show command juniper switch

April 21, 2015
Here are some useful command in day to day life while troubleshooting the juniper switch. 

1. show mac add of specific vlan
  root@jpudasaini#show ethernet-switching table vlan 608

2. compare configure before commit
  root@jpudasaini#show | compare

3. check mac add
  root@jpudasaini#show ethernet-switching table brief

4. show perticular Mac in Juniper
  root@jpudasaini#show ethernet-switching table | match d4ca.6dea.d420

5. show port description/status
  root@jpudasaini#show interfaces descriptions statistics

6. Show configuration in configuration mode
  root@jpudasaini#show configuration | display set

7. show correctness of the command before commit
  root@jpudasaini#commit check

8. Show Link Layer detection Protocol 
  root@jpudasaini#show protocols lldp 

9. Show vlan in configuration mode
root@jpudasaini#show vlans | display set

PEAR Succeeded but it is not a valid package archive

April 21, 2015
Recently I encounter following problem while installing PEAR in Ubuntu 14.04 server, after long search I found that, it is a bug already reported a long before. Solution at bottom of the page.

root@dns:~# pear install DB
WARNING: "pear/DB" is deprecated in favor of "pear/MDB2"
WARNING: "pear/Console_Getopt" is deprecated in favor of "pear/Console_GetoptPlus"
downloading DB-1.8.2.tgz ...
Starting to download DB-1.8.2.tgz (131,693 bytes)
.............................done: 131,693 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/DB-1.8.2.tgz"
Download of "pear/DB" succeeded, but it is not a valid package archive
Error: cannot download "pear/DB"
downloading PEAR-1.9.5.tgz ...
Starting to download PEAR-1.9.5.tgz (290,006 bytes)
...done: 290,006 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/PEAR-1.9.5.tgz"
Download of "pear/PEAR" succeeded, but it is not a valid package archive
Error: cannot download "pear/PEAR"
downloading Archive_Tar-1.3.16.tgz ...
Starting to download Archive_Tar-1.3.16.tgz (20,024 bytes)
...done: 20,024 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/Archive_Tar-1.3.16.tgz"
Download of "pear/Archive_Tar" succeeded, but it is not a valid package archive
Error: cannot download "pear/Archive_Tar"
downloading Console_Getopt-1.4.0.tgz ...
Starting to download Console_Getopt-1.4.0.tgz (4,534 bytes)
...done: 4,534 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/Console_Getopt-1.4.0.tgz"
Download of "pear/Console_Getopt" succeeded, but it is not a valid package archive
Error: cannot download "pear/Console_Getopt"
downloading XML_Util-1.2.3.tgz ...
Starting to download XML_Util-1.2.3.tgz (17,134 bytes)
...done: 17,134 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/XML_Util-1.2.3.tgz"
Download of "pear/XML_Util" succeeded, but it is not a valid package archive
Error: cannot download "pear/XML_Util"
Download failed
install failed

Solution: Edit /usr/share/php/Archive/Tar.php find and replace the following 'gzopen' with gzopen64' and 'gzseek' with gzseek64' 

Juniper switch Basic Configuration Commands

December 31, 2014
Hello fellow blog reader, after long gap I'm going to write this thread regarding the basic Juniper command and configuration. I try to include as much as troubleshooting/configuration command during day to day work.
I would like to thank to Srijan pointing the error on LACP command.

1. Set username for login
root@jpudasaini#set system root-authentication encrypted-password
New password:
Retype new password:

root@jpudasaini#set system login user jay full-name jaypudasaini uid 400 class super-user authentication encrypted-password


2. Hostname configuration.
root@switch#set system host-name jpudasaini
root@jpudasaini#

3. Set Tacplus authentication for juniper switch.
root@jpudasaini# set system authentication-order tacplus
root@jpudasaini# set system authentication-order password
root@jpudasaini# set system root-authentication encrypted-password "you password here"
root@jpudasaini# set system tacplus-server 10.10.10.10(your tacplus server IP) secret "your server password here"
root@jpudasaini#set system tacplus-options service-name test

4. Configuration VLAN(Group)
root@jpudasaini#set vlans Cust-Fiber vlan-id 500-550
root@jpudasaini#set vlans Cust-Wireless vlan-id 551-575
    single vlan
root@jpudasaini#set vlans Cust-A vland-id 25

