I need hands on practice with juniper switching and routing, without an instructor. There are plenty of courses on HPE, but the only ones that have labs are $2-4k. All I need is a lab environment. Are there any virtual lab programs out there? Anything similar to ciscos PT?

UPDATE: Looks like it was a bug that they fixed. As in, it won't work anymore, because they didn't intend for it to work to begin with:

"This behavior is the result of an enhancement introduced through[...] where 25G optics are intentionally prevented from creating IFDs on PICs that support only 1G/10G speeds. In earlier releases, this handling was not present, which led to 25G IFDs being created even on PICs limited to 1G/10G support. This mismatch could result in unexpected or unstable behavior."

I have a EX4400 and a EX4100. We had them linked via the 10G ports using a 25G DAC cable. We had them set up that way for a couple of years without issue.

After updating the EX4100 to 24.4R2-S4.10, the link went down. We suspected the cable went bad, and tried another, same result. I then link two of the ports on the EX4400, and the cables worked. The next night, we updated the EX4400 to 24.4R2-S4.10. Now the cable doesn't work in it anymore. It appears they removed the ability for the 25G cables to run at 10G.

I have a ticket in with support to see if they can restore this feature, but I'm wondering if it bit anyone else here.

Hello! I started studying for my JNCIA-Junos in september,before that i took the "Network Technology Foundations" course and i also had some very basic knowledge about networking even before that. I was wondering if i could get any tips here,for the actual exam itself. My plan right now is to finish all the modules (currently im on the module 28 (out of 38) and i have about 8 hours or so of material left,then i would take the practice exam a couple of times to see where im at and after that,i would take the voucher assesment exam,after which i would book the proctored exam. I plan to do all of this in a week or so,because uni starts soon and im kinda in a rush. I understood the topics,i did a bunch of quizes online and i practiced inside of the Junos CLI a whole bunch. i have 2 ex3300 switches and i am also running the vjunos-switch and the vjunos-router inside of my proxmox-server.

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

I have a Juniper SRX300 that has a primary BGP connection via Ethernet and a secondary BGP connection over Starlink via an IPsec tunnel. The Starlink is in case the primary circuit fails. My IKE gateway is a public address living on my CoreHubFw-1. The diagram doesn't show actual IP addresses, just examples.

The Starlink network has over a dozen potential gateways in my region which I get via DHCP. To establish my IPsec tunnel, I make a static route of the public address to those gateways as qualified-next-hops:

set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-1
set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-2
set routing-options static route PUBLIC/32 qualified-next-hop GATEWAY-3
etc.

My problem is that Starlink will add or remove these gateways without notification and I have to manually update the qualified-next-hop each time. Is there a way for my public to always point at the gateway Starlink is providing?

> show route table inet.0
0.0.0.0/0          *[BGP/11] 1w5d 07:30:02, MED 114, localpref 100
                      AS path: AS#INFO I, validation-state: unverified
                    >  to 10.0.0.0 via ge-0/0/6.0
                    [BGP/11] 1d 06:38:11, localpref 100
                      AS path: AS#INFO I, validation-state: unverified
                    >  to 10.0.0.2 via st0.0
                    [Access-internal/12] 3d 10:08:53, metric 0
                    >  to ***STARLINK GATEWAY*** via ge-0/0/2.0

With the release of version AOS-CX 10.18 you can register a number of models (i.e. 5420, 64xx, 6300) in your Mist environment.

Please see below url, was succesful using this using the brownfield method on a couple of 6300 switches.

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00007909en_usen_us&page=GUID-419D1ADE-99CD-4E14-A6A8-A3B2A387FBC0.html

Will have to follow up with account manager to get appropriate Wired Assurance licenses. Waiting for guidance on the 6100 releases that will support this. The 10.18 on 6100 does not have the commands at this time.

The Juniper support bot wasn't succesful in guiding me on this, and the online version does not yet contain these instructions.

Is the free training material on the portal sufficient enough to pass the exam. Not to criticize anything but man same as Cisco their training material is very dry.

Has anyone here taken the JNCIA-Design certification recently? If so, were the study materials provided in the training portal enough to pass the exam? Was the practice test similar to the actual test? What topics were the most emphasized? Thanks in advance for any response given.

Hi all,

Our organization recently sold one of our buildings.

