Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... User manual

JunosE™ Software
for E Series™ Broadband
Services Routers
System Basics Configuration Guide
Release
11.3.x
Published: 2010-10-04
Copyright © 2010, Juniper Networks, Inc.

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United
States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other
trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify,
transfer, or otherwise revise this publication without notice.
Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are
owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312,
6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785.
JunosE™ Software for E Series™ Broadband Services Routers System Basics Configuration Guide
Release 11.3.x
Copyright © 2010, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Writing: Mark Barnard, Diane Florio, Bruce Gillham, Sarah Lesway-Ball, Brian Wesley Simmons, Fran Singer, Krupa Chandrashekar, Poornima
Goswami, Hema Priya J, Subash Babu Asokan, Sairam Venugopalan
Editing: Benjamin Mann, Alana Calapai
Illustration: Nathaniel Woodward
Cover Design: Edmonds Design
Revision History
October 2010—FRS JunosE 11.3.x
The information in this document is current as of the date listed in the revision history.
YEAR 2000 NOTICE
Juniper Networks hardware and software products are Year 2000 compliant. The Junos OS has no known time-related limitations through
the year 2038. However, the NTP application is known to have some difficulty in the year 2036.
Copyright © 2010, Juniper Networks, Inc.ii

END USER LICENSE AGREEMENT
READ THIS END USER LICENSE AGREEMENT (“AGREEMENT”) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE.
BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS
CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO
BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED
HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE, AND (B) YOU MAY CONTACT JUNIPER NETWORKS
REGARDING LICENSE TERMS.
1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer’s principal office is located in the Americas) or
Juniper Networks (Cayman) Limited (if the Customer’s principal office is located outside the Americas) (such applicable entity being referred
to herein as “Juniper”), and (ii) the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable
license(s) for use of the Software (“Customer”) (collectively, the “Parties”).
2. The Software. In this Agreement, “Software” means the program modules and features of the Juniper or Juniper-supplied software, for
which Customer has paid the applicable license or support fees to Juniper or an authorized Juniper reseller, or which was embedded by
Juniper in equipment which Customer purchased from Juniper or an authorized Juniper reseller. “Software” also includes updates, upgrades
and new releases of such software. “Embedded Software” means Software which Juniper has embedded in or loaded onto the Juniper
equipment and any updates, upgrades, additions or replacements which are subsequently embedded in or loaded onto the equipment.
3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer
a non-exclusive and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the
following use restrictions:
a. Customer shall use Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by
Customer from Juniper or an authorized Juniper reseller.
b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units
for which Customer has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access
Client software only, Customer shall use such Software on a single computer containing a single physical random access memory space
and containing any number of processors. Use of the Steel-Belted Radius or IMS AAA software on multiple computers or virtual machines
(e.g., Solaris zones) requires multiple licenses, regardless of whether such computers or virtualizations are physically contained on a single
chassis.
c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may
specify limits to Customer’s use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent
users, sessions, calls, connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of
separate licenses to use particular features, functionalities, services, applications, operations, or capabilities, or provide throughput,
performance, configuration, bandwidth, interface, processing, temporal, or geographical limits. In addition, such limits may restrict the use
of the Software to managing certain kinds of networks or require the Software to be used only in conjunction with other specific Software.
Customer’s use of the Software shall be subject to all such limitations and purchase of all applicable licenses.
d. For any trial copy of the Software, Customer’s right to use the Software expires 30 days after download, installation or use of the
Software. Customer may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not
extend or create an additional trial period by re-installing the Software after the 30-day trial period.
e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customer’s
enterprise network. Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the
Steel-Belted Radius software to support any commercial network access services.
The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase
the applicable license(s) for the Software from Juniper or an authorized Juniper reseller.
4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees
not to and shall not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized
copies of the Software (except as necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the
Software, in any form, to any third party; (d) remove any proprietary notices, labels, or marks on or in any copy of the Software or any product
in which the Software is embedded; (e) distribute any copy of the Software to any third party, including as may be embedded in Juniper
equipment sold in the secondhand market; (f) use any ‘locked’ or key-restricted feature, function, service, application, operation, or capability
without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even if such feature, function, service, application,
operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper to any third party; (h) use the
iiiCopyright © 2010, Juniper Networks, Inc.

Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper reseller; (i)
use Embedded Software on non-Juniper equipment; (j) use Embedded Software (or make it available for use) on Juniper equipment that
the Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking
of the Software to any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly
provided herein.
5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper,
Customer shall furnish such records to Juniper and certify its compliance with this Agreement.
6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper.
As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence,
which at a minimum includes restricting access to the Software to Customer employees and contractors having a need to use the Software
for Customer’s internal business purposes.
7. Ownership. Juniper and Juniper’s licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to
the Software, associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance
of any right, title, or interest in the Software or associated documentation, or a sale of the Software, associated documentation, or copies
of the Software.
8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty
statement that accompanies the Software (the “Warranty Statement”). Nothing in this Agreement shall give rise to any obligation to support
the Software. Support services may be purchased separately. Any such support shall be governed by a separate, written support services
agreement. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA,
OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES
ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER
BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE.
EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW, JUNIPER DISCLAIMS ANY
AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING ANY
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES
JUNIPER WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT
ERROR OR INTERRUPTION, OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Juniper’s or its suppliers’
or licensors’ liability to Customer, whether in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid
by Customer for the Software that gave rise to the claim, or if the Software is embedded in another Juniper product, the price paid by
Customer for such other product. Customer acknowledges and agrees that Juniper has set its prices and entered into this Agreement in
reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between
the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same
form an essential basis of the bargain between the Parties.
9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination
of the license granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related
documentation in Customer’s possession or control.
10. Taxes. All license fees payable under this agreement are exclusive of tax. Customer shall be responsible for paying Taxes arising from
the purchase of the license, or importation or use of the Software. If applicable, valid exemption documentation for each taxing jurisdiction
shall be provided to Juniper prior to invoicing, and Customer shall promptly notify Juniper if their exemption is revoked or modified. All
payments made by Customer shall be net of any applicable withholding tax. Customer will provide reasonable assistance to Juniper in
connection with such withholding taxes by promptly: providing Juniper with valid tax receipts and other required documentation showing
Customer’s payment of any withholding taxes; completing appropriate applications that would reduce the amount of withholding tax to
be paid; and notifying and assisting Juniper in any audit or tax proceeding related to transactions hereunder. Customer shall comply with
all applicable tax laws and regulations, and Customer will promptly pay or reimburse Juniper for all costs and damages related to any
liability incurred by Juniper as a result of Customer’s non-compliance or delay with its responsibilities herein. Customer’s obligations under
this Section shall survive termination or expiration of this Agreement.
11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any
applicable foreign agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such
restrictions, laws or regulations, or without all necessary approvals. Customer shall be liable for any such violations. The version of the
Software supplied to Customer may contain encryption or other capabilities restricting Customer’s ability to export the Software without
an export license.
Copyright © 2010, Juniper Networks, Inc.iv

12. Commercial Computer Software. The Software is “commercial computer software” and is provided with restricted rights. Use,
duplication, or disclosure by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS
227.7201 through 227.7202-4, FAR 12.212, FAR 27.405(b)(2), FAR 52.227-19, or FAR 52.227-14(ALT III) as applicable.
13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer
with the interface information needed to achieve interoperability between the Software and another independently created program, on
payment of applicable fee, if any. Customer shall observe strict obligations of confidentiality with respect to such information and shall use
such information in compliance with any applicable terms and conditions upon which Juniper makes such information available.
14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products
or technology are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement,
and such licensor or vendor shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party
software may be provided with the Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent
portions of the Software are distributed under and subject to open source licenses obligating Juniper to make the source code for such
portions publicly available (such as the GNU General Public License (“GPL”) or the GNU Library General Public License (“LGPL”)), Juniper
will make such source code portions (including Juniper modifications, as appropriate) available upon request for a period of up to three
years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA
94089, ATTN: General Counsel. You may obtain a copy of the GPL at http://www.gnu.org/licenses/gpl.html, and a copy of the LGPL
at http://www.gnu.org/licenses/lgpl.html .
15. Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws
principles. The provisions of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes
arising under this Agreement, the Parties hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal
courts within Santa Clara County, California. This Agreement constitutes the entire and sole agreement between Juniper and the Customer
with respect to the Software, and supersedes all prior and contemporaneous agreements relating to the Software, whether oral or written
(including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an
authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained
herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in writing
by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity
of the remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the
Parties agree that the English version will govern. (For Canada: Les parties aux présentés confirment leur volonté que cette convention de
même que tous les documents y compris tout avis qui s'y rattaché, soient redigés en langue anglaise. (Translation: The parties confirm that
this Agreement and all related documentation is and will be in the English language)).
vCopyright © 2010, Juniper Networks, Inc.

