Enable Traceoption and manually update security update on Juniper JunOS SRX

In our environment, there was having issue to use NSM push security update to one pair of Juniper SRX 240. NSM is the only method to get update from Internet and push those updates to SRX. Most of SRX are fine working with NSM. Occasionally pushing from NSM failed with following message:

request security idp load detector /var/db/idpd/nsm-download/libidp-detector.so.gz:
  Attack Update took too long, NSM giving up after 303 secs.
Device Status Received by NSM :   Done;AI installation failed! Attack DB update failed!
Install application package version 2270 failed.
AI compilation has failed.

After checked device has enough space to hold those updates, we tried following procedures to fix this issue:

To enable trace-options:
# set security idp trace-options file idp-trace size 100M
# set security idp trace-options flag all
# set security idp trace-options level all
# commit

+ Issues the security-package install command:
> request security idp security-package install
Check the status of this command:
> request security idp security-package install status
Once this fails, you can disable the trace-options:
# deactivate security idp trace-options
# commit

+ These logs would be captured in the file /var/log/idp-trace

After update NSM attack database, we tried push again and this time, it is successful:

request security idp security-package install status:
  Done;Attack DB update : successful - [UpdateNumber=2272,ExportDate=Wed Jun 12 18:23:00 2013 UTC,Detector=12.6.160130325]
     Updating control-plane with new detector : successful
     Updating data-plane with new attack or detector : successful

Cisco Switchport Mode Best Practices

For Access Mode: 

switchport mode access

switchport nonegotiate

switchport access vlan 100

For Trunk Mode:
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
switchport trunk allowed vlan 10,100
switchport trunk native vlan 1

The reason why switch port can automatically form trunk is because of DTP (Dynamic Trunk Protocol).
For access layer switches, default configuration is switchport mode dynamic auto , which means it will not send DTP packets initially but will pro-actively send it after received one.
For Distribution layer switches, default configuration is switchport mode dynamic desirable , which means it will send DTP packets actively.
`

 

witchport mode dynamic desirable

Makes the interface actively attempt to convert the link to a trunking link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.

switchport mode access

Puts the interface into permanent nontrunking mode and negotiates to convert the link into a nontrunking link. The interface becomes a nontrunk interface even if the neighboring interface does not change.

Desirable is the default state of a switch port. It means that if a device connected to the other end of the cable is trying to trunk, your switch will form a trunk thus voiding switchport access vlan 10 command.

If you want to get rid of this line in your config and prevent a port from trunking you should issue switchport mode access command.

desirable + trunk = trunk

desirable + desirable = trunk

desirable + auto = trunk

desirable + access = access

Dynamic desirable is the new default for DTP in Cisco IOS, old IOS uses dynamic auto as default. You can turn off DTP (and therefore don't see link in desirable or auto state) using 'switchport nonegotiate' command. This command will leave your port the way it's previously configured (either as access or trunk, explicitly).

Basic MPLS Lab on GNS3

Topology:

IOS:  c3640-jk9s-mz.124-16.bin

GNS3 IOS Configuration:

Changed XTERM to gnome-terminal for better copy&paste feature:

In GNS3 Preference , replaced

xterm -T %d -e 'telnet %h %p' >/dev/null 2>&1 &

with

gnome-terminal --command='telnet %h %p' >/dev/null 2>&1 &

R1:

interface Serial0/0

 ip address 10.1.12.1 255.255.255.0

 mpls ip

interface Ethernet1/0

 ip address 10.1.13.1 255.255.255.0

 mpls ip

router eigrp 100

 network 10.1.12.0 0.0.0.255

 network 10.1.13.0 0.0.0.255

 auto-summary

R2:

interface Serial0/0

 ip address 10.1.12.2 255.255.255.0

 mpls ip

interface Ethernet1/0

 ip address 10.1.24.2 255.255.255.0

 half-duplex

 mpls ip

router eigrp 100

 network 10.1.12.0 0.0.0.255

 network 10.1.24.0 0.0.0.255

 auto-summary

R3:

interface Ethernet1/0

 ip address 10.1.13.3 255.255.255.0

 half-duplex

 mpls ip

router eigrp 100

 network 10.1.13.0 0.0.0.255

 auto-summary

R4;

interface Ethernet1/0

 ip address 10.1.24.4 255.255.255.0

 half-duplex

 mpls ip

router eigrp 100

 network 10.1.24.0 0.0.0.255

 auto-summary

Results:

