close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
play_arrow Install and Upgrade cRPD
play_arrow Managing cRPD
play_arrow Programmable Routing
- JET APIs
play_arrow Use cRPD
play_arrow Troubleshooting
play_arrow Best Practices
- Security Best Practices

list Table of Contents

English

Configure OSPF
Configure Bridged Interfaces
Configure Routed VLAN Interfaces
Configure ISO Interfaces
Configure IPv6 Interfaces
Configure IPv4 Interfaces
View Interfaces
Configure MTU
Configure MAC
Configure gRPC Services
Configure TACACS+ Server
Configure Static Label Switched Paths for MPLS
Configure Instance Type
Assign an IP Address to the Routing Instance
View Routes for a VRF

keyboard_arrow_right

Configure Settings on cRPD

date_range 10-Dec-24

arrow_backward

arrow_forward

This chapter provides information on how to tune the settings on cRPD to enable advanced features.

Configure OSPF

To configure OSPF on a network:

Configure crpd01 to set up OSPF protocol.
root@ubuntu-vm18:~# set policy-options policy-statement adv term 1 from route-filter 10.10.10.0/24 exact

root@ubuntu-vm18:~# set policy-options policy-statement adv term 1 then accept

root@ubuntu-vm18:~# set routing-options router-id 10.255.255.1

root@ubuntu-vm18:~# set routing-options static route 10.10.10.0/24 reject

root@ubuntu-vm18:~# set protocols ospf export adv

root@ubuntu-vm18:~# set protocols ospf area 0.0.0.0 interface eth1

root@ubuntu-vm18:~# set protocols ospf area 0.0.0.0 interface lo.0
Configure crpd02 to set up OSPF protocol.
root@ubuntu-vm18:~# set policy-options policy-statement adv term 1 from route-filter 10.20.20.0/24 exact

root@ubuntu-vm18:~# set policy-options policy-statement adv term 1 then accept

root@ubuntu-vm18:~# set routing-options router-id 10.255.255.2

root@ubuntu-vm18:~# set routing-options static route 10.20.20.0/24 reject

root@ubuntu-vm18:~# set protocols ospf export adv

root@ubuntu-vm18:~# set protocols ospf area 0.0.0.0 interface eth1

root@ubuntu-vm18:~# set protocols ospf area 0.0.0.0 interface lo.0

docker exec -it crpd01 bash

content_copy zoom_out_map
===>
           Containerized Routing Protocols Daemon (CRPD)
 Copyright (C) 2018-19, Juniper Networks, Inc. All rights reserved.
                                                                    <===

Verify OSPF route details.

root@crpd01:/# cli

root@crpd01> show ospf neighbor

content_copy zoom_out_map
Address          Interface              State     ID               Pri  Dead
10.1.1.2         eth1                   Full      10.255.255.2     128    32

root@crpd01> show ospf route

content_copy zoom_out_map
Topology default Route Table:

Prefix             Path  Route      NH       Metric NextHop       Nexthop      
                   Type  Type       Type            Interface     Address/LSP
10.255.255.2       Intra AS BR      IP            1 eth1          10.1.1.2
10.1.1.0/24        Intra Network    IP            1 eth1
10.20.20.0/24      Ext2  Network    IP            0 eth1          10.1.1.2
10.255.255.1/32    Intra Network    IP            0 lo.0
10.255.255.2/32    Intra Network    IP            1 eth1          10.1.1.2

root@crpd01> show route

content_copy zoom_out_map
inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.1.1.0/24        *[Direct/0] 00:51:32
                    >  via eth1
10.1.1.1/32        *[Local/0] 00:51:32
                       Local via eth1
10.10.10.0/24      *[Static/5] 00:22:21
                       Reject
10.20.20.0/24      *[OSPF/150] 00:20:01, metric 0, tag 0
                    >  to 10.1.1.2 via eth1
10.255.255.1/32    *[Direct/0] 00:25:43
                    >  via lo.0
10.255.255.2/32    *[OSPF/10] 00:20:01, metric 1
                    >  to 10.1.1.2 via eth1
172.17.0.0/16      *[Direct/0] 01:33:53
                    >  via eth0
172.17.0.2/32      *[Local/0] 01:33:53
                       Local via eth0
224.0.0.5/32       *[OSPF/10] 01:33:53, metric 1
                       MultiRecv
...