Copyright © 2010, Juniper Networks, Inc.vi

Abbreviated Table of Contents
AbouttheDocumentation........................................xxvii
Part 1 Chapters
Chapter1 PlanningYourNetwork..............................................3
Chapter2 Command-LineInterface...........................................27
Chapter3 InstallingJunosESoftware.........................................117
Chapter4 ConfiguringSNMP................................................137
Chapter5 ManagingtheSystem............................................239
Chapter6 Managing Modules ...............................................341
Chapter7 PasswordsandSecurity..........................................403
Chapter8 WritingCLIMacros...............................................459
Chapter9 BootingtheSystem..............................................495
Chapter 10 Configuring the System Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
Chapter11 ConfiguringVirtualRouters........................................525
Part 2 Reference Material
AppendixA AbbreviationsandAcronyms......................................537
AppendixB References......................................................559
Part 3 Index
Index ...........................................................585
viiCopyright © 2010, Juniper Networks, Inc.

Copyright © 2010, Juniper Networks, Inc.viii
JunosE 11.3.x System Basics Configuration Guide

Table of Contents
AbouttheDocumentation........................................xxvii
E Series and JunosE Documentation and Release Notes . . . . . . . . . . . . . . . . . . xxvii
Audience ........................................................xxvii
E Series and JunosE Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . xxvii
ObtainingDocumentation...........................................xxix
DocumentationFeedback...........................................xxix
RequestingTechnicalSupport........................................xxix
Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxx
OpeningaCasewithJTAC........................................xxx
Part 1 Chapters
Chapter1 PlanningYourNetwork..............................................3
Platform Considerations ..............................................3
InterfaceSpecifiers...............................................4
EdgeApplicationsOverview...........................................4
PrivateLineAggregation...........................................4
xDSLSessionTermination.........................................5
LayeredApproach...................................................6
LineModules,I/OModules,andIOAs....................................7
Interfaces ..........................................................8
Subinterfaces ...................................................8
interfaceCommand..............................................8
GeneralConfigurationTasks...........................................9
ConfiguringVirtualRouters............................................9
ConfiguringIPSec...................................................10
Configuring Physical Layer Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
LineModuleFeatures.............................................11
ConfigurableHDLCParameters....................................12
Configuring Channelized T3 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
ConfiguringT3andE3Interfaces...................................13
Configuring OCx/STMx and OC48 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . 14
Configuring Channelized OCx/STMx Line Interfaces . . . . . . . . . . . . . . . . . . . . 14
ConfiguringEthernetInterfaces....................................15
Configuring IPSec-Service Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Configuring Tunnel Service Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Configuring Data Link-Layer Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
ConfiguringIP/FrameRelay........................................16
Configuring IP/ATM..............................................18
ConfiguringIP/PPP..............................................20
Configuring IP/HDLC .............................................21
ixCopyright © 2010, Juniper Networks, Inc.

ConfiguringIP/Ethernet...........................................22
Configuring IP Tunnels, Shared IP Interfaces, and Subscriber Interfaces . . . . . . . . 22
ConfiguringIPTunnels...........................................22
Configuring Shared Interfaces and Subscriber Interfaces . . . . . . . . . . . . . . . . 22
ConfiguringRoutingProtocols.........................................23
ConfiguringVRRP...................................................24
ConfiguringRoutingPolicy............................................24
ConfiguringQoS....................................................24
ConfiguringPolicyManagement.......................................25
ConfiguringRemoteAccess...........................................25
Chapter2 Command-LineInterface...........................................27
Overview..........................................................27
CommandModes...............................................27
Command-LinePrompts.........................................28
KeywordsandParameters........................................29
Keywords ..................................................29
Parameters ................................................29
Keywords and Parameters Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
UsingCLICommands............................................30
Abbreviated Commands ......................................31
The?Key...................................................31
BackspaceorDelete..........................................31
Enter ......................................................31
Tab .......................................................32
ArrowKeys.................................................32
ThenoVersion..............................................32
runanddoCommands.......................................33
showCommands............................................34
Redirection of show Command Output . . . . . . . . . . . . . . . . . . . . . . . . . . 38
RegularExpressions..........................................39
The--More--Prompt........................................40
RespondingtoPrompts.......................................43
CLIStatusIndicators.............................................44
LevelsofAccess................................................45
UserLevel..................................................45
Privileged Level .............................................45
InitializationSequence...........................................45
PlatformConsiderations.............................................45
AccessingtheCLI...................................................45
LoggingIn .....................................................45
Privileged-LevelAccess ..........................................46
DefiningCLILevelsofPrivilege.................................46
Accessing the Privileged Exec Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Moving from Privileged Exec to User Exec Mode . . . . . . . . . . . . . . . . . . . . . . . 48
LoggingOut....................................................49
CLICommandPrivileges.............................................49
CLIPrivilegeGroups.............................................49
Examples Using Privilege Group Membership . . . . . . . . . . . . . . . . . . . . . . . . . 50
Copyright © 2010, Juniper Networks, Inc.x
JunosE 11.3.x System Basics Configuration Guide

