Log Message TermsSystem Log Message Terms System Log Messages Overview System Log Message Destinations System Log Facilities and Severity LevelsSystem Logging Facilities Regular Expressions System Logging Severity LevelsCommon Regular Expression Operators and the Terms They Match Regular Expression Operator Matching TermsSending System Log Messages to a File Configuring System Log Messages with a Configuration EditorSending System Log Messages to a File Edit system syslogSending Messages to a User Terminal Sending System Log Messages to a User TerminalArchiving System Logs Set user frank any criticalFiltering System Log Messages Disabling System LogsMonitoring System Log Messages with the J-Web Event Viewer Filtering System Log MessagesCLI command-show system processes Installation and Upgrade GuideViewing System Log Messages Viewing System Log MessagesConfiguring and Monitoring Alarms Alarm TermsAlarm Terms Alarm OverviewAlarm Types Interface alarmInterface Alarm Conditions Alarm SeverityAlarm Conditions Configuring and Monitoring AlarmsInterface Alarm Conditions Hw-down Pic-hold-resetPic-reset LinkdownChassis Alarm Conditions and Corrective Actions Chassis Alarm Conditions and Corrective Actions Component Alarm ConditionsCorrective Action Alarm Severity System Alarm Conditions and Corrective Actions Configuring Alarms with a Configuration EditorSystem Alarm Conditions and Corrective Actions Alarm Type Alarm Condition Corrective ActionConfiguring Interface Alarms On page 174 summarizes the output fields on the alarms Checking Active AlarmsShow chassis alarms Show system alarms Summary of Key Alarm Output FieldsTo verify alarms configuration, perform the following task Verifying the Alarms ConfigurationDisplaying Alarm Configurations Edit User@host# show chassis alarms t3Displaying Alarm Configurations Managing Services Router Software Managing Services Router SoftwarePage Performing Software Upgrades and Reboots Upgrade and Downgrade OverviewUpgrade and Downgrade Overview Upgrade Software Packages Recovery Software PackagesDownloading Software Upgrades from Juniper Networks Secondary Storage Devices for BackupPerforming Software Upgrades and Reboots Installing Software Upgrades with the J-Web Interface Installing Software Upgrades from a Remote ServerInstalling Software Upgrades with the J-Web Interface Installing Software Upgrades by Uploading Files Install Remote SummaryUpload Package Summary User@host request system software add unlink no-copy source Installing Software Upgrades with the CLIInstalling Software Upgrades with the CLI Var/tmp/junos-j-series8.5R2.1.tar.gzDowngrading the Software with the CLI Downgrading the SoftwareDowngrading the Software with the J-Web Interface Downgrading the SoftwareConfiguring Boot Devices Configuring Boot DevicesUser@host request system reboot User@host request system software rollbackClick OK Snapshot SummaryPartitions the boot medium Configuring a Boot Device for Backup with the CLI CLI request system snapshot Command OptionsOption Description Partition Root-size sizeSwap-size size Recovering Primary Boot Devices Why Compact Flash Recovery Might Be NecessaryCLI set system dump-device Command Options Recommended Recovery Hardware and Software Recommended Recovery Hardware and SoftwareConfiguring Internal Compact Flash Recovery Recovery Hardware\ physdiskwrite -u junos-jseries-7.0-20041028.0-export-cf512 Rebooting or Halting a Services Router Rebooting or Halting a Services RouterRebooting a Services Router with the CLI CLI Request System Reboot Command OptionsOption Description Halting a Services Router with the CLI CLI Request System Halt Command OptionsThis option is a synonym for the at + minutes option Page Cleaning Up Files Managing FilesManaging Files with the J-Web Interface Downloading Files Managing Files with the J-Web