If you work with Juniper hardware and have never used the Juniper Port Checker, you are missing out on a really useful tool. It is part of the Juniper Pathfinder suite and it gives you a visual representation of the front panel of a device and lets you configure port speeds to validate that your planned configuration is actually supported by the hardware. No more digging through data sheets trying to figure out what happens to adjacent ports when you change a speed.

I have seen similar conditions as these ports can also be used for the Virtual Chasis (VC) ports. What I did find interesting is that the normal way I have always changed VC-Ports on Junos did not work.

First, let us look at the vc-ports on this EX4400-24T:

{master:0}
lab@ex2> show virtual-chassis vc-port 
fpc0:
--------------------------------------------------------------------------
Interface   Type              Trunk  Status       Speed        Neighbor
or                             ID                 (mbps)       ID  Interface
PIC / Port
1/0         Configured         -1    Down         50000
1/1         Configured         -1    Down         50000
1/2         Configured         -1    Down         50000
1/3         Configured         -1    Down         50000

As you can see, we have 4 VC-Ports configured on Pic 1 – Ports 0-3.

Virtual Router Redundancy Protocol (VRRP) is commonly deployed on corporate networks in order to maintain default gateway redundancy for hosts. In this post, I will show you the commands to configure VRRP with route-tracking and interface-tracking.

For this lab, I will be using EVE-NG with four vSRX running 12.1X47-D15.4 code in packet-mode. I am using this version as it has the same features as newer codes, yet is less impactful on my lab hardware. The diagram for this lab is below, you can find the starting and ending configs at my GitHub repository. The root password for the devices is juniper123. BGP has been configured between INET and WAN1/WAN2 and is passing a default (0/0) route.

First up we will configure our VRRP on WAN1 and WAN2 using the virtual IP of 192.168.255.1. To configure VRRP there are a few things we need to remember in Junos.

• The VRRP group on both routers has to match
• In order to ping, you need to configure accept-data
• VRRP is configured under the interface IP address
• Higher priority is the preferred master
• Preempt is required if you want to allow for the backup to take over

I figured I would take a moment and recap theses past few posts and talk about the different methods now that we understand what they are. I also want to talk about some of the things to consider when choosing your approach.

Policy-Based with Security Policies

In our first post, we covered using security policies to establish and pass the traffic over the tunnel. There are a few challenges with this type of configuration is that you need to be keenly aware of.

You need to keep in mind that the order of security policies is critical. If you have a policy that permits or denies this traffic before the policy that says to tunnel the traffic, you will never send the traffic over the tunnel. Also, new security policies are always placed at the end of the current policies, so when you add a new VPN, you will need to remember to insert the new policy in the proper location.

Policy-based VPNs are a pain most of the time, especially when compared to route-based VPNs. Many of the policy-based VPNs I run across today are legacy configurations dealing with ASA or interop between vendors where the one side only supported policy-based VPNs.

With Junos, there are four ways to configure VPNs to support policy-based VPN requirements. Two are a true policy-based VPN and the other two are actually route-based VPNs that support policy-based VPNs.

The four different VPN configuration options are:

• Uni-directional policy-based VPN (Covered in this post)
• Bi-directional policy-based VPN (Covered in this post at the end)
• IPSEC proxy-identity route-based (Coming soon)
• IPSEC Traffic selectors route-based (Coming soon)

There will be four posts in this series. The first post will cover the first two items listed above, the second will cover proxy-identity, the third will cover traffic-selectors, and the last post will be a wrap-up recap with pros and caveats to each option.

I will be using Juniper vLabs IPSEC VPN Policy-based lab for all these posts. We will only be working with one SRX to emulate what setting up a VPN would really be like. Feel free to head on over there and spin the lab up yourself when you are ready and kick the tires on these different configurations. Below is our diagram for the lab topology.

A little over a year ago Juniper released Juniper vLabs. What vLabs is, is a place where you can safely lab and learn on Juniper virtualized hardware. When it was first launched there where about six labs available:

If you check out Juniper vLabs today, you will find 20 labs available across five different topic areas. With these labs, and I did test out a few, you do need to “reserve” them and you get them for about 3-hours. Everyone that I “reserved” was available immediately and ready to go in about 15 minutes. I did receive e-mails when I reserved when the lab was ready, and when I ended it.

This blog post was spurred on by a recent real-world experience where I had to configure a primary IP address on an ISP facing interface. In this scenario, we needed to maintain the corporate ARIN assigned IP on an interface for VPN traffic to originate from and terminate on. Yet the ISP would only allow the customer to use the ISP provided IP address for BGP peering.

Fair warning, this is a bit of a long one and has a twist and turn. Also, take note that I am using interface overload NAT only for demonstration purposes.

There was some discussion around the primary and preferred interface commands, so why not learn more about it and, in turn, write a blog post about it.

Below is the lab diagram we will use for this blog post. I have preconfigured the devices to pass traffic with vSRX2 set to NAT all internal traffic to its outside (ge-0/0/2) interface. vSRX1, vSRX3, and vSRX4 are all configured in packet mode to keep the configurations simple. You can find a copy of the eve-ng topology, starting configs, and ending configs at the end of this post.

Over the past couple of years, Juniper has hosted a Hackathon at start of NXTWORK. This event is a great way to meet new people, start to get in the groove of challenging technology and just have some fun. When you register for NXTWORK, there is an option to sign up for the Hackathon.

In 2017 we did a Red Team / Blue Team attach where the RED team was using Kali Linux to attach the Blue Team. We had to take advantage of OS and vendor exploits to gain access. The Blue Team was there monitoring and reporting on our activities as they could not stop (rules) us from entering their network.

Earlier this week I did a post on Juniper NXTWORK and talked about the event. There is a lot going on that week, but one of the best things is the FREE JCNP level certification testing that is available. I wanted to elaborate a bit more on the testing, how to register, and what to expect.

Let us start with the JNCIE lab exams that are available for 50% off. All of the JNCIE labs – ENT JPR-944, -CLOUD JPR-911, -SEC JPR-933, -DC JPR-980, and -SP JPR-960 – are available on the November 9th and 10th. The exam times are from 9 AM to 6 PM both days, except for the new ENT and CLOUD which are 6-hour exams. To register for a JNCIE lab exam, you must have the required JNCIP level certification and e-mail certification@juniper.net with your Full Name, Cert Manager ID (JPRxxxx), Exam Name, and what date you would like to take it. There is limited seating, so they are first come first serve.

Similar to last year, Juniper is offering a limited amount of discounted JNCIE labs on Saturday and Sunday (9th and 10th). I took the JNCIE-SEC lab at the event last year and the testing was just like if you took the test in their Herndon, VA location. You are remote to the equipment and provided a laptop to access everything with. If you are looking to take a JNCIE lab, this is a great opportunity to save some monies and give it a go! Once you register you can select that you want to book a lab and the Certification team will contact you.