CLICommandExceptions........................................54
CLIKeywordMapping............................................54
Setting Privileges for Ambiguous Commands . . . . . . . . . . . . . . . . . . . . . . . . . 55
Setting Privilege Levels for no or default Versions . . . . . . . . . . . . . . . . . . . . . . 56
Setting Privilege Levels for Multiple Commands . . . . . . . . . . . . . . . . . . . . . . . 56
Setting Privilege Levels for All Commands in a Mode . . . . . . . . . . . . . . . 56
Setting Privilege Levels for a Group of Commands . . . . . . . . . . . . . . . . . 56
UsingtheOrderofPrecedence.................................56
Superseding Privilege Levels with the all Keyword . . . . . . . . . . . . . . . . . . 57
RemovingtheallKeyword.....................................58
SettingDefaultLinePrivilege......................................58
ViewingCLIPrivilegeInformation...................................59
Viewing the Current User Privilege Level . . . . . . . . . . . . . . . . . . . . . . . . . 59
Viewing Privilege Levels for All Connected Users . . . . . . . . . . . . . . . . . . . 59
Viewing Privilege Levels for Changed CLI Commands . . . . . . . . . . . . . . . 59
UsingHelp........................................................60
?(QuestionMarkKey)...........................................60
helpCommand.................................................63
Partial-keyword<Tab>...........................................63
UsingCommand-LineEditing.........................................63
BasicEditing...................................................63
Command-LineEditingKeys......................................63
CommandHistoryKeys..........................................65
PaginationKeys.................................................65
AccessingCommandModes..........................................66
ExecModes....................................................79
PasswordProtection.........................................80
GlobalConfigurationMode........................................81
ExecutingaScriptFile........................................81
AAAProfileConfigurationMode....................................82
Address Family Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
ATMVCConfigurationMode......................................82
ATMVCClassConfigurationMode.................................83
Classifier Group Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Color Mark Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
ControlPlaneConfigurationMode..................................85
ControllerConfigurationMode.....................................85
DHCP Local Pool Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
DomainMapConfigurationMode..................................86
Domain Map Tunnel Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
DoS Protection Group Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
DropProfileConfigurationMode...................................87
ExplicitPathConfigurationMode..................................88
FlowCacheConfigurationMode...................................88
InterfaceConfigurationMode.....................................89
IPNATPoolConfigurationMode...................................89
IP PIM Data MDT Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
IP Service Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
IPSec CA Identity Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
xiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

IPSecIdentityConfigurationMode..................................91
IPSec IKE Policy Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
IPSec Manual Key Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
IPSec Peer Public Key Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
IPSec Transport Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . 92
IPSec Tunnel Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
IPTunnelDestinationProfileMode.................................93
IPv6 Local Pool Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
L2 Transport Load-Balancing-Circuit Configuration Mode . . . . . . . . . . . . . . . 95
L2TP Destination Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . 95
L2TP Destination Profile Host Configuration Mode . . . . . . . . . . . . . . . . . . . . 95
L2TP Tunnel Switch Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . 96
Layer 2 Control Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Layer 2 Control Neighbor Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . 97
LDPConfigurationMode..........................................97
LineConfigurationMode..........................................97
Local IPSec Transport Profile Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 98
LocalUserConfigurationMode....................................98
MapClassConfigurationMode....................................99
MapListConfigurationMode......................................99
ParentGroupConfigurationMode.................................100
PolicyListConfigurationMode....................................100
Policy List Parent Group Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . 101
Policy Parameter Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
PPPoE Service Name Table Configuration Mode . . . . . . . . . . . . . . . . . . . . . . 101
ProfileConfigurationMode.......................................102
QoS Interface Set Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
QoS Interface Superset Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . 103
QoS Parameter Definition Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . 103
QoSProfileConfigurationMode...................................104
QoS Shared Shaper Control Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 104
QueueProfileConfigurationMode.................................105
RADIUSConfigurationMode......................................105
RADIUSRelayConfigurationMode.................................106
Rate Limit Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
RedundancyConfigurationMode..................................107
Remote Neighbor Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
RouteMapConfigurationMode...................................108
RouterConfigurationMode.......................................108
RSVPConfigurationMode.......................................109
RTRConfigurationMode.........................................109
Scheduler Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Service Session Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . 110
SNMP Event Manager Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Statistics Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
SubinterfaceConfigurationMode...................................111
Subscriber Policy Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
TrafficClassConfigurationMode...................................112
Traffic Class Group Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Copyright © 2010, Juniper Networks, Inc.xii
JunosE 11.3.x System Basics Configuration Guide

