Preface |
|
xv | |
1 Juniper MX Architecture |
|
1 | (90) |
|
|
3 | (17) |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
4 | (2) |
|
|
6 | (9) |
|
|
15 | (2) |
|
|
17 | (3) |
|
|
20 | (19) |
|
|
21 | (1) |
|
|
22 | (2) |
|
|
24 | (1) |
|
|
25 | (2) |
|
|
27 | (1) |
|
|
28 | (2) |
|
|
30 | (3) |
|
|
33 | (6) |
|
|
39 | (10) |
|
|
40 | (1) |
|
|
41 | (1) |
|
|
42 | (1) |
|
|
43 | (3) |
|
|
46 | (3) |
|
|
49 | (1) |
|
|
49 | (22) |
|
|
50 | (1) |
|
Modular Port Concentrator |
|
|
51 | (14) |
|
|
65 | (4) |
|
|
69 | (1) |
|
|
69 | (2) |
|
|
71 | (15) |
|
|
73 | (3) |
|
|
76 | (1) |
|
|
77 | (5) |
|
Enhanced MX Switch Control Board |
|
|
82 | (2) |
|
|
84 | (2) |
|
|
86 | (2) |
|
|
88 | (2) |
|
|
90 | (1) |
2 Bridging, VLAN Mapping, IRB, and Virtual Switches |
|
91 | (102) |
|
|
91 | (2) |
|
|
93 | (5) |
|
|
93 | (2) |
|
|
95 | (1) |
|
|
96 | (2) |
|
|
98 | (2) |
|
Interface Bridge Configuration |
|
|
100 | (3) |
|
Basic Comparison of Service Provider Versus Enterprise Style |
|
|
100 | (3) |
|
Service Provider Interface Bridge Configuration |
|
|
103 | (12) |
|
|
104 | (4) |
|
|
108 | (4) |
|
Service Provider Bridge Domain Configuration |
|
|
112 | (3) |
|
Enterprise Interface Bridge Configuration |
|
|
115 | (6) |
|
|
115 | (4) |
|
|
119 | (2) |
|
Service Provider VLAN Mapping |
|
|
121 | (12) |
|
|
121 | (1) |
|
|
122 | (3) |
|
|
125 | (2) |
|
|
127 | (1) |
|
Bridge Domain Requirements |
|
|
128 | (1) |
|
|
129 | (1) |
|
Example: Swap-Push and Pop-Swap |
|
|
130 | (3) |
|
|
133 | (34) |
|
|
134 | (3) |
|
|
137 | (16) |
|
VLAN Normalization and Rewrite Operations |
|
|
153 | (1) |
|
|
154 | (7) |
|
Show Bridge Domain Commands |
|
|
161 | (2) |
|
|
163 | (2) |
|
|
165 | (2) |
|
Integrated Routing and Bridging |
|
|
167 | (4) |
|
|
168 | (3) |
|
|
171 | (5) |
|
|
171 | (5) |
|
|
176 | (12) |
|
VXLAN as a Layer 2 Overlay |
|
|
176 | (4) |
|
|
180 | (8) |
|
|
188 | (1) |
|
|
189 | (2) |
|
|
191 | (2) |
3 Stateless Filters, Hierarchical Policing, and Tri-Color Marking |
|
193 | (112) |
|
Firewall Filter and Policer Overview |
|
|
194 | (16) |
|
Stateless Versus Stateful |
|
|
194 | (2) |
|
Stateless Filter Components |
|
|
196 | (8) |
|
Filters Versus Routing Policy |
|
|
204 | (1) |
|
|
205 | (4) |
|
Filtering Differences for MPC Versus DPC |
|
|
209 | (1) |
|
|
210 | (7) |
|
Stateless Filter Processing |
|
|
210 | (7) |
|
|
217 | (23) |
|
Rate Limiting: Shaping or Policing? |
|
|
217 | (5) |
|
|
222 | (4) |
|
|
226 | (2) |
|
Single and Two-Rate Three-Color Policers |
|
|
228 | (8) |
|
|
236 | (4) |
|
Applying Filters and Policers |
|
|
240 | (23) |
|
Filter Application Points |
|
|
240 | (6) |
|
|
246 | (16) |
|
|
262 | (1) |
|
Policer Application Restrictions |
|
|
263 | (1) |
|
Advanced Filtering Features |
|
|
263 | (12) |
|
|
263 | (1) |
|
|