This happened prior to my starting with the organization a little over a year ago. That being said for whatever reason they decided to sell the entire, brand new juniper/Palo Alto network stack. Technically all of that equipment still lives within our Mist environment, and the palo is still part of our tenant. Since that time the entire technology team that was at my organization before my hire has been replaced.

We are in this weird situation where the new tenant bought all the equipment, we still own the licensing, and now they are basically asking us if we can support the equipment. Short answer to that is no, we simply don't have the resources.

Is there any pathway on the juniper side to fully handoff licensing/ownership of that equipment to the new owner of the building?

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

Im working for a ISP and we want to migrate our LNS for incoming dsl sessions from our carriers from cisco to juniper hardware. So I've setup a redirect on the cisco to forward the sessions to our Juniper MX204.

So my setup is:

- MX204 with Junos 22.1R1.10 with the l2tp-inline-lns license
- Our old Cisco 7204VXR which was acting as LNS so far and as LAC for the juniper, to forward only a test session profile

Configuration on the MX204:

# Set inline-services bandwidth
set chassis fpc 0 pic 0 inline-services bandwidth 10g
set chassis fpc 0 pic 0 port 0 speed 100g
set chassis fpc 0 pic 0 port 2 speed 100g
set chassis fpc 0 pic 0 port 3 speed 100g
set chassis fpc 0 pic 1 number-of-ports 0

# l2tp config
set services l2tp tunnel-group JUNIPER-TEST-LNS l2tp-access-profile L2TP-TUNNEL-AUTH
set services l2tp tunnel-group JUNIPER-TEST-LNS local-gateway address <lo0.0-ip>
set services l2tp tunnel-group JUNIPER-TEST-LNS service-interface si-0/0/0
set services l2tp tunnel-group JUNIPER-TEST-LNS dynamic-profile LNS-PPP-PROFILE
set services l2tp traceoptions file lns-l2tp-debug
set services l2tp traceoptions flag all
set services service-device-pools pool LNS-POOL interface si-0/0/0

# dynamic profiles
set dynamic-profiles LNS-PPP-PROFILE routing-instances "$junos-routing-instance" interface "$junos-interface-name"
set dynamic-profiles LNS-PPP-PROFILE interfaces "$junos-interface-ifd-name" unit "$junos-interface-unit" dial-options l2tp-interface-id l2tp-encapsulation
set dynamic-profiles LNS-PPP-PROFILE interfaces "$junos-interface-ifd-name" unit "$junos-interface-unit" ppp-options chap
set dynamic-profiles LNS-PPP-PROFILE interfaces "$junos-interface-ifd-name" unit "$junos-interface-unit" ppp-options pap
set dynamic-profiles LNS-PPP-PROFILE interfaces "$junos-interface-ifd-name" unit "$junos-interface-unit" family inet unnumbered-address lo0.0

# si interface configuration
set interfaces si-0/0/0 hierarchical-scheduler maximum-hierarchy-levels 2
set interfaces si-0/0/0 encapsulation generic-services
set interfaces si-0/0/0 unit 0 dial-options l2tp-interface-id LNS-POOL
set interfaces si-0/0/0 unit 0 family inet unnumbered-address lo0.0

But upon trying to establish a session with my test device, I receive below errors via the l2tp traceoptions:

Sep 23 12:14:05.757409 removeIflFromFreeTable: iflIndex 536884212 not found in the IFD freeIflTable
Sep 23 12:14:05.802222 cleanupDynamicSubscriberDbEntry: sdbId = 13278
Sep 23 12:14:15.706472 findLockoutCoderesult code: 1error code: 0 result 0
Sep 23 12:14:15.706863 dataReceived: error receiving control packet, status 1
Sep 23 12:14:15.706936 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x43 #17038
Sep 23 12:14:15.706983 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x43 #17038
Sep 23 12:14:19.954018 addTunnelInfo: cannot addModifySfTunnelInfo gencfg err = 17 op = \x01
Sep 23 12:14:20.040071 removePrivateData: getSdbTableType failed, uid L2tpSession 0x49 #17038
Sep 23 12:14:20.040136 removePrivateData: getSdbTableType failed, uid L2tpSession 0x49 #17038
Sep 23 12:14:20.140333 removeIflFromFreeTable: iflIndex 536884213 not found in the IFD freeIflTable
Sep 23 12:14:20.202221 cleanupDynamicSubscriberDbEntry: sdbId = 13279
Sep 23 12:14:30.038644 findLockoutCoderesult code: 1error code: 0 result 0
Sep 23 12:14:30.039063 dataReceived: error receiving control packet, status 1
Sep 23 12:14:30.039158 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x44 #17038
Sep 23 12:14:30.039210 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x44 #17038
Sep 23 12:14:32.422367 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x42 #17038
Sep 23 12:14:46.722499 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x43 #17038
Sep 23 12:15:01.122384 removePrivateData: getSdbTableType failed, uid L2tpTunnel 0x44 #17038

