Re: [j-nsp] Junos 10.0 SLAX question

2017-07-26 Thread Alexander Shikoff
On Tue, Jul 25, 2017 at 07:20:44PM +0200, Vlad Skuba wrote: > Hi, Alexander, > > you can print any ASCII character by using it's HEX number: "\xXX". > > For double quote it will be "\x22". Thanks for suggestion. It does not work for Junos 10.0. > On T

[j-nsp] Junos 10.0 SLAX question

2017-07-25 Thread Alexander Shikoff
Hello! Does anybody know how to create a string in JunOS 10.0 SLAX with double-quote character inside? var $str = "'"; works but: var $str = '"'; var $str = '\"'; both result to an error. Thanks in advance! -- MINO-RIPE ___ juniper-nsp mailing

[j-nsp] CPU monitoring of cluster of two J6350

2012-10-08 Thread Alexander Shikoff
Hello! I need to monitor CPU load of every node in a cluster of two J6350 routers via SNMP. I found KB12142 article which tells that Work is ongoing to support these MIBs on J-Series and SRX Branch in a future release. Currently my cluster is running JunOS 10.2R3.10. Does anybody know is there

[j-nsp] Destination Class Accounting: counters are zero

2012-05-15 Thread Alexander Shikoff
Hello List, I have MX240 router (10.0 R4.7) with two peering links and two upstream links. I need separate accounting of customer's traffic: to/from upstreams and to/from peerings. I configured an SCU input accounting on peering and upstream links, DCU and SCU output accounting on customer's

Re: [j-nsp] Destination Class Accounting: counters are zero

2012-05-15 Thread Alexander Shikoff
Hello! On Tue, May 15, 2012 at 03:17:36PM +0100, Alex Arseniev wrote: Hello there, This might help http://www.juniper.net/techpubs/en_US/junos12.1/topics/concept/source-class-usage-guidelines-solution.html quote A source or destination class is applied to a packet only once during the

[j-nsp] SNMP OID for sessions number

2012-04-03 Thread Alexander Shikoff
Hello List, what is the right SNMP oid/MIB variable for monitoring of sessions number on J/SRX box? minotaur@BACKUP# run show security flow session summary node0: -- Unicast-sessions: 253200 Multicast-sessions: 0

[j-nsp] Cluster with two J6350: session overflow

2012-04-03 Thread Alexander Shikoff
Hello List, I have a strange problem with cluster of two J6350. When there is incoming TCP connection to any service behind cluster two session is created: one (Active) on primary node and second (Backup) on secondary node: {primary:node1}[edit] minotaur@BACKUP# run show security flow session

Re: [j-nsp] SNMP OID for sessions number

2012-04-03 Thread Alexander Shikoff
On Tue, Apr 03, 2012 at 09:28:04AM -0400, Scott T. Cameron wrote: SRX240 (non-cluster): Current flows: .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.6 Max flows: .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.7 On my SRX3400 cluster: Current: .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.6 Max:

Re: [j-nsp] SNMP OID for sessions number

2012-04-03 Thread Alexander Shikoff
On Tue, Apr 03, 2012 at 09:56:46AM -0400, Clarke Morledge wrote: In response to: what is the right SNMP oid/MIB variable for monitoring of sessions number on J/SRX box? Try this: jnxJsSPUMonitoringCurrentFlowSession which is available in the mib-jnx-js-spu-monitoring MIB. Values

[j-nsp] Loopback interface and rib-groups

2012-03-24 Thread Alexander Shikoff
Hello List, I have lo0.0 interface in default routing table : minot...@br1-gdr.ki# show interfaces lo0 unit 0 { family inet { address 109.68.40.32/32; } } minot...@br1-gdr.ki# run show route 109.68.40.32/32 table inet.0 inet.0: 2 destinations, 2 routes (2 active, 0

[j-nsp] Matching communities in 'show route receive-protocol bgp' command

2011-07-06 Thread Alexander Shikoff
Hello, I have a problem with matching communities in 'show route receive-protocol bgp' command. For example, I have a route: minot...@br1-gdr.ki show route ams-ix.net receive-protocol bgp 77.88.200.133 detail table World.inet.0 World.inet.0: 362279 destinations, 720396 routes (358851