264 | (5) |
|
|
269 | (6) |
|
Advanced Filtering Summary |
|
|
275 | (1) |
|
Bridge Filtering Case Study |
|
|
275 | (19) |
|
Filter Processing in Bridged and Routed Environments |
|
|
275 | (2) |
|
Monitor and Troubleshoot Filters and Policers |
|
|
277 | (7) |
|
Bridge Family Filter and Policing Case Study |
|
|
284 | (10) |
|
|
294 | (1) |
|
Service Provider DDOS Filtering Case Study |
|
|
294 | (6) |
|
|
300 | (1) |
|
|
301 | (2) |
|
|
303 | (2) |
4 Routing Engine Protection and DDoS Prevention |
|
305 | (108) |
|
|
305 | (41) |
|
IPv4 RE Protection Filter |
|
|
306 | (26) |
|
IPv6 RE Protection Filter |
|
|
332 | (14) |
|
DDoS Protection Case Study |
|
|
346 | (21) |
|
The Issue of Control Plane Depletion |
|
|
347 | (1) |
|
DDoS Operational Overview |
|
|
347 | (11) |
|
DDoS Configuration and Operational Verification |
|
|
358 | (9) |
|
|
367 | (7) |
|
|
368 | (6) |
|
Suspicious Control Flow Detection |
|
|
374 | (14) |
|
|
376 | (1) |
|
|
377 | (2) |
|
Case Study: Suspicious Flow Detection |
|
|
379 | (8) |
|
Suspicious Control Flow Detection Summary |
|
|
387 | (1) |
|
|
388 | (7) |
|
BGP Flow-Specification to the Rescue |
|
|
388 | (6) |
|
What's New in the World of Flow-Spec? |
|
|
394 | (1) |
|
BGP Flow-Specification Case Study |
|
|
395 | (13) |
|
|
399 | (9) |
|
|
408 | (1) |
|
|
409 | (1) |
|
|
410 | (3) |
5 Trio Class of Service |
|
413 | (250) |
|
|
414 | (14) |
|
Port Versus Hierarchical Queuing MPCs |
|
|
415 | (4) |
|
CoS Capabilities and Scale |
|
|
419 | (9) |
|
|
428 | (19) |
|
Intelligent Oversubscription |
|
|
429 | (2) |
|
The Remaining CoS Packet Flow |
|
|
431 | (1) |
|
CoS Processing: Port- and Queue-Based MPCs |
|
|
431 | (11) |
|
Key Aspects of the Trio CoS Model |
|
|
442 | (4) |
|
Trio CoS Processing Summary |
|
|
446 | (1) |
|
|
447 | (45) |
|
The H-CoS Reference Model |
|
|
448 | (1) |
|
|
449 | (3) |
|
|
452 | (4) |
|
|
456 | (4) |
|
|
460 | (1) |
|
|
460 | (6) |
|
Interface Modes and Excess Bandwidth Sharing |
|
|
466 | (17) |
|
|
483 | (2) |
|
|
485 | (2) |
|
Control CoS on Host-Generated Traffic |
|
|
487 | (4) |
|
|
491 | (1) |
|
Per-VLAN Queuing for Non-Queuing MPCs |
|
|
492 | (9) |
|
Per-Unit Scheduler Case Study on MPC4e |
|
|
494 | (7) |
|
Per-Unit Scheduling for Non-Q MPC Summary |
|
|
501 | (1) |
|
Trio Scheduling and Queuing |
|
|
501 | (40) |
|
|
502 | (2) |
|
Scheduler Priority Levels |
|
|
504 | (8) |
|
|
512 | (19) |
|
H-CoS and Aggregated Ethernet Interfaces |
|
|
531 | (3) |
|
Schedulers, Scheduler Maps, and TCPs |
|
|
534 | (7) |
|
Trio Scheduling and Priority Summary |
|
|
541 | (1) |
|
|
541 | (4) |
|
Four Forwarding Classes, but Only Two Queues |
|
|
541 | (2) |
|
Default BA and Rewrite Marker Templates |
|
|
543 | (2) |
|
MX Trio CoS Defaults Summary |
|
|
545 | (1) |
|
|
545 | (8) |
|
|