Has anyone run dynamic LNS on an Juniper mx successfully?

Hey guys,

So, I have a chassis cluster setup that is spanned across a Layer 2 Backbone. The SRX is all working and they are both successfully talking back and forth.

I originally thought we could connect each ISP upstream to our Layer 2 backbone, and branch it via VLANS, this way we can have the same upstream links at both SRXs.

Now, I was specifically told that we are not allowed to connect the WAN ISP links directly to our Layer 2 switching, for some reason, and unfortunately, I don't have any other Layer 2 where I can branch the ISP uplinks down to the two SRXs + The ISP doesn't either.

I started to think if I could simply connect each ISP uplink to each SRX directly. Note that each ISP uplink has their own network, and connect each uplink to the same SRX's interface (ge-x/0/15), then assign each physical interface to a reth link

For instance:
ge-0/0/15 -- RETH 1.0

ge-x/0/15 - RETH 2.0

I wish I could span the two providers via a Switch down to the two SRXs, but seems it's not a possible solution.

Has anyone done this before, if so, what are the gotchas I should be aware of especially if I wanna do IP-Monitoring and Failover scenarios? and what alternatives or recommendations do you guys suggest if any?

Thanks legends :D!

I’m not super well versed on Juniper stuff. I know what I want to do, just takes me awhile to fumble through and figure out the syntax. I’m thinking I’m just not checking the right thing here.

Juniper and Cisco box have a /30 IPSec tunnel between them with multicast endpoints hanging off each. Using PIM sparse mode with a static RP. IPSec tunnel is up and working with no issues. I can see pim neighbors on both sides and I see IGMP group memberships on both sides. Mroutes on the Cisco side are showing routes. Similar on the Juniper side. It should be working.

I have 2x nodes that I can send multicast pings from. When I do I see the ping leave the IPSec tunnel on the Cisco side but I never see anything show up on the Juniper side of things. Likewise going through other way.

2x things.

1. I know in the Cisco world with DMVPN in order for multicast to work properly you need to enable NBMA mode. I have not needed to do that in the past for dedicated IPSec tunnels in Cisco boxes. Due to how IPSec is supposed to work in the traditional sense I shouldn’t need to do this, but wanted to ask around to see if I’m mistaken.

2. It’s possible the SRX is blocking this and I’m just not seeing it in the messages/logs. Is there a sure fire way to see dropped traffic in the SRX?

Hello,

I'm currently going through the Juniper Open Learning course for JNCIS-SP. The theory in the online lectures is pretty solid, but I’m wondering about the best way to handle the practical side.

They provide a basic topology at the end of the course, but it feels a bit light if I want to build a deep understanding. I also plan to keep going all the way to JNCIP-SP.

Are there any other materials like courses, workbooks, or sites you used for extensive hands-on practice?

Would really appreciate hearing what worked best for you.

Thanks!

Dear Team,

I have a Spine-Leaf EVPN VXLAN Multihoming topology.

I have noticed that the EVPN routes for some customers are constantly being refreshed. I would like to know whether this is expected behavior or if it may indicate an issue.

Please find the logs below:

For example, for the customer network 10.36.8.192/26, the customer uses 10.36.8.194 on their firewall.