Re: [j-nsp] Matching communities in 'show route receive-protocol bgp' command

2011-07-06 Thread Alexander Shikoff
On Wed, Jul 06, 2011 at 09:50:55AM -0600, Stacy W. Smith wrote: I just tried to replicate your problem (on an old version of JunOS), and the community knob works as expected for me. root@j6300 show version Hostname: j6300 Model: j6300 JUNOS Software Release [9.3S9] root@j6300 show

Re: [j-nsp] Matching communities in 'show route receive-protocol bgp' command

2011-07-06 Thread Alexander Shikoff
On Wed, Jul 06, 2011 at 10:28:07AM -0600, Stacy W. Smith wrote: OK. Thanks for the additional details. That allows me to replicate the behavior you are seeing. It seems the 'community' argument to 'show route' always evaluates post import policy even when 'receive-protocol' is specified.

Re: [j-nsp] Source address for DNS queries

2011-04-14 Thread Alexander Shikoff
On Thu, Apr 14, 2011 at 06:45:12AM +1000, Chris Kawchuk wrote: You could try: system { default-address-selection; } This will try to source all router-initiated management traffic from your loopback address. - Chris. Thanks Chris! It works now. -- MINO-RIPE

[j-nsp] MX80 errors

2011-04-14 Thread Alexander Shikoff
Hello, I have a trouble with MX80-48T: it is reporting a lot of errors to messages log file: Apr 14 21:30:04 br1-gdr.ki tfeb0 LU 0 RMC 0 Uninitialized EDMEM[0x35] Read Apr 14 21:30:04 br1-gdr.ki tfeb0 LU 0 PPE_0 Errors sync xtxn error Apr 14 21:30:04 br1-gdr.ki tfeb0 LU 0 PPE_2 Errors

[j-nsp] Routing to tunnel interfaces on M10i

2011-01-18 Thread Alexander Shikoff
Hello, I have M10i box and a IP-IP tunnel to remote office: minot...@cr1-gdr.ki show configuration interfaces ipip unit 0 { tunnel { source 109.68.40.33; destination 212.109.41.180; } family inet { mtu 1460; address 109.68.40.157/30; } } The

Re: [j-nsp] Routing to tunnel interfaces on M10i

2011-01-18 Thread Alexander Shikoff
On Wed, Jan 19, 2011 at 01:20:00AM +1100, Julien Goodwin wrote: 2. Do you have a tunnel pic? - Some quick googling does seem to confirm IPIP needs a tunnel pic - However traffic to the RE may still work without one I do not have it. I thought that tunnel pic is needed only for hardware

Re: [j-nsp] Unable to display ARP table on M10i

2010-11-17 Thread Alexander Shikoff
On Fri, Nov 12, 2010 at 05:58:33PM +0200, Alexander Shikoff wrote: Hello, I'm unable to display ARP table on my M10i box with JunOS 9.5R1.8. minot...@br1-gdr.ki show arp no-resolve expiration-time ... and silence. The command is just hanging and there is no any output, but I'm still

[j-nsp] Unable to display ARP table on M10i

2010-11-12 Thread Alexander Shikoff
Hello, I'm unable to display ARP table on my M10i box with JunOS 9.5R1.8. minot...@br1-gdr.ki show arp no-resolve expiration-time ... and silence. The command is just hanging and there is no any output, but I'm still able to break it with Ctrl+C. What may be a reason of such behavior? Thanks

[j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Alexander Shikoff
Hello, On MX80-48T with JunOS 10.2R1.8 I have a BGP session with downstream configured as follows: minot...@br1-gdr.ki# show routing-instances World protocols bgp group Downstreams neighbor 178.214.196.6 description MHost: World; import [ Local-Pref-400 from-MHost Deny-Rest ]; export

Re: [j-nsp] Strange behavior of BGP policy

2010-11-09 Thread Alexander Shikoff
Thanks a lot to all who replied! On Tue, Nov 09, 2010 at 01:57:00PM +0300, Alexandre Snarskii wrote: On Tue, Nov 09, 2010 at 12:18:37PM +0200, Alexander Shikoff wrote: Filtering of outgoing prefixes is performed via to-MHost policy: minot...@br1-gdr.ki# show policy-options policy