553 | (1) |
|
Predicting Queue Throughput |
|
|
553 | (19) |
|
|
554 | (3) |
|
Trio CoS Proof-of-Concept Test Lab |
|
|
557 | (15) |
|
Predicting Queue Throughput Summary |
|
|
572 | (1) |
|
|
572 | (60) |
|
Configure Unidirectional CoS |
|
|
573 | (22) |
|
Verify Unidirectional CoS |
|
|
595 | (23) |
|
Confirm Scheduling Behavior |
|
|
618 | (14) |
|
Add H-CoS for Subscriber Access |
|
|
632 | (23) |
|
|
637 | (4) |
|
|
641 | (13) |
|
|
654 | (1) |
|
|
655 | (4) |
|
|
659 | (4) |
6 MX Virtual Chassis |
|
663 | (56) |
|
|
663 | (28) |
|
|
665 | (1) |
|
|
666 | (2) |
|
|
668 | (1) |
|
|
669 | (12) |
|
MX-VC Interface Numbering |
|
|
681 | (2) |
|
|
683 | (2) |
|
|
685 | (1) |
|
|
686 | (1) |
|
|
687 | (3) |
|
|
690 | (1) |
|
|
691 | (13) |
|
|
691 | (1) |
|
|
692 | (1) |
|
|
693 | (1) |
|
|
694 | (2) |
|
Virtual Chassis Configuration |
|
|
696 | (2) |
|
|
698 | (2) |
|
Virtual Chassis Verification |
|
|
700 | (2) |
|
|
702 | (1) |
|
|
703 | (1) |
|
VCP Interface Class of Service |
|
|
704 | (11) |
|
VCP Traffic Encapsulation |
|
|
704 | (1) |
|
VCP Class of Service Walkthrough |
|
|
704 | (2) |
|
|
706 | (1) |
|
|
707 | (2) |
|
|
709 | (1) |
|
|
710 | (1) |
|
|
711 | (3) |
|
|
714 | (1) |
|
|
715 | (1) |
|
|
716 | (1) |
|
|
717 | (2) |
7 Trio Load Balancing |
|
719 | (42) |
|
Junos Load Balancing Overview |
|
|
719 | (7) |
|
Per-Prefix Versus Per-Flow Load Balancing |
|
|
720 | (1) |
|
|
721 | (1) |
|
|
721 | (1) |
|
|
722 | (4) |
|
Junos Load Balancing Summary |
|
|
726 | (1) |
|
Trio Load Balancing and Backward Compatibility |
|
|
726 | (14) |
|
Host Outbound Load Balancing |
|
|
727 | (1) |
|
Configure Per-Family Load Balancing |
|
|
727 | (11) |
|
Family and Enhanced Hash Field Summary |
|
|
738 | (1) |
|
|
738 | (2) |
|
|
740 | (17) |
|
The Problem of Polarization |
|
|
740 | (2) |
|
|
742 | (2) |
|
|
744 | (4) |
|
|
748 | (9) |
|
|
757 | (1) |
|
|
758 | (2) |
|
|
760 | (1) |
8 Trio Inline Services |
|
761 | (80) |
|
What Are Trio Inline Services? |
|
|
761 | (1) |
|
|
762 | (15) |
|
|
763 | (1) |
|
|
763 | (1) |
|
Inline IPFIX Software Architecture |
|
|
764 | (2) |
|
Inline IPFIX Configuration |
|
|
766 | (9) |
|
Inline IPFIX Verification |
|
|
775 | (2) |
|
|
777 | (1) |
|
Network Address Translation |
|
|
777 | (20) |
|
|
777 | (2) |
|
Services Inline Interface |
|
|
779 | (1) |
|
|
780 | (15) |
|
Destination NAT Configuration |
|
|
795 | (2) |
|
Network Address Translation Summary |
|
|
797 | (1) |
|
|
797 | (27) |
|
|
798 | (3) |
|
A Tunneled Packet Walkthrough |
|
|
801 | (2) |
|
Tunnel Services Redundancy |
|
|
803 | (6) |
|
Inline GRE with Filter-Based Tunnel |
|
|
809 | (2) |
|
Case Study: Traffic Mitigation Based on GRE Filter-Based Tunnel |
|
|
811 | (4) |
|
Case Study: Interconnect Logical and Physical Routers |
|
|
815 | (9) |
|