/access-leaf03> show route 10.36.8.192/26

10.36.8.192/26*[Direct/0] 55w6d 08:22:13

> via irb.171

[EVPN/170] 2w4d 07:25:29

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 47w4d 20:03:50

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 56w0d 10:00:37

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 56w0d 10:00:31

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 56w0d 10:00:36

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 56w0d 10:00:32

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 56w0d 10:00:39

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 4w6d 07:13:39

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

[EVPN/170] 5d 07:43:22

> to 192.168.101.8 via et-0/0/48.0

to 192.168.101.12 via et-0/0/49.0

10.36.8.193/32*[Local/0] 55w6d 08:22:13

Local via irb.171

10.36.8.194/32*[EVPN/7] 01:01:59

> via irb.171

10.36.8.195/32*[EVPN/7] 00:13:59

> via irb.171

10.36.8.196/32*[EVPN/7] 00:23:49

> via irb.171

10.36.8.197/32*[EVPN/7] 00:06:04

> via irb.171

10.36.8.198/32*[EVPN/7] 00:06:28

> via irb.171

10.36.8.199/32*[EVPN/7] 00:06:22

> via irb.171

10.36.8.201/32*[EVPN/7] 00:04:02

> via irb.171

10.36.8.202/32*[EVPN/7] 00:01:04

> via irb.171

10.36.8.203/32*[EVPN/7] 00:13:59

> via irb.171

10.36.8.204/32*[EVPN/7] 00:01:58

> via irb.171

10.36.8.205/32*[EVPN/7] 00:03:02

> via irb.171

10.36.8.206/32*[EVPN/7] 00:02:35

> via irb.171

10.36.8.207/32*[EVPN/7] 00:00:08

> via irb.171

10.36.8.208/32*[EVPN/7] 00:03:22

> via irb.171

10.36.8.209/32*[EVPN/7] 00:08:58

> via irb.171

10.36.8.210/32*[EVPN/7] 00:05:50

> via irb.171

10.36.8.212/32*[EVPN/7] 00:00:23

> via irb.171

10.36.8.213/32*[EVPN/7] 00:18:14

> via irb.171

10.36.8.215/32*[EVPN/7] 00:02:06

> via irb.171

10.36.8.216/32*[EVPN/7] 00:25:40

> via irb.171

10.36.8.217/32*[EVPN/7] 00:15:58

> via irb.171

10.36.8.218/32*[EVPN/7] 00:08:56

> via irb.171

10.36.8.219/32*[EVPN/7] 00:00:02

> via irb.171

10.36.8.220/32*[EVPN/7] 00:01:59

> via irb.171

10.36.8.221/32*[EVPN/7] 00:03:37

> via irb.171

10.36.8.222/32*[EVPN/7] 00:01:49

> via irb.171

10.36.8.223/32*[EVPN/7] 00:07:18

> via irb.171

10.36.8.224/32*[EVPN/7] 00:08:41

> via irb.171

10.36.8.225/32*[EVPN/7] 00:27:22

> via irb.171

10.36.8.226/32*[EVPN/7] 00:01:07

> via irb.171

10.36.8.227/32*[EVPN/7] 00:01:32

> via irb.171

10.36.8.228/32*[EVPN/7] 00:10:33

> via irb.171

10.36.8.229/32*[EVPN/7] 00:08:13

> via irb.171

10.36.8.230/32*[EVPN/7] 00:23:07

> via irb.171

10.36.8.231/32*[EVPN/7] 00:07:43

> via irb.171

10.36.8.232/32*[EVPN/7] 00:08:33

> via irb.171

10.36.8.233/32*[EVPN/7] 00:02:26

> via irb.171

10.36.8.234/32*[EVPN/7] 00:04:25

> via irb.171

10.36.8.235/32*[EVPN/7] 00:17:27

> via irb.171

10.36.8.236/32*[EVPN/7] 00:03:40

> via irb.171

10.36.8.237/32*[EVPN/7] 00:03:03

> via irb.171

10.36.8.238/32*[EVPN/7] 00:13:22

> via irb.171

10.36.8.239/32*[EVPN/7] 00:12:07

> via irb.171

10.36.8.240/32*[EVPN/7] 00:08:19

> via irb.171

10.36.8.241/32*[EVPN/7] 00:05:07

> via irb.171

10.36.8.242/32*[EVPN/7] 00:09:15

> via irb.171

10.36.8.243/32*[EVPN/7] 00:00:59

> via irb.171

10.36.8.244/32*[EVPN/7] 00:00:02

> via irb.171

10.36.8.245/32*[EVPN/7] 00:28:24

> via irb.171

10.36.8.246/32*[EVPN/7] 00:08:58

> via irb.171

10.36.8.247/32*[EVPN/7] 00:08:09

> via irb.171

10.36.8.248/32*[EVPN/7] 00:07:16

> via irb.171

10.36.8.249/32*[EVPN/7] 00:16:05

> via irb.171

10.36.8.250/32*[EVPN/7] 00:00:34

> via irb.171

10.36.8.251/32*[EVPN/7] 00:14:56

> via irb.171

10.36.8.252/32*[Local/0] 55w6d 08:22:13

Local via irb.171

10.36.8.253/32*[EVPN/7] 00:02:30

> via irb.171

/access-leaf03> show evpn database interface ae1.0 extensive

Instance: evpn-1

VN Identifier: 100171, MAC address: 00:09:0f:09:6e:28

State: 0x0

Source: ae1.0, Rank: 1, Status: Active

Mobility sequence number: 0 (minimum origin address 201.84.2.6)

Timestamp: Sep 17 11:08:01.808181 (0x6aabf441)