Verify the routes.

root@crpd01> exit

root@crpd01:/# ip route

content_copy zoom_out_map
default via 172.17.0.1 dev eth0 
10.1.1.0/24 dev eth1 proto kernel scope link src 10.1.1.1 
10.20.20.0/24 via 10.1.1.2 dev eth1 proto 22 
10.255.255.2 via 10.1.1.2 dev eth1 proto 22 
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.2

root@crpd01:/# ping 10.255.255.2 -c 2

content_copy zoom_out_map
PING 10.255.255.2 (10.255.255.2) 56(84) bytes of data.
64 bytes from 10.255.255.2: icmp_seq=1 ttl=64 time=0.273 ms
64 bytes from 10.255.255.2: icmp_seq=2 ttl=64 time=0.040 ms

--- 10.255.255.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1005ms
rtt min/avg/max/mdev = 0.040/0.156/0.273/0.117 ms

Configure Bridged Interfaces

You can configure a logical interface as a trunk port at the [edit interfaces interface-name unit logical-unit-number family bridge interface-mode trunk] hierarchy level.

To configure all the VLAN identifiers to associate with a Layer 2 trunk port, include the vlan-id-list [vlan-id-numbers ] statement at the [edit interfaces interface-name unit logical-unit-number family bridge] hierarchy level.

Configure each bridged physical interface with the family type bridge.
[edit interfaces]
user@host# set interface interface-name unit logical-unit-number family bridge interface-mode access
Configure each logical interface with a VLAN ID. This helps to determine the interface to which a bridge belongs.
user@host# set interface interface-name unit logical-unit-number family bridge vlan-id vlan-id
Create a virtual switch instance with a bridge domain and configure logical interfaces.
[edit routing-instances]
user@host# set routing-instance-name instance-type virtual-switch

user@host# set routing-instance-name interface interface-name unit logical-unit-number

user@host# set routing-instance-name bridge-domains bridge-domain-name

Configure a virtual switch with IRB support and associate a routing interface with a bridge domain.

content_copy zoom_out_map
[edit]
routing-instances {
    routing-instance-name {
        instance-type virtual-switch;
        bridge-domains {
            bd {
                domain-type bridge;
                interface eth1;
                routing-interface irb.0;
                vlan-id (none | number);
            }
        }
    }
}

Configure Routed VLAN Interfaces

You can configure a routed VLAN interface (RVI) for a private VLAN (PVLAN).

Configure an RVI for a PVLAN.
[edit interfaces]

user@host# set vlan unit logical-unit-number family inet address inet-address
View RVI interfaces and their current state.
user@host> show interfaces vlan terse
```
Interface Admin Link Proto Local Remote
vlan     up     up
```

Configure ISO Interfaces

Configure the ISO family on loopback interfaces that are supporting the IS-IS protocol by including the family iso statement on the interface.

Configure a loopback interface using the host IP address and enable the ISO family on the interface.
user@host# set interfaces lo0 unit 0 family iso address 192.168.0.1
Advertise the device interfaces into IS-IS by including the interface interface-name statement in the protocol configuration.
user@host# set protocols isis interface lo0.0

Configure IPv6 Interfaces

To configure an IPv6 address on routers and switches, use the

interface interface-name unit number
          family inet6 address aaaa:bbbb:...:zzzz/nn

statement at the [edit interfaces] hierarchy level.

You can also assign multiple IPv6 addresses on the same interface.

To specify an IP address for the logical unit using IPv6:

user@host# set interfaces interface-name unit
                  logical-unit-number family inet6 address
                  ip-address

Configure IPv4 Interfaces

To configure an IPv4 address on routers and switches, use the interface interface-name unit number family inet address a.b.c.d/nn statement at the [edit interfaces] hierarchy level.

You can also assign multiple IPv4 addresses on the same interface.

To specify an IP address for the logical unit using IPv4:

user@host# set interfaces interface-name unit
                  logical-unit-number family inet address
                  ip-address

View Interfaces

The following example shows the CLI command to view the configured interfaces:

From configuration mode, confirm your configuration by entering the

show
              interfaces

command.

user@host# show
            interfaces

content_copy zoom_out_map
eth1{
    unit 0 {
        family inet {
            address 10.100.37.178/24;
        }
        family inet6 {
            address 8d8d:8d01::1/64;
        }
    }
}

From the operational mode, enter the show interfaces terse command.

user@host> show interfaces
            terse

content_copy zoom_out_map
Interface@link   Oper State     Addresses
erspan0@NONE     DOWN
gre0@NONE        UNKNOWN
gretap0@NONE     DOWN
ip6tnl0@NONE     UNKNOWN        fe80::200:ff:fe00:0/64 fe80::a8e5:3fff:fe51:d740/64
irb              UNKNOWN        fe80::1ca8:7cff:fe01:274e/64
lo               UNKNOWN        127.0.0.1/8 ::1/128
lo0.0            UNKNOWN        fe80::4475:46ff:fe30:383f/64
lsi              UNKNOWN        fe80::e44e:b4ff:feab:1920/64
sit0@NONE        UNKNOWN        ::127.0.0.1/96
tunl0@NONE       UNKNOWN