|
824 | (1) |
|
|
824 | (9) |
|
Port Mirror Supported Families |
|
|
826 | (1) |
|
Port Mirroring Case Study |
|
|
827 | (5) |
|
|
832 | (1) |
|
|
833 | (5) |
|
Layer 2 Analyzer Configuration |
|
|
833 | (3) |
|
Layer 2 Analyzer Case Study |
|
|
836 | (2) |
|
|
838 | (1) |
|
|
838 | (1) |
|
|
838 | (2) |
|
|
840 | (1) |
9 Multi-Chassis Link Aggregation |
|
841 | (80) |
|
Multi-Chassis Link Aggregation |
|
|
841 | (6) |
|
|
843 | (1) |
|
|
844 | (1) |
|
Multi-Chassis Link Aggregation Versus MX Virtual Chassis |
|
|
845 | (2) |
|
|
847 | (1) |
|
Inter-Chassis Control Protocol |
|
|
847 | (17) |
|
|
848 | (2) |
|
|
850 | (1) |
|
|
851 | (6) |
|
ICCP Configuration Guidelines |
|
|
857 | (6) |
|
|
863 | (1) |
|
|
864 | (1) |
|
|
864 | (9) |
|
|
865 | (2) |
|
|
867 | (5) |
|
|
872 | (1) |
|
|
873 | (44) |
|
Logical Interfaces and Loopback Addressing |
|
|
874 | (1) |
|
|
875 | (14) |
|
|
889 | (6) |
|
|
895 | (13) |
|
Connectivity Verification |
|
|
908 | (9) |
|
|
917 | (1) |
|
|
917 | (1) |
|
|
918 | (1) |
|
|
919 | (2) |
10 Junos High Availability on MX Routers |
|
921 | (120) |
|
Junos High-Availability Feature Overview |
|
|
921 | (2) |
|
Graceful Routing Engine Switchover |
|
|
923 | (19) |
|
|
924 | (4) |
|
|
928 | (13) |
|
|
941 | (1) |
|
|
942 | (21) |
|
|
942 | (1) |
|
Graceful Restart Operation: OSPF |
|
|
943 | (5) |
|
Graceful Restart and Other Routing Protocols |
|
|
948 | (5) |
|
Configure and Verify OSPF GR |
|
|
953 | (10) |
|
|
963 | (1) |
|
Nonstop Routing and Bridging |
|
|
963 | (52) |
|
Replication, the Magic That Keeps Protocols Running |
|
|
964 | (6) |
|
|
970 | (2) |
|
|
972 | (6) |
|
This NSR Thing Sounds Cool: So What Can Go Wrong? |
|
|
978 | (6) |
|
|
984 | (2) |
|
|
986 | (28) |
|
|
1014 | (1) |
|
In-Service Software Upgrades |
|
|
1015 | (9) |
|
|
1015 | (5) |
|
ISSU Layer 3 Protocol Support |
|
|
1020 | (1) |
|
|
1021 | (1) |
|
ISSU: A Double-Edged Knife |
|
|
1021 | (3) |
|
|
1024 | (1) |
|
|
1024 | (11) |
|
|
1026 | (2) |
|
|
1028 | (7) |
|
|
1035 | (1) |
|
|
1036 | (2) |
|
|
1038 | (3) |
11 The Virtual MX |
|
1041 | (44) |
|
Why Use vMX and for What Purpose? |
|
|
1041 | (9) |
|
|
1042 | (1) |
|
|
1043 | (2) |
|
Deployments to Use with vMX |
|
|
1045 | (5) |
|
A Technical Overview of vMX |
|
|
1050 | (5) |
|
Several vMX Instances per Server |
|
|
1051 | (2) |
|
Network Virtualization Techniques for vMX |
|
|
1053 | (1) |
|
|
1053 | (2) |
|
|
1055 | (1) |
|
vMX and the Virtual World |
|
|
1055 | (10) |
|
|
1057 | (8) |
|
|
1065 | (1) |
|
Resources for Installing vMX for Lab Simulation |
|
|
1065 | (3) |
|
vMX Initial Configuration |
|
|
1066 | (2) |
|
Technical Details of the vMX |
|
|
1068 | (13) |
|
|
1069 | (7) |
|
|
1076 | (3) |
|
|
1079 | (2) |
|
|
1081 | (1) |
|
|
1082 | (1) |
|
|
1083 | (2) |
Index |
|
1085 | |