InterfaceDeleting the Backup Software Image Deleting the Backup Software ImageCleaning Up Files with the CLI Managing FilesManaging Accounting Files Managing Accounting FilesEncrypting and Decrypting Configuration Files Encrypting and Decrypting Configuration FilesGz.jc-for example, juniper.conf.gz.jc CLI Command Description Encrypting Configuration FilesRequest system set-encryption-key Commands For exampleTo begin the decryption process, commit the configuration Decrypting Configuration FilesTo begin the encryption process, commit the configuration Modifying the Encryption KeyAt the second prompt, reenter the new encryption key Diagnosing Performance and Network Problems Diagnosing Performance and Network ProblemsPage Using Services Router Diagnostic Tools Diagnostic TermsSeries Diagnostic Terms Diagnostic Tools Overview Web Diagnostic Tools OverviewWeb Interface Diagnose and Manage Options CLI Diagnostic Commands Overview Manage OptionsCLI Diagnostic Command Summary Diagnosis and TroubleshootingOptions for Checking Mpls Connections Command Function StartMpls Connection Checking QuitVPN prefix Locate LSP usingPing LSP to Layer Ping mpls l3vpn Interface name Instance to which thisPing Mpls Preparation Mpls EnabledGeneral Preparation Loopback AddressWeb Ping Host Field Summary Using the J-Web Ping Host ToolPinging Hosts from the J-Web Interface Pinging Hosts from the J-Web InterfacePing Host Results Ping Host Result Ping Host Results and Output SummaryWeb Ping Host Results and Output Summary Icmpseq=0 Icmpseq=numberUsing the J-Web Ping Mpls Tool Checking Mpls Connections from the J-Web InterfaceChecking Mpls Connections from the J-Web Interface Web Ping Mpls Field Summary Ping LDP-signaled LSPLocate LSP using interface name Ping LSP to Layer 3 VPN prefixLocate LSP from virtual circuit information Instance to which this connection belongsLocate LSP from interface name Ping end point of LSPField Description Ping Mpls Results and OutputWeb Ping Mpls Results and Output Summary TimeTo use the traceroute tool Using the J-Web Traceroute ToolTracing Unicast Routes from the J-Web Interface Tracing Unicast Routes from the J-Web InterfaceTraceroute Traceroute Field SummaryTraceroute Results and Output Summary Web Traceroute Results and Output SummaryTo use J-Web packet capture Using J-Web Packet CaptureCapturing and Viewing Packets with the J-Web Interface Capturing and Viewing Packets with the J-Web InterfacePacket Capture Field Summary Ge-0/0/0Advanced Options Addresses Into hostnames in the packet headers displayed Packet Capture Results and Output Summary Web Packet Capture Results and Output SummaryCLI ping Command Options Using CLI Diagnostic CommandsTo quit the ping command, press Ctrl-C Pinging Hosts from the CLIDo-not-fragment Following is sample output from a ping command Checking Mpls Connections from the CLIPinging RSVP-Signaled LSPs and LDP-Signaled LSPs Following is sample output from a ping mpls commandFollowing is sample output from a ping mpls l3vpn command CLI ping mpls l3vpn Command OptionsPinging Layer 3 VPNs Following is sample output from a ping mpls l2vpn command CLI ping mpls l2vpn Command OptionsPinging Layer 2 VPNs CLI ping mpls l2circuit Command Options Pinging Layer 2 CircuitsCLI traceroute Command Options Using the traceroute CommandTo quit the traceroute command, press Ctrl-C Tracing Unicast Routes from the CLIGateway address Using the traceroute monitor CommandFollowing is sample output from a traceroute command Inet6To quit the traceroute monitor command, press Q CLI traceroute monitor Command OptionsOn page 240 summarizes the output fields of the display CLI traceroute monitor Command Output Summary Tracing Multicast Routes from the CLIUsing the mtrace from-source Command CLI mtrace from-source Command Options On page 243 summarizes the output fields of the