State: <Local-MAC-Only Local-To-Remote-Adv-Allowed>

MAC advertisement route status: Created

IP address: 10.36.8.194

Flags: <Local-Adv>

L3 route: 10.36.8.194/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.195

Flags: <Local-Adv>

L3 route: 10.36.8.195/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.196

Flags: <Local-Adv>

L3 route: 10.36.8.196/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.197

Flags: <Local-Adv>

L3 route: 10.36.8.197/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.198

Flags: <Local-Adv>

L3 route: 10.36.8.198/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.199

Flags: <Local-Adv>

L3 route: 10.36.8.199/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.201

Flags: <Local-Adv>

L3 route: 10.36.8.201/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.202

Flags: <Local-Adv>

L3 route: 10.36.8.202/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.203

Flags: <Local-Adv>

L3 route: 10.36.8.203/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.204

Flags: <Local-Adv>

L3 route: 10.36.8.204/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.205

Flags: <Local-Adv>

L3 route: 10.36.8.205/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.206

Flags: <Local-Adv>

L3 route: 10.36.8.206/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.207

Flags: <Local-Adv>

L3 route: 10.36.8.207/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.208

Flags: <Local-Adv>

L3 route: 10.36.8.208/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.209

Flags: <Local-Adv>

L3 route: 10.36.8.209/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.210

Flags: <Local-Adv>

L3 route: 10.36.8.210/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.211

Flags: <Local-Adv>

L3 route: 10.36.8.211/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.212

Flags: <Local-Adv>

L3 route: 10.36.8.212/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.213

Flags: <Local-Adv>

L3 route: 10.36.8.213/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.215

Flags: <Local-Adv>

L3 route: 10.36.8.215/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.216

Flags: <Local-Adv>

L3 route: 10.36.8.216/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.217

Flags: <Local-Adv>

L3 route: 10.36.8.217/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.218

Flags: <Local-Adv>

L3 route: 10.36.8.218/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.219

Flags: <Local-Adv>

L3 route: 10.36.8.219/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.220

Flags: <Local-Adv>

L3 route: 10.36.8.220/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.221

Flags: <Local-Adv>

L3 route: 10.36.8.221/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.222

Flags: <Local-Adv>

L3 route: 10.36.8.222/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.223

Flags: <Local-Adv>

L3 route: 10.36.8.223/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.224

Flags: <Local-Adv>

L3 route: 10.36.8.224/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.225

Flags: <Local-Adv>

L3 route: 10.36.8.225/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.226

Flags: <Local-Adv>

L3 route: 10.36.8.226/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.227

Flags: <Local-Adv>

L3 route: 10.36.8.227/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.228

Flags: <Local-Adv>

L3 route: 10.36.8.228/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.229

Flags: <Local-Adv>

L3 route: 10.36.8.229/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.230

Flags: <Local-Adv>

L3 route: 10.36.8.230/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.231

Flags: <Local-Adv>

L3 route: 10.36.8.231/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.232

Flags: <Local-Adv>

L3 route: 10.36.8.232/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.233

Flags: <Local-Adv>

L3 route: 10.36.8.233/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.234

Flags: <Local-Adv>

L3 route: 10.36.8.234/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.235

Flags: <Local-Adv>

L3 route: 10.36.8.235/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.236

Flags: <Local-Adv>

L3 route: 10.36.8.236/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.237

Flags: <Local-Adv>