user@host> show interfaces routing
            lo0.0

content_copy zoom_out_map
Interface        State Addresses
lo0.0            Up    MPLS  enabled
                       ISO   enabled
                       INET6 fe80::89f:9fff:fe05:1f8b

user@host> show interfaces routing
            irb

content_copy zoom_out_map
Interface        State Addresses
irb              Up    MPLS  enabled
                       ISO   enabled
                       INET6 fe80::bcf1:a4ff:fe68:d413

user@host> show interfaces extensive
              lo0.0

content_copy zoom_out_map
Interface Idx: Interface@link: <>
10: lo0.0: <BROADCAST,UP,LOWER_UP> mtu 65535 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ether 0a:9f:9f:05:1f:8b brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 0 maxmtu 0
    dummy numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
    inet6 fe80::89f:9fff:fe05:1f8b/64 scope link
       valid_lft forever preferred_lft forever
    RX:  bytes packets errors dropped  missed   mcast
             0       0      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
           440       4      0       0       0       0

Configure MTU

To configure the media maximum transmission unit (MTU):

Configure maximum transmit packet size.
user@host# set interfaces interface-name mtu packet size
Configure maximum transmission unit packet size.
user@host# set interfaces interface-name unit logical-unit-number mtu packet size

Configure MAC

To configure the MAC address:

Include the mac statement at the

[edit interfaces
                interface-name]

hierarchy level.

user@host# set interfaces interface-name mac
                  mac-address

Specify the MAC address as six hexadecimal bytes in one of the following formats: nnnn.nnnn.nnnn (for example, 0011.2233.4455) or nn:nn:nn:nn:nn:nn (for example, 00:11:22:33:44:55).

Configure gRPC Services

To configure your network device for gRPC services and specify the local certificate used for server authentication, see Enable gRPC Services.

Navigate to the SSL-based API connection settings for gRPC services.
```
[edit]
user@host# edit system services extension-service request-response grpc ssl
```

Configure the port to use for gRPC services.

content_copy zoom_out_map
[edit system services extension-service request-response grpc ssl]
user@host# set port port-number

Specify a local certificate.

content_copy zoom_out_map
[edit system services extension-service request-response grpc ssl]
user@host# set local-certificate certificate-id

Enable the device to reload certificates without terminating the gRPC session.
```
[edit system services extension-service request-response grpc ssl]
user@host# set hot-reloading
```

(Optional) Specify an IP address to listen to incoming connections.

content_copy zoom_out_map
[edit system services extension-service request-response grpc ssl]
user@host# set ip-address address

(Optional) Configure tracing for extension services to debug any issues.

content_copy zoom_out_map
[edit]
user@host# top
user@host# set system services extension-service traceoptions file jsd
user@host# set system services extension-service traceoptions flag all

Commit the configuration.
```
[edit]
user@host# commit
```

Configure TACACS+ Server

To configure the Terminal Access Controller Access Control System Plus (TACACS+) servers.

Enable TACACS+ accounting.

content_copy zoom_out_map
[edit]
user@host# set system accounting destination tacplus

Configure the address for one or more TACACS+ accounting servers.

content_copy zoom_out_map
[edit system accounting destination tacplus]
user@host# set server server-address

For example:

content_copy zoom_out_map
[edit system accounting destination tacplus]
user@host# set server 192.168.17.28

(Optional) Configure the source address for TACACS+ accounting requests.
```
[edit system accounting destination tacplus server server-address]
user@host# set source-address source-address
```
For example:
```
[edit system accounting destination tacplus server 192.168.17.28]
user@host# set source-address 192.168.17.1
```
The source address is a valid IPv4 address or IPv6 address configured on one of the router interfaces or switch interfaces.
Configure the shared secret password that the network device uses to authenticate the TACACS+ accounting server.
The configured password must match the password that is configured on the TACACS+ server. If the password contains spaces, enclose it in quotation marks. The device stores the password as an encrypted value in the configuration database.
```
[edit system accounting destination tacplus server server-address]
user@host# set secret password
```
For example:
```
[edit system accounting destination tacplus server 192.168.17.28]
user@host# set secret Tacplussecret1
```
(Optional) If necessary, specify to which TACACS+ accounting server port must send accounting packets, if different from the default (49).
```
[edit system accounting destination tacplus server server-address]
user@host# set port port-number
```
(Optional) Configure the amount of time that the device waits to receive a response from the TACACS+ accounting server.
By default, the device waits for three seconds. You can configure the timeout value from 1 through 90 seconds.
```
[edit system accounting destination tacplus server server-address]
user@host# set timeout seconds
```
For example, to wait 15 seconds for a response from the server:
```
[edit system accounting destination tacplus server 192.168.17.28]
user@host# set timeout 15
```
(Optional) Configure the device to maintain one open TCP connection to the server for multiple requests instead of opening a separate connection for each connection attempt.
```
[edit system accounting destination tacplus server server-address]
user@host# set single-connection
```
(Optional) To route TACACS+ accounting packets through the non-default management instance or another routing instance instead of the default routing instance, configure the routing-instance statement and specify the routing instance.
```
[edit system accounting destination tacplus server server-address]
user@host# set routing-instance routing-instance
```
For example:
```
[edit system accounting destination tacplus server 192.168.17.28]
user@host# set routing-instance mgmt_junos
```