TunnelGroupConfigurationMode..................................113
Tunnel Group Tunnel Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Tunnel Profile Configuration Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
TunnelServerConfigurationMode.................................114
VRFConfigurationMode.........................................114
VRGroupConfigurationMode.....................................115
Chapter3 InstallingJunosESoftware.........................................117
Overview..........................................................117
Identifying the Software Release File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
PlatformConsiderations.............................................119
Installing Software When a Firewall Exists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Task 1: Obtain the Required Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Task 2: Divert Network Traffic to Another Router . . . . . . . . . . . . . . . . . . . . . . 120
Task 3: Access Privileged Exec Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Task 4: Configure IP on an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Task 5: Copy the Release Files to the Network Host . . . . . . . . . . . . . . . . . . . . 121
Task 6: Configure Access to the Network Host . . . . . . . . . . . . . . . . . . . . . . . . 121
Task 7: Enable the FTP Server on the Router . . . . . . . . . . . . . . . . . . . . . . . . . 122
Task 8: Identify the Files to Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Task 9: Transfer Files to the User Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Task 10: Install Files on the System Space . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Task 11: Save the Current Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Task12:ReboottheSystem.......................................123
Installing Software When a Firewall Does Not Exist . . . . . . . . . . . . . . . . . . . . . . . 124
Installing Software in Normal Operational Mode . . . . . . . . . . . . . . . . . . . . . . 124
Task 1: Obtain the Required Information . . . . . . . . . . . . . . . . . . . . . . . . . 124
Task 2: Divert Network Traffic to Another Router . . . . . . . . . . . . . . . . . . 125
Task 3: Access Privileged Exec Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Task 4: Configure IP on an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Task 5: Configure Access to the Network Host . . . . . . . . . . . . . . . . . . . . 126
Task 6: Copy the Release Files to the Network Host . . . . . . . . . . . . . . . . 126
Task 7: Copy the Software Release File to the Router . . . . . . . . . . . . . . . 127
Task 8: Save the Current Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Task9:ReboottheSystem....................................127
InstallingSoftwareinBootMode..................................128
Task 1: Obtain the Required Information . . . . . . . . . . . . . . . . . . . . . . . . . 128
Task 2: Divert Network Traffic to Another System . . . . . . . . . . . . . . . . . . 128
Task3:AccesstheBootMode.................................128
Task4:AssignanIPAddress..................................129
Task 5: Configure Access to the Network Host . . . . . . . . . . . . . . . . . . . . 129
Task 6: Resetting the SRP Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Task 7: Copy the Release Files to the Network Host . . . . . . . . . . . . . . . . 129
Task 8: Copy the Software Release File to the Router . . . . . . . . . . . . . . 130
Task9:ReboottheSystem...................................130
Copying Release Files from One Router to Another . . . . . . . . . . . . . . . . . . . . . . . 130
Upgrading Systems That Are Operating with Two SRP Modules . . . . . . . . . . . . . 131
xiiiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

UpgradingJunosESoftware..........................................133
Upgrading Software Remotely Through Telnet or FTP . . . . . . . . . . . . . . . . . 133
Upgrading Software from an NVS Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Upgrading a System That Contains One SRP Module . . . . . . . . . . . . . . 133
Upgrading a System That Contains Two SRP Modules . . . . . . . . . . . . . 134
DowngradingJunosESoftware.......................................135
Chapter4 ConfiguringSNMP................................................137
Overview .........................................................137
Terminology...................................................138
SNMPFeaturesSupported.......................................139
SNMPClient...................................................139
SNMPServer..................................................140
SNMPMIBs...................................................140
StandardSNMPMIBs.......................................140
Juniper Networks E Series Enterprise MIBs . . . . . . . . . . . . . . . . . . . . . . . 140
AccessingSupportedSNMPMIBs..............................140
SNMPVersions................................................140
SecurityFeatures...............................................141
Management Features ..........................................142
VirtualRouters.................................................143
CreatingSNMPProxy........................................143
Disabling and Reenabling SNMP Proxy . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Communicating with the SNMP Engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
SNMPAttributes...............................................145
SNMPOperations..............................................145
SNMPPDUTypes..............................................146
Platform Considerations ............................................146
References........................................................147
BeforeYouConfigureSNMP..........................................147
SNMPConfigurationTasks...........................................148
EnablingSNMP................................................148
Configuring SNMP v1/v2c Community . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
CommunityName..........................................149
PrivilegeLevels.............................................149
IPAccessList..............................................149
ConfiguringSNMPv3Users.......................................150
Configuring SNMP Dynamic Groups and Views . . . . . . . . . . . . . . . . . . . . . . . 150
SettingServerParameters........................................151
ConfiguringSNMPPacketSize....................................151
ConfiguringMemoryWarning.....................................152
ConfiguringEncodingMethod.....................................152
ManagingInterfaceSublayers.....................................153
CompressingInterfaces......................................153
Controlling Interface Numbering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
MonitoringInterfaceTables...................................156
ConfiguringTraps..................................................156
IP Hosts ......................................................157
Trap Categories ................................................157
Copyright © 2010, Juniper Networks, Inc.xiv
JunosE 11.3.x System Basics Configuration Guide

