On Fri, Jan 15, 2016 at 03:51:02PM -0500, Phil Shafer wrote: > But most of these issues can be mitigated. For example, they change > config using "cat command-file | cli" which churns the change bits > in the database even when nothing changes; using "load update" will > solve that. In addition, between JUNOS-12.1 and 15.1 we've done a > lot with commit performance which will help. > > Another fix would be the use of the ephemeral database, which keeps > transient data away from human config, and allows us to avoid saving > it in juniper.conf (and the expense of writing it on every commit). > > I've sent ThreatStop an offer to help with the incorporation of > these suggestions. But if the bad-guys.list is available via http, > then we can make an event script that downloads it and "load updates" > it into the ephemeral database fairly easily.
The lists are distributed by DNS. They use dig on the router to download them. I assume by "ephemeral" database, you mean "configure dynamic" to edit the dynamic-db? Unfortunately, it appears that dynamic-db only works for BGP policies, not firewall filters. Also, a bigger problem IMO is that the dynamic database is not synchronized to the backup RE. Do you have any clever workarounds for either of these two limitations? Thanks. _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
