Hi folks, it looks like the "[KB14893] Cisco EIGRP protocol and EX Switch configuration compatibility" is wrong.
Here they say: If the VLAN on the EX Switch is configured for IGMP-snooping protocol, flooding of multicast hello packets will not happen. The EX Switch with IGMP-snoooping enabled will drop EIGRP hello packets and routers connected at interfaces will not be able to form adjacency. NOTE: IGMP-snooping is enabled by default in JUNOS 9.3 software and later releases [Cisco A] ---------- Port 1 (VLAN A)-- [EX switch]--(VLAN A) Port 2 ------------ [Cisco B] For Cisco's EIGRP protocol to work using the EX Switch in above topology (transit mode) IGMP-Snooping protocol has to be disabled on the EX Switch To disable IGMP-Snooping protocol on the EX switch use following command: juniper@ex# set protocol igmp-snooping vlan <name of the vlan> disable juniper@ex# commit Now, I have version 12.3R8.7 on my EX4200 and the default command set protocol igmp-snooping vlan all and yet EIGRP traffic is flowing and with that, even data traffic. Therefore applying the filter was a costly mistake. I may even lose my job because of that: now, who´s to blame? Thanks Regards Lucio -----Messaggio originale----- Da: Niall Donaghy [mailto:[email protected]] Inviato: venerdì 9 settembre 2016 22:45 A: Valentini, Lucio <[email protected]>; [email protected] Oggetto: RE: Etherchannel Cisco - Juniper and firewall filter Hi Lucio, A few thoughts that occur to me: - Your configuration looks 100% correct; I am equally surprised it dropped traffic. - Is the Junos code in production and in lab the same? - Perhaps try the same filter in production but without the discard action. Check if the counter is working as expected. - You could try filtering out destination-address 224.0.0.10/32. - But ... why not just set EIGRP to passive on that interface, eg: C3750(config)#router eigrp <asn> C3750(config-router)#passive-interface <int> Kind regards, Niall > -----Original Message----- > From: juniper-nsp [mailto:[email protected]] On Behalf Of > Valentini, Lucio > Sent: 09 September 2016 15:37 > To: [email protected]<mailto:[email protected]> > Subject: [j-nsp] Etherchannel Cisco - Juniper and firewall filter > > Hi there, > > I have a Juniper EX4200 connected through an etherchannel with a Cisco > C3750; I noticed (with the "monitor traffic interface ae1" > command) > the interface on the Juniper was receiving EIGRP Hello packets, I applied > this filter on the input in order to stop/drop these packets, > because as far as I know there is no EIGRP-speaking router on the other side > of the Juniper switch. > > set firewall family ethernet-switching filter block-Eigrp term block-Eigrp > from destination-mac-address 01:00:5e:00:00:0a/48 > set firewall family ethernet-switching filter block-Eigrp term block-Eigrp > then discard > set firewall family ethernet-switching filter block-Eigrp term block-Eigrp > then count eigrp-count > set firewall family ethernet-switching filter block-Eigrp term traffic-allow > then accept > > information was taken from: > https://kb.juniper.net/InfoCenter/index?page=content&id=KB14893&actp=search > > where they say that the mac-address 01:00:5e:00:00:0a/48 is used by EIGRP. > > But instead of dropping only the EIGRP packets, the filter dropped traffic as > well and the result was really bad. > > Strangely enough, I tried to replicate the problem in the lab: I connected a > Cisco router´s EIGRP Hello-generating interface to an EX4200, > configured the IP addresses and the ping worked fine both ways. > > Any ideas about how to drop only Hello packets without causing disruption ? > Thanks > > Cheers > > Lucio > > > _______________________________________________ > juniper-nsp mailing list > [email protected]<mailto:[email protected]> > https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