R1# show mpls ldp neighbor 

    Peer LDP Ident: 10.1.24.2:0; Local LDP Ident 10.1.13.1:0

TCP connection: 10.1.24.2.56937 - 10.1.13.1.646

State: Oper; Msgs sent/rcvd: 45/46; Downstream

Up time: 00:35:42

LDP discovery sources:

 Serial0/0, Src IP addr: 10.1.12.2

        Addresses bound to peer LDP Ident:

          10.1.12.2       10.1.24.2       

    Peer LDP Ident: 10.1.13.3:0; Local LDP Ident 10.1.13.1:0

TCP connection: 10.1.13.3.37365 - 10.1.13.1.646

State: Oper; Msgs sent/rcvd: 46/46; Downstream

Up time: 00:35:20

LDP discovery sources:

 Ethernet1/0, Src IP addr: 10.1.13.3

        Addresses bound to peer LDP Ident:

          10.1.13.3  

Cisco MPLS IOS for GNS3

Here are listed working IOS for MPLS LAB on GNS3:

• c3640-jk9s-mz.124-16
• c3640-jk9s-mz.124-16a
• c3640-jk9o3s-mz.123-14.T7
• c7200-adventerprisek9-mz.124-11.T
• c3725-adventerprisek9-mz.124-15.T10

Note: c3640-jk9s-mz.124-16是学习Gisco过程中最我们最常用IOS,此IOS不单单支持路由交换实验，同时还支持IPv6、VPN、VOip、MPLS-VPN 等，所以人们通常称之为全能型IOS。

BGP Command : soft-reconfiguration inbound & soft in

When you apply policy changes, they are only applied on routes that are learned after the policy changes have been enacted. This is because BGP is most frequently implemented on links that connect to other ASes - and you can't just force an ISP or another organization to resend their BGP routing table to you. You can force this by running "clear ip bgp *" (every BGP neighbor) or "clear ip bgp A.B.C.D" - but these clear commands actually tear down connections between neighbors and cause communication to cease until the neighbor relations are rebuilt. In the real world where BGP is run - this is a bad thing.

When you perform the "neighbor A.B.C.D soft-reconfiguration inbound" router command - it shuts down the connection (just like a hard reset). When the neighbor resends you it's routing table, BGP stores a copy of the received routing table in memory. This 2nd copy takes up memory, but it serves a useful purpose. Now, when you apply policy changes to a neighbor or out a particular interface, you can configure "clear ip bgp * (or A.B.C.D) soft in" and run the saved copy of the neighbor's routes through your new bgp policy filters. You can make policy changes all you want and your neighbor never has to resend you its routing table, and you never have to tear down the connection between you and disrupt network communication. 

EIGRP, OSPF, RIP, IGRP - If you apply a policy change (ACL, Distribute List, Route Map, whatever) - that change takes place instantly (instantly + the time to propogate the change and implement the policy). BGP acts differently - it waits until it receives new routes through its new filters. That's why the "soft-reconfiguration inbound" command was created.

R6#sh ip bgp nei 46.46.46.46 received-routes
% Inbound soft reconfiguration not enabled on 46.46.46.46


R6(config-router)#neighbor 46.46.46.46 soft-reconfiguration inbound

R6#sh ip bgp nei 46.46.46.46 received-routes

BGP table version is 3, local router ID is 6.6.6.6

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*>i4.4.4.4/32       46.46.46.46              0    100      0 i

Total number of prefixes 1