[j-nsp] Route export from VRF

2010-10-19 Thread Alexander Shikoff
Hello! I have a question about route export from VRF. I have following vrf configured on my MX80: World { instance-type vrf; interface ge-1/0/4.0; interface ge-1/0/5.0; interface ae0.74; interface lo0.0; route-distinguisher 42546:0; vrf-target target:42546:0;

Re: [j-nsp] IKE gateway within routing-instance

2010-08-10 Thread Alexander Shikoff
timeline for your application. -Original Message- From: juniper-nsp-boun...@puck.nether.net on behalf of Alexander Shikoff Sent: Mon 8/9/2010 5:53 AM To: juniper-nsp Subject: [j-nsp] IKE gateway within routing-instance Hello, Does anyone know are there new JunOS versions

[j-nsp] Static NAT with IPSEC VPN on one J-router

2009-12-10 Thread Alexander Shikoff
Hello! I'm wondering is it possible to configure Static NAT with IPSEC VPN on one J-router? I have working IPSEC policy (users connect successfully): minot...@br# show security policies from-zone External to-zone Internal { policy RemoteVPN { match { source-address any;

Re: [j-nsp] A couple of CLI questions...

2009-12-10 Thread Alexander Shikoff
On Thu, Dec 10, 2009 at 02:16:52PM -0500, Jason Lixfeld wrote: I've dug through a bunch of manuals for both these items, but I fear my search terminology may be preventing me from finding the appropriate results. Hoping someone here can give me some pointers: 1- How to set the system time

[j-nsp] Netscreen Remote VPN Client behind NAT

2009-11-23 Thread Alexander Shikoff
Hello! I'm trying to make VPN connection to Juniper J2320 with secure VPN client located behind NAT. Phase 1 is completed successfully and I get login/password prompt in client. But authentication fails: In debug on J-box I see errors: Nov 23 13:52:22 unknown (unknown) - unknown { unknown

Re: [j-nsp] destination nat, 8 rule limit

2009-11-03 Thread Alexander Shikoff
On Tue, Nov 03, 2009 at 06:32:05PM -0700, Brandon Bennett wrote: 08/17/09 05:21:01 I am not sure of the exact time, but I know that It should be in version 10 of Junos. Did they mention what it would be increased to? IIRC 256 rules per one rule-set. -- MINO-RIPE

Re: [j-nsp] destination nat, 8 rule limit

2009-11-03 Thread Alexander Shikoff
On Tue, Nov 03, 2009 at 03:45:18PM -0600, Christopher M. Hobbs wrote: On Tue, Nov 03, 2009 at 08:39:02AM -0800, Derick Winkworth wrote: Upgrade to 9.6. You can have many more rules per rule-set... From: Christopher M. Hobbs ch...@altbit.org

Re: [j-nsp] Generating events based on day of week

2009-10-30 Thread Alexander Shikoff
On Fri, Oct 30, 2009 at 07:14:41AM -0700, Curtis Call wrote: BTW, if the need is to do stateless firewall filters that change based on the day of week then there is already a commit+event script in Junoscriptorium that do all the heavy lifting for you. With them loaded, all you need to do

Re: [j-nsp] Generating events based on day of week

2009-10-29 Thread Alexander Shikoff
On Thu, Oct 29, 2009 at 01:32:43AM -0400, Phil Shafer wrote: Alexander Shikoff writes: I'm wondering is it possible to generate events based on day of week, i.e. every Friday or Sunday etc.? set event-options generate-event allows configuration of time of day only. Any ideas? Thanks

[j-nsp] Need help with event script

2009-10-23 Thread Alexander Shikoff
Hello! I'm trying to make changes of run-time configuration based on time of day. I want simple event script to change policer on interface at given time. Script is quite simple (see below). event-options are configured as follows: [edit event-options] minot...@br1-gdr.ki# show generate-event {

Re: [j-nsp] Need help with event script

2009-10-23 Thread Alexander Shikoff
; } } Thank you, Curtis! We're using 9.5R1.8. Your workaround was helpful. We will consider upgrading to 9.5R2. -Original Message- From: juniper-nsp-boun...@puck.nether.net [mailto:juniper-nsp- boun...@puck.nether.net] On Behalf Of Alexander Shikoff Sent: Friday, October 23, 2009 7:28 AM