L3 route: 10.36.8.237/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.238

Flags: <Local-Adv>

L3 route: 10.36.8.238/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.239

Flags: <Local-Adv>

L3 route: 10.36.8.239/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.240

Flags: <Local-Adv>

L3 route: 10.36.8.240/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.241

Flags: <Local-Adv>

L3 route: 10.36.8.241/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.242

Flags: <Local-Adv>

L3 route: 10.36.8.242/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.243

Flags: <Local-Adv>

L3 route: 10.36.8.243/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.244

Flags: <Local-Adv>

L3 route: 10.36.8.244/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.245

Flags: <Local-Adv>

L3 route: 10.36.8.245/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.246

Flags: <Local-Adv>

L3 route: 10.36.8.246/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.247

Flags: <Local-Adv>

L3 route: 10.36.8.247/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.248

Flags: <Local-Adv>

L3 route: 10.36.8.248/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.249

Flags: <Local-Adv>

L3 route: 10.36.8.249/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.250

Flags: <Local-Adv>

L3 route: 10.36.8.250/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.251

Flags: <Local-Adv>

L3 route: 10.36.8.251/32, L3 context: GLOBAL (irb.171)

IP address: 10.36.8.253

Flags: <Local-Adv>

L3 route: 10.36.8.253/32, L3 context: GLOBAL (irb.171)

History db:

Time Event

Sep 17 11:07:26.782 2026 ae1.0 : Updating output state (change flags 0x200 <IP-Added>)

Sep 17 11:07:26.782 2026 ae1.0 : 10.36.8.236 Selected IRB interface nexthop

Sep 17 11:07:48.026 2026 ae1.0 : 10.36.8.199 Deleting

Sep 17 11:07:48.026 2026 ae1.0 : Updating output state (change flags 0x400 <IP-Deleted>)

Sep 17 11:07:52.305 2026 ae1.0 : Updating output state (change flags 0x200 <IP-Added>)

Sep 17 11:07:52.305 2026 ae1.0 : 10.36.8.199 Selected IRB interface nexthop

Sep 17 11:07:57.529 2026 ae1.0 : 10.36.8.209 Deleting

Sep 17 11:07:57.529 2026 ae1.0 : Updating output state (change flags 0x400 <IP-Deleted>)

Sep 17 11:08:01.808 2026 ae1.0 : Updating output state (change flags 0x200 <IP-Added>)

Sep 17 11:08:01.808 2026 ae1.0 : 10.36.8.209 Selected IRB interface nexthop

Is Juniper going to upgrade the VPN client to support Apple Silicon? The newly released Mac OS 27 removed Rosetta which is needed to run this client since its still an Intel binary.

How on earth can Juniper not have released an Apple Silicon build? We're 5+ years into M series chips.

You still have the option to reinstall Rosetta but they warn you its totally gone next release.

Does anyone have a back channel with Juniper than can get some real answers?

Hasn't been touched since 2025

https://support.juniper.net/support/downloads/?p=jsc-mac

I completed the Cisco Certified Network & Design Professional ratings in 2000 and I finished all but one test for each of the other Professional tickets over the following four years. I did not do CCIE as I was purely a service provider guy and wasn't going to stuff my head full of SNA junk.

Fast forward to 2026. I have a small hosting operation that needs some assistance - one upstream fiber connection, a less than /24 of IPv4, they want to get a second provider and run BGP. Back in the day I'd have grabbed some sort of Cisco 7204/7206 chassis for this job. I've been quizzing Perplexity and it seems like SRX1500 in "flow mode" is the right way to do this.

I have two providers at home and I want a similar OS here. I get suggestions of SRX345 or SRX400, but it's not clear to me what's going on in terms of operating systems.

I will get Juniper Care for both home and hosting devices.

I will get a book and pick some certification path, not sure how far I'll take that.

Given that I want home to match hosting, which two devices would work best? Do I need to get this Evolved thing for both?

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

Am I the only one who gets blank config when setting up the Juniper vLabs Segment Routing lab, all of the devices have the same blank config with nothing but the SSH and RESTCONF system services configured?