displayUsing the mtrace monitor Command CLI mtrace from-source Command Output SummaryCLI mtrace monitor Command Output Summary Displaying Log and Trace Files from the CLICLI monitor interface Output Control Keys Using the monitor interface CommandMonitoring Interfaces and Traffic from the CLI CLI monitor interface traffic Output Control KeysUsing the monitor traffic Command User@host monitor interface fe-0/0/0CLI monitor traffic Command Options Extensive CLI monitor traffic Match ConditionsOption Description Brief Match Condition DescriptionDirectional Binary Operator CLI monitor traffic Logical OperatorsArithmetic Operator Relational OperatorFollowing is sample output from the monitor traffic command Page Configuring Packet Capture Packet Capture TermsPacket Capture Terms Packet Capture Overview Packet Capture TermsConfiguring Packet Capture Packet Capture on Router InterfacesFirewall Filters for Packet Capture Packet Capture Files Analysis of Packet Capture FilesConfiguring Packet Capture with a Configuration Editor Enabling Packet Capture RequiredEnabling Packet Capture Navigate to the Forwarding optionsConfiguring Packet Capture on an Interface Configuring Packet Capture on an Interface RequiredConfiguring a Firewall Filter for Packet Capture Optional 259Configuring a Firewall Filter for Packet Capture Edit firewall192.168.1.1/32 Deleting Packet Capture Files Enter set packet-capture disableDisabling Packet Capture 261Cd /var/tmp Return to the CLI operational modeUser@host start shell Rm pcap-file.fe.0.0.0Mv pcap-file.fe.0.0.0 pcap-file.fe.0.0.0.chdsl Displaying a Packet Capture ConfigurationVerifying Packet Capture Verifying Packet CaptureVerifying Captured Packets Ftp bye Goodbye Edit User@host# Return to the CLI configuration modeFtp lcd /var/tmp Local directory now /cf/var/tmp Verifying Captured PacketsMeaning Verify that the output shows the intended packets Configuring RPM Probes RPM TermsRPM target RPM OverviewRPM Probes RPM testProbe and Test Intervals Configuring RPM ProbesRPM Tests Jitter Measurement with Hardware TimestampingRound-Trip Times RPM StatisticsRPM Statistics Inbound and Outbound Times Icmp Timestamp Probes OnlyConfiguring RPM with Quick Configuration RPM Thresholds and TrapsRPM for BGP Monitoring RPM Quick Configuration Summary Configuring RPM with Quick ConfigurationPerformance Probe Owners Router Advanced WAN Access Configuration Guide Maximum Probe Thresholds Generates Snmp traps when the threshold for standard Configuring RPM with a Configuration Editor Configuring RPM with a Configuration EditorConfiguring Basic RPM Probes Performance Probe ServerClick Configure Configuring Basic RPM ProbesEdit services rpm Set probe customerASet test icmp-test probe-frequency Edit services rpm probe customerA192.178.16.5 Set test icmp-test probe-type icmp-ping-timestampConfiguring TCP and UDP Probes Configuring TCP and UDP Probes Router a ConfigurationRouter B Configuration CustomerA Tuning RPM ProbesTuning RPM Probes Set probe-limitConfiguring RPM Probes to Monitor BGP Neighbors Configuring RPM Probes for BGP MonitoringConfiguring RPM Probes to Monitor BGP Neighbors Directing RPM Probes to Select BGP Routers Verifying an RPM ConfigurationDirecting RPM Probes to Select BGP Routers Add new entryVerifying RPM Services Verifying RPM ServicesVerifying RPM Statistics Verifying RPM Statistics Verifying RPM Probe Servers Verifying RPM Probe ServersIndex Index onIndex Series Services Router Administration Guide Index Symbols 112 Chassis Dd utility, for compact flash recovery 192 Snmp health monitor System logs Dhcp Snmp Junos Internet software Diagnosing problems from 210 Monitoring from 102 See also Snmp Permissions Radius CLI See also RPM probes Preparation Serial number Chassis components BGP TACACS+ Routing Engine, too warm Upgrades Version Hardware, displaying