TrapSeverityLevels.............................................158
Specifying an Egress Point for SNMP Traps . . . . . . . . . . . . . . . . . . . . . . . . . . 163
ConfiguringTrapQueues.........................................163
Configuring Trap Notification Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
RecoveringLostTraps...........................................166
Configuring the SNMP Server Event Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
EventMIBPurpose..............................................167
EventMIBStructure.............................................167
TriggerTable...............................................167
ObjectsTable..............................................168
EventTable................................................168
ConfigurationTasks.............................................168
DefiningaBooleanTest......................................170
DefininganExistenceTest.....................................171
DefiningaThresholdTest.....................................172
MonitoringEvents..............................................178
CollectingBulkStatistics............................................183
Interface Strings ...............................................185
Understanding Counter Discontinuity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Configuring Collectors and Receivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Deleting All Bulkstats Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
MonitoringCollectionStatistics...................................193
UnderstandingSchemas........................................203
If-StatsSchemaObjects....................................204
IGMPSchemaObjects......................................205
PolicySchemaObjects......................................206
QoSSchemaObjects.......................................207
ConfiguringSchemas...........................................209
Mapping Bulkstats Output to MIB Flies and CLI Configurations for Bulk
StatisticsSchema...........................................212
MonitoringSchemaStatistics....................................224
Configuring Interface Numbering Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
UsingtheBulkStatisticsFormatter....................................226
SettingRemoteFilenames.......................................226
Guidelines.................................................227
SpecifyingEndofLineFormat....................................227
ManagingVirtualRouters...........................................228
MonitoringSNMP..................................................228
EstablishingaBaseline..........................................228
ViewingSNMPStatus...........................................229
OutputFiltering................................................238
Chapter5 ManagingtheSystem............................................239
Overview ........................................................240
PlatformConsiderations............................................240
NamingtheSystem................................................240
Configuring the Switch Fabric Bandwidth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
ConfiguringTiming.................................................241
MonitoringTiming..............................................243
xvCopyright © 2010, Juniper Networks, Inc.
Table of Contents

UsingtheCLI.....................................................243
ManagingvtyLines................................................246
ConfiguringvtyLines...........................................246
MonitoringvtyLines............................................247
ClearingLines.....................................................248
Monitoring the Current Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Defining the Configuration Output Format . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Customizing the Configuration Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Detecting Corrupt File Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Automatically Recovering Corrupt Configuration Files . . . . . . . . . . . . . . . . . 260
Configuring the System Automatically . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
SavingtheCurrentConfiguration.....................................264
Using the Desktop Tool for Viewing Uncompressed Text Configuration . . . . . . . 267
Installation Prerequisites for the Desktop Tool . . . . . . . . . . . . . . . . . . . . . . . 267
Requirements for Microsoft Windows Systems . . . . . . . . . . . . . . . . . . . 268
Requirements for Sun Solaris Systems . . . . . . . . . . . . . . . . . . . . . . . . . 268
Requirements for Linux Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
UsageNotesforthePerlScript...................................269
CustomizingtheUserInterface.......................................269
SettingtheConsoleSpeed.......................................269
ConfiguringtheDisplayTerminal..................................270
SpecifyingtheCharacterSet.....................................270
ConfiguringLoginConditions......................................271
SettingTimeLimitsforUserLogin.................................271
SettingTimeLimitsforUserInput.................................272
ConfiguringCLIMessages........................................272
MonitoringtheConsoleSettings..................................274
SendingMessages.................................................276
Managing Memory.................................................277
Managing Files ....................................................277
Managing the User Space from a Network Host . . . . . . . . . . . . . . . . . . . . . . 279
FileCommandsandFTPServers..................................280
RenamingFiles................................................280
DeletingFiles..................................................282
MonitoringFiles................................................283
ViewingFiles..................................................286
Transferring Files ..................................................287
References ...................................................288
CopyingandRedirectingFiles....................................288
UsingthecopyCommand.......................................289
copyCommandExamples.......................................294
UsingTFTPtoTransferFiles......................................295
ConfiguringtheFTPServer......................................296
Features..................................................296
FTPPassiveMode..........................................296
ConfiguringAuthentication...................................296
ConfigurationTasks.........................................297
Configuration Example ......................................297
MonitoringtheFTPServer.......................................298
Copyright © 2010, Juniper Networks, Inc.xvi
JunosE 11.3.x System Basics Configuration Guide