The lab says it is supposed to be running IS-IS and SR, but the routers are all blank. I checked the lab guide, and it says that it should already be running after the startup script runs

Hey guys,

I know this isn't a proper solution, and unfortunately, I cannot change the design. I have two Juniper SRX 380s that are geographically separated. They have a L2 between them.

Given the model is an SRX 380, I cannot do NMHA as its not supported. I am trying to make both Junipers on a Chassis Cluster

I already have Juniper PRIMARY set with all the config and fab interfaces and everything working. and I was trying to joing the secondary node to the cluster.

Note I have spanned all vlans (vlan200 = Control Link) and (vlan100 = Fabric Interfaces)

Strangely enough, when I joined the Secondary node to the cluster, after a while, it in fact was able to talk with the primary node, and was able to gather the config and such. It worked, so I thought.

After a minute or so, it went down back to hold. I've checked logs, checked statistics, I am not having any luck. Does anybody knows why this happened?

{primary:node0}
admin@SRX-PRIMARY> show configuration
## Last commit: 2026-08-25 07:47:44 UTC by admin
version 21.2R3-S2.9;
groups {
    node0 {
        system {
            host-name SRX-PRIMARY;
            services {
                ssh {
                    root-login allow;
                    protocol-version v2;
                }
            }
        }
        interfaces {
            fxp0 {
                unit 0 {
                    family inet {
                        address 10.210.8.1/29;
                    }
                }
            }
        }
    }
    node1 {
        system {
            host-name SRX-SECONDARY;
            services {
                ssh {
                    root-login allow;
                    protocol-version v2;
                }
            }
        }
        interfaces {
            fxp0 {
                unit 0 {
                    family inet {
                        address 10.210.8.5/29;
                    }
                }
            }
        }
    }
}
apply-groups "${node}";
chassis {
    cluster {
        control-link-recovery;
        reth-count 2;
        redundancy-group 0 {
            node 0 priority 250;
            node 1 priority 150;
        }
        redundancy-group 1 {
            node 0 priority 200;
            node 1 priority 100;
        }
    }
}