[j-nsp] Need help with stripping of BGP communities

2009-10-06 Thread Alexander Shikoff
Hello All, I have M10i router and need to strip BGP communities that don't match regex pattern. I've configured BGP community: [edit policy-options] minot...@br1-gdr.ki# show community Prohibited invert-match; members ^((9002)|(21011)|(13228)):([0-5])$; Then I've created policy-statement and

Re: [j-nsp] DCU SNMP MIB - Cacti

2009-10-06 Thread Alexander Shikoff
On Thu, Oct 01, 2009 at 01:36:35PM +0800, Mark Tinka wrote: Hello all. Wondering whether anyone has come across a Cacti plug-in to read Juniper's Destination Class Usage MIB. All help appreciated. As far as I remember cacti-spine (poller for Cacti written in C) uses net-snmp libraries.

Re: [j-nsp] Need help with stripping of BGP communities

2009-10-06 Thread Alexander Shikoff
On Tue, Oct 06, 2009 at 02:59:02PM -0400, Stefan Fouant wrote: On Tue, Oct 6, 2009 at 1:52 PM, Alexander Shikoff minot...@crete.org.uawrote: Hello All, I have M10i router and need to strip BGP communities that don't match regex pattern. I've configured BGP community: [edit

Re: [j-nsp] Need help with stripping of BGP communities

2009-10-06 Thread Alexander Shikoff
On Tue, Oct 06, 2009 at 04:10:30PM -0400, Eric Van Tol wrote: -Original Message- From: juniper-nsp-boun...@puck.nether.net [mailto:juniper-nsp- boun...@puck.nether.net] On Behalf Of Alexander Shikoff Sent: Tuesday, October 06, 2009 1:52 PM To: juniper-nsp Subject: [j-nsp] Need

Re: [j-nsp] AS-path

2009-08-13 Thread Alexander Shikoff
On Wed, Aug 12, 2009 at 11:24:42PM +0500, Fahad Khan wrote: Dear Folks, what should be the As-path reg expression for getting the routes transiting AS 100 and not originating from AS 100 regards What for? Add two terms to policy-statement. First term should reject routes originating

[j-nsp] Zero counters for destination-class

2009-07-29 Thread Alexander Shikoff
Hello, I have a problem with configuring DCU for my customer's interface. We split all traffic from/to customer into two classes: minot...@br1-gdr.ki show configuration policy-options policy-statement Mark-FT term World { from interface [ ge-0/0/0.403 ge-0/0/0.1252 ]; then {

Re: [j-nsp] Zero counters for destination-class

2009-07-29 Thread Alexander Shikoff
...@puck.nether.net] On Behalf Of Alexander Shikoff Sent: Wednesday, July 29, 2009 8:47 PM To: juniper-nsp@puck.nether.net Subject: [j-nsp] Zero counters for destination-class Hello, I have a problem with configuring DCU for my customer's interface. We split all traffic from/to customer into two classes

[j-nsp] DHCP static bindings on J2320

2009-07-16 Thread Alexander Shikoff
Hello, I'm using J2320 (JunOS 9.5R1.8) as a router in office network with ~10 VLANs. DHCP works good on it but there is confusing issue with DHCP static bindings. I've configured binding: minot...@cr1-kur.ki show configuration system services dhcp static-binding 00:40:01:27:e2:87 fixed-address

Re: [j-nsp] DHCP static bindings on J2320

2009-07-16 Thread Alexander Shikoff
On Thu, Jul 16, 2009 at 06:08:03PM +0500, mas...@nexlinx.net.pk wrote: the services router supports dhcp client requests received on fast ethernet interfaces only. dhcp is not supported on interfaces that are part of a virtual private network (vpn). by the way there is already a thread on

Re: [j-nsp] Destination NAT with Junos 9.5

2009-06-11 Thread Alexander Shikoff
On Thu, Jun 11, 2009 at 02:12:58PM +0800, ?? wrote: JUNOS 9.6 will increase the limitation to 256 and even more in future release. A guy from J-Net Community forum told me that limit will be increased in 9.5R2. Juniper plans to release it at the end of current month. My interest is more

[j-nsp] Destination NAT with Junos 9.5

2009-06-10 Thread Alexander Shikoff
Hello! I have J2320 with JunOS 9.5, one external interface with one IP-address. I wish to make destination NAT for 12 different hosts in my internal network, for example external IP port 5000 - local IP1 port 5000 external IP port 5001 - local IP2 port 5001 [...] But one