CopyingPartialReleases........................................300
ConfiguringtheNFSClient..........................................302
References ...................................................302
Prerequisites ..................................................302
Configuration Tasks ............................................302
MonitoringtheNFSClient.......................................303
UsingaLoopbackInterface..........................................304
UsingtheTelnetClient.............................................305
Configuring DNS ..................................................305
References ...................................................306
AssigningNameServers........................................306
Using One Name Resolver for Multiple Virtual Routers . . . . . . . . . . . . . . . . 308
Monitoring DNS ...............................................308
TroubleshootingtheSystem.........................................309
CreatingCoreDumpFiles........................................309
BootMode................................................309
GlobalConfigurationMode...................................310
ManagingCoreDumpFiles.......................................312
Enabling and Disabling the Core Dump Monitor . . . . . . . . . . . . . . . . . . . 313
Specifying the Core Dump Monitor Interval . . . . . . . . . . . . . . . . . . . . . . 314
Viewing Core Dump Monitor Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
AccessingtheCoreDumpFile.....................................315
CapturingandWritingCoreDumps................................316
UnderstandingtheCoreDumpFile.................................317
TrackingIPPrefixReachability....................................318
Gathering Information for Customer Support . . . . . . . . . . . . . . . . . . . . . . . . 319
ManagingandMonitoringResources..................................320
Enabling and Disabling the Resource Threshold Monitor . . . . . . . . . . . . . . . 320
Viewing Resource Threshold Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
MonitoringtheSystem..............................................322
Chapter6 Managing Modules ...............................................341
Overview .........................................................341
PlatformConsiderations............................................342
ERX7xx Models, ERX14xx Models, and the ERX310 Broadband Services
Router....................................................342
LineModulesandI/OModules................................342
SRPModules..............................................342
E120 and E320 Broadband Services Routers . . . . . . . . . . . . . . . . . . . . . . . . . 343
LineModulesandIOAs......................................343
SRPModulesandSFMs.....................................345
Disabling and Reenabling Line Modules, SRP Modules, and SFMs . . . . . . . . . . . 346
DisablingandReenablingIOAs.......................................348
RemovinganSRPModule...........................................349
Replacing Line Modules on ERX Routers, the E120 Router, and the E320
Router .......................................................350
Replacing a Line Module by Erasing the Slot Configuration . . . . . . . . . . . . . . 351
Replacing a Line Module Without Erasing the Slot Configuration . . . . . . . . 352
xviiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Replacing IOAs on the E120 Router and the E320 Router . . . . . . . . . . . . . . . . . . 355
ReplacingSRPModulesandSFMs................................355
SoftwareCompatibility.............................................359
LineModules..................................................359
I/OModulesandIOAs...........................................359
Configuring Performance Rate of Line Modules on ERX7xx Models and the
ERX1410Router................................................359
Choosing a Combination of Line Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
SlotGroups...............................................360
SRPModulesBandwidth....................................360
Line Modules Bandwidth and Switch Usage . . . . . . . . . . . . . . . . . . . . . 360
Allowed Combinations for Line Rate Performance . . . . . . . . . . . . . . . . . 361
Specifying the Type of Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363
Monitoring Bandwidth Oversubscription . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363
Troubleshooting Bandwidth Oversubscription . . . . . . . . . . . . . . . . . . . . . . . 364
Managing Flash Cards on SRP Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
FlashFeatures.................................................365
Flash Features on the E120 Router and the E320 Router . . . . . . . . . . . . . . . 365
Installing and Removing Flash Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
SynchronizingFlashCards.......................................368
Synchronizing Flash Cards of Different Capacities . . . . . . . . . . . . . . . . 369
DisablingAutosynchronization................................369
Validating and Recovering Redundant SRP File Integrity . . . . . . . . . . . . . . . 370
Reformatting the Primary Flash Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
Copying the Image on the Primary SRP Module . . . . . . . . . . . . . . . . . . . . . . 374
ScanningFlashCards...........................................375
MonitoringFlashCards..........................................377
Updating the Router with JunosE Hotfix Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
Hotfix Compatibility and Dependency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
RemovingHotfixes.............................................380
HotfixesandBackupSettings....................................380
HotfixesandStandbySRPModules................................381
HotfixesandLineModules.......................................381
Monitoring Hotfixes ............................................383
Example: Using and Monitoring Hotfixes . . . . . . . . . . . . . . . . . . . . . . . . 386
Managing the Ethernet Port on the SRP Module . . . . . . . . . . . . . . . . . . . . . . . . . 388
Monitoring Statistics ...........................................389
Monitoring the Ethernet Configuration for the SRP Module . . . . . . . . . . . . . 389
Enabling Warm Restart Diagnostics on Modules . . . . . . . . . . . . . . . . . . . . . . . . . 391
Enabling Warm Restart Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Enabling Diagnostics ...........................................392
IgnoringDiagnosticTestFailures......................................392
MonitoringModules................................................394
Chapter7 PasswordsandSecurity..........................................403
Overview ........................................................403
PlatformConsiderations............................................403
Copyright © 2010, Juniper Networks, Inc.xviii
JunosE 11.3.x System Basics Configuration Guide