5. Trunk Port Configuration
root@jpudasaini#set interfaces ge-0/0/9 description connect-to-sw2
root@jpudasaini#set interfaces ge-0/0/9 unit 0 family ethernet-switching port-mode trunk
root@jpudasaini#set interfaces ge-0/0/9 unit 0 family ethernet-switching vlan members Cust-Fiber

6. Access Port Configuration
root@jpudasaini#set interfaces ge-0/0/0 description Link-to-sw3
root@jpudasaini#set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode access
root@jpudasaini#set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 25

7. Port Channel Configuration
root@jpudasaini#set chassis aggregated-devices ethernet device-count 10
root@jpudasaini#set interfaces ae0 description TR-2-Jpudasaini-Sw2
root@jpudasaini#set interfaces ae0 aggregated-ether-options lacp active
root@jpudasaini#set interfaces ae0 unit 0 family ethernet-switching port-mode trunk
root@jpudasaini#set interfaces ae0 unit 0 family ethernet-switching vlan members Cust-Fiber
root@jpudasaini#set interfaces ae0 unit 0 family ethernet-switching vlan members Cust-Wireless

8. Port Channel Assign to the Physical Port
root@jpudasaini#set interfaces ge-0/0/16 description test-sw1
root@jpudasaini#set interfaces ge-0/0/16 ether-options 802.3ad ae0
root@jpudasaini#set interfaces ge-0/0/17 description test-sw1
root@jpudasaini#set interfaces ge-0/0/17 ether-options 802.3ad ae0

9. Configuration management IP for switch.
root@jpudasaini#set interfaces vlan unit 20 family inet address 10.10.10.11/24

10. Configuration snmp.
root@jpudasaini#set snmp name Test-SNMP
root@jpudasaini#set snmp description test-sw2
root@jpudasaini#set snmp location "Jpudasaini-NOC"
root@jpudasaini#set snmp contact "system@jpudasaini.com.np"
root@jpudasaini#set snmp client-list list0 10.10.10.0/24
root@jpudasaini#set snmp community ax3R5vgW authorization read-only
root@jpudasaini#set snmp community ax3R5vgW client-list-name jpudasaini

11. Enable LLDP
root@jpudasaini# set protocols lldp interface all
root@jpudasaini#set protocols lldp-med interface all

12. Configure port as L3
root@jpudasaini#set interface ge-0/0/23 unit 0 family ethernet-switching port-mode trunk
root@jpudasaini#set interface ge-0/0/23 unit 0 family ethernet-switching vlan member 25
root@jpudasaini#set vlan Mgmt vlan-id 25
root@jpudasaini#set vlan Mgmt l3-interface vlan.25
root@jpudasaini#set interface vlan.250 family inet address xxx.xxx.xxx.xxx

13.Rate Limit
 Configure the policer

root@jpudasaini# set firewall policer Policer_2M if-exceeding bandwidth-limit 1M
root@jpudasaini# set firewall policer Policer_2M if-exceeding burst-size-limit 2k
root@jpudasaini# set firewall policer Policer_2M then discard

Configure the firewall filter

root@jpudasaini# set firewall family ethernet-switching filter Limit term 1 then accept
root@jpudasaini# set firewall family ethernet-switching filter Limit term 1 then policer Poicer_2M

Apply filter on interface (can be any interface as required)

root@jpudasaini# set interface ge-0/0/24.0 family ethernet-switching filter input Limit

Note: Remember that EX series switches apply rate limit only on ingress. 

Cisco Protected Port

October 29, 2014
I can see in my network any customer can communicate to any one on the same VLAN. Basically when ever any unknown packets ingress into the switch. Switch found no record in CAM table, so that frame flood every port of the respected VLAN, except the frame received port. Such a communication can very dangerous for the service provider and its customer. Because any one can sniff or send information to other customer in same VLAN. 

Broadcast packet also flooded into the network that can bottleneck our network. The way to protect such a bottleneck of the network we can configure switch port as protected port thus no port can directly communicated in a same broadcast domain.

Command:
interface fa0/2
switchchport mode access
switchport access vlan 30
switchport protected

This way we can protect the user in same VLAN. Protected port only be configured in edge port not the trunk port or L3 connected port. Now the protected port prevent any unicast, broadcast or multicast packet entering to the same switch interface. But traffic forwarded to same domain can be communicated through L3 device like router.