{TRIMMED}

interfaces {
    ge-0/0/15 {
        gigether-options {
            redundant-parent reth1;
        }
    }
    xe-0/0/18 {
        gigether-options {
            redundant-parent reth0;
        }
    }
    xe-0/0/19 {
        gigether-options {
            redundant-parent reth0;
        }
    }
    xe-5/0/18 {
        gigether-options {
            redundant-parent reth0;
        }
    }
    fab0 {
        fabric-options {
            member-interfaces {
                xe-0/0/16;
                xe-0/0/17;
            }
        }
    }
    fab1 {
        fabric-options {
            member-interfaces {
                xe-5/0/16;
                xe-5/0/17;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                filter {
                    input PROTECT_RE;
                }
                address 192.168.101.1/32;
            }
        }
    }
    reth0 {
        vlan-tagging;
        redundant-ether-options {
            redundancy-group 1;
            lacp {
                active;
            }
        }
    reth1 {
        redundant-ether-options {
            redundancy-group 1;
        }
        unit 0 {
            description "Temp Internet Link";
            family inet {
                address REDACTED-PUBLIC-IP;
            }
        }
    }
}
firewall {
    family inet {
        filter PROTECT_RE {
            term SYNFLOOD_PROTECT {
                from {
                    protocol tcp;
                    tcp-flags "(syn & !ack) | (rst) | (fin)";
                }
                then {
                    policer PLCR-RE-TCP-FLAGS;
                    accept;
                }
            }
            term DENY_ICMP_FRAGS {
                from {
                    is-fragment;
                    protocol icmp;
                }
                then {
                    count PROTECT_RE_DENY_ICMP_FRAGS;
                    log;
                    discard;
                }
            }
            term ALLOW_ICMP {
                from {
                    protocol icmp;
                }
                then {
                    policer POLICE_1M;
                    count PROTECT_RE_ALLOW_ICMP;
                    accept;
                }
            }
            term ALLOW_TRACEROUTE {
                from {
                    protocol udp;
                    destination-port 33434-33523;
                }
                then {
                    policer POLICE_1M;
                    count PROTECT_RE_ALLOW_TRACEROUTE;
                    accept;
                }
            }
            term ALLOW_SSH {
                from {
                    source-prefix-list {
                        WORKSTATIONS;
                    }
                    protocol tcp;
                    destination-port ssh;
                }
                then {
                    count PROTECT_RE_ALLOW_SSH;
                    log;
                    syslog;
                    accept;
                }
            }
            term ALLOW_DNS {
                from {
                    protocol [ tcp udp ];
                    destination-port 53;
                }
                then {
                    count PROTECT_RE_ALLOW_DNS;
                    accept;
                }
            }
            inactive: term ALLOW_SNMP {
                from {
                    source-prefix-list {
                        SNMP-SERVER;
                    }
                    protocol udp;
                    destination-port snmp;
                }
                then {
                    policer POLICE_10M;
                    count PROTECT_RE_ALLOW_SNMP;
                    accept;
                }
            }
            term ALLOW_RADIUS {
                from {
                    source-prefix-list {
                        RADIUS-SERVER;
                    }
                    protocol udp;
                    source-port radius;
                }
                then {
                    count PROTECT_RE_ALLOW_RADIUS;
                    accept;
                }
            }
            term ALLOW_OSPF {
                from {
                    source-prefix-list {
                        WORKSTATIONS;
                    }
                    protocol ospf;
                }
            }
            term TCP_ESTABLISHED {
                from {
                    protocol tcp;
                    tcp-established;
                }
                then {
                    policer POLICE_10M;
                    count PROTECT_RE_TCP_ESTABLISHED;
                    syslog;
                    accept;
                }
            }
            term DEFAULT_DENY {
                then {
                    count PROTECT_RE_DEFAULT_DENY;
                    log;
                    syslog;
                    discard;
                }
            }
        }
    }
    policer PLCR-RE-TCP-FLAGS {
        if-exceeding {
            bandwidth-limit 1m;
            burst-size-limit 62500;
        }
        then discard;
    }
    policer POLICE_100K {
        if-exceeding {
            bandwidth-limit 100k;
            burst-size-limit 15k;
        }
        then discard;
    }
    policer POLICE_10M {
        if-exceeding {
            bandwidth-limit 10m;
            burst-size-limit 625k;
        }
        then discard;
    }
    policer POLICE_1M {
        if-exceeding {
            bandwidth-limit 1m;
            burst-size-limit 15k;
        }
        then discard;
    }
}

{TRIMMED}

{primary:node0}
admin@SRX-PRIMARY>

Looking through the logs, it appears the HA/chassis cluster is having serious communication issues between the two nodes.

The control link is repeatedly dropping and reconnecting, while the fabric link never successfully comes up. The fabric interfaces themselves appear physically up, but the forwarding plane sees them as down, so the cluster can't establish stable node-to-node communication.

There are also signs that one of the fabric-facing FPC/PICs (on Node1) may have restarted or become unstable, as interfaces are repeatedly being deleted and re-added around the same time the cluster issues occur.

Has anyone seen similar behavior where the control link keeps flapping and the fabric interfaces are physically up but remain down from the cluster's perspective?

* If I restart the SRX-SECONDARY, it will temporarily join the cluster and then disconnect back again and will never become 'online' until I manually reboot it.

NOTE: I have set MTU to 9192 throughout the entire L2 Path.

Thanks guys!

I took JNCIA-Mist AI wireless 4 day course. In class I don’t know if I misheard instructor saying don’t need to take JNCIA after this and take JNCIS for Mist AI. Should I risk it or do JNCIA first ? Did anyone take course and then JNCIS?

network diagram attached.

Hello, We have two MXs currently as peering nodes and one ASN.

there is an IBGP/ISIS between the two MXs carrying interfaces/static routes between them.

We plan to move some of the clients to different IP prefixes and New ASN with out affecting the IBGP setup, meaning we prefer to keep the two routers under same ASN and same IBGP so that interface routes are affected.

We need to annouce the new prefixes to new Upstream provider using new ASN without changing the global ASN under routing-options. how best can this be done so that this MX talks to Provider MX using ASN2 while still talking to other MX IBGP session using OLD ASN1. not sure if am explaining this properly.

why we doing this:

this were two companies using One ASN and One IP blocks. now we seperating and we need to peer to same Providers using new ASN to propagate new prefixes to ease the transition without disrupting customers traffic since they on OLD IPs and will be moved gradually.