SettingBasicPasswordParameters...................................404
CreatingEncryptedPasswords...................................404
CreatingSecrets...............................................404
Encrypting Passwords in Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . 405
CommandsandGuidelines......................................405
SettingandErasingPasswords.......................................407
PrivilegeLevels................................................407
AccessingPrivilegeLevels....................................407
SettingEnablePasswords.......................................408
ErasingEnablePasswords.......................................408
SettingaConsolePassword......................................410
ErasingtheConsolePassword.....................................411
MonitoringPasswords...........................................412
Vty Line Authentication and Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
Configuring Simple Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
Configuring AAA Authentication and AAA Authorization . . . . . . . . . . . . . . . 415
VirtualTerminalAccessLists.........................................420
Secure System Administration with SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421
Transport .....................................................421
UserAuthentication............................................422
Connection ...................................................422
KeyManagement..............................................422
UserKeyManagement......................................422
HostKeyManagement......................................422
Performance ..................................................423
SecurityConcerns..............................................424
BeforeYouConfigureSSH.......................................424
SSHConfigurationTasks........................................424
Configuring Encryption ......................................425
Configuring User Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426
Configuring Message Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
EnablingandDisablingSSH..................................428
DisplayingSSHStatus.......................................429
TerminatinganSSHSession..................................430
RestrictingUserAccess.............................................431
Restricting Access to Commands with RADIUS . . . . . . . . . . . . . . . . . . . . . . . 431
Per-UserEnableAuthentication..................................432
Restricting Access to Virtual Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
VSAConfigurationExamples.................................433
CommandsAvailabletoUsers................................434
DenialofService(DoS)Protection....................................435
Suspicious Control Flow Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
Suspicious Control Flow Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437
ConfigurableOptions...........................................438
Display Options ...............................................438
TrapsandLogs................................................438
Suspicious Control Flow Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Monitoring Suspicious Control Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
Denial-of-Service Protection Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
xixCopyright © 2010, Juniper Networks, Inc.
Table of Contents

GroupParameters .............................................446
Attaching Groups ..............................................447
ProtocolMapping..............................................447
DoS Protection Group Configuration Example . . . . . . . . . . . . . . . . . . . . . . . . 451
DoSProtectionGroupCommands.................................451
MonitoringDoSProtectionGroups.................................457
Chapter8 WritingCLIMacros...............................................459
PlatformConsiderations............................................459
WritingMacros....................................................459
EnvironmentCommands........................................460
CapturingOutputofCommands..................................462
Adding Regular Expression Matching to Macros . . . . . . . . . . . . . . . . . . . . . . 462
Extracting a Substring Based on Regular Expression Matching . . . . . . . . . . 463
Adding Global Variables for Availability to the onError Macro . . . . . . . . . . . 463
UniqueIDsforMacros..........................................464
Accurate Use of Error Status When Accessed Ourside of onError Macro . . 464
Variables.....................................................465
Literals ......................................................465
Operators ....................................................465
Assignment ...............................................468
IncrementandDecrement...................................468
String Operations ..........................................469
ExtractionOperations.......................................469
Arithmetic Operations..........................................470
RelationalOperations.......................................470
Logical Operations .........................................470
MiscellaneousOperations....................................471
ConditionalExecution...........................................471
IfConstructs...............................................471
WhileConstructs...........................................473
PassingParametersinMacros....................................474
GeneratingMacroOutput........................................474
InvokingOtherMacros..........................................475
Detecting and Recording Macro Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476
DetectableMacroErrors.........................................477
LoggingMacroResults..........................................477
ViewingMacroErrors...........................................478
onErrorMacroExamples........................................478
Detecting Invalid Command Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
DetectingInvalidCommands.................................479
DetectingMissingMacros....................................480
RunningMacros ...................................................481
SchedulingMacros................................................484
Practical Examples ................................................487
ConfiguringFrameRelay........................................487
ConfiguringATMInterfaces.......................................491
Copyright © 2010, Juniper Networks, Inc.xx
JunosE 11.3.x System Basics Configuration Guide