Configure Static Label Switched Paths for MPLS

Multiprotocol Label Switching (MPLS) is a protocol that uses labels instead of the forwarding table to route packets instead of using IP addresses. To configure MPLS, you must first create one or more named paths on the ingress and egress routers. For more information to configure static LSPs on the ingress router and an egress router, see Configure Static LSPs and static-label-switched-path

To configure a static LSP on the ingress router, the label properties next-hop, push, and to are required; the other statements are optional.

To configure the transit statement, the label properties next-hop and pop | swap are required. The remaining statements are optional.

To configure a bypass static LSP, the label properties next-hop, push, and to are required; the other statements are optional.

Configure static LSPs on the ingress router.

[edit protocols mpls static-label-switched-path
                static-lsp-name]

user@host# show
            protocols

content_copy zoom_out_map
 
mpls {
        interface eth1;
        static-label-switched-path path1 {
            ingress {
                next-hop 10.1.23.2;     
                to 10.1.45.2;
                push 1000123;
            }
        }
}

View the state of the MPLS interface.
root@host:~# docker exec -it crpd01 cli

root@host> show mpls interface
Run the following command to view the MPLS LSPs on the router.
root@host> show mpls lsp

Configure Instance Type

To instantiate a virtual routing and forwarding (VRF) device and associate it with a VRF table, Logical interfaces are assigned to a VRF by including the interface name at [edit routing-instances routing-instance-name] hierarchy level] to a VRF device. The connected and local routes are automatically moved to the table associated with the VRF device:

You can configure the following instance type:

Layer 3 VPNs require that each PE router has a VPN routing and forwarding (VRF) table for distributing routes within the VPN. To create the VRF table on the router, include the instance-type statement and specify the value vrf. See Configure Routing Instances.
To enable the virtual-router routing instance, include the instance-type statement and specify the value of virtual-router. See Configure Virtual-Router.
To provide support for Layer 2 bridging with a protocol configuration, include the instance-type statement and specify the value virtual-switch. See Configure a Layer 2 Virtual Switch.
To configure multiple customer-specific EVPN instances (EVIs) of type, each of which can support a different EVPN service type, include the instance-type statement and specify the value mac-vrf.
Enable an Ethernet VPN (EVPN) Virtual Private Wire Service (VPWS) on the routing instance, include the instance-type statement and specify the value evpn-vpws.

Create an instance type and configure the routing instances on the interface.
[edit routing-instances vpn1]

root@host# set instance-type vrf

root@host# set interface ge-2/0/0.0
Configure the Layer 3 VPN routing instances.
[edit routing-instances vpn1]

root@host# set vrf-target target:203:100

root@host# set routing-options static route 203.0.113.1/24 discard
Run the following command to view the list of VRFs in the host OS.
root@host:~# show routing-instances
```
vpn1 {
instance-type vrf;
vrf-target target:203:100;
routing-options {
static {
route 203.0.113.1/24 discard;
}
}
}
vpn2 {
instance-type vrf;
vrf-target target:203:101;
routing-options {
static {
route 203.0.113.2/24 discard;
}
}
}
```
A VRF instance consists of one or more routing tables, a derived forwarding table, the interfaces that use the forwarding table, and the policies and routing protocols that determine what goes into the forwarding table. Because each instance is configured for a particular VPN, each VPN has separate tables, rules, and policies that control its operation. A separate VRF table is created for each VPN that has a connection to a router. The VRF table is populated with routes received from directly connected sites associated with the VRF instance, and with routes received from other routers in the same VPN.

The VRF table distinguishes the routes for different customers as well as customer routes from provider routes on the device. For information on configuring policies, see Configure Policies for the VRF Table.

Assign an IP Address to the Routing Instance

To associate IP address with each VRF or virtual-router routing instance at [edit interfaces lo0 unit unit-number family inet] hierarchy level, see Configure a Logical Unit.

View Routes for a VRF

To view routes for a VRF:

Run the following command to view the IPv6 routes table associated with the VRF device:

root@host> show route

content_copy zoom_out_map
inet6.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

::/96              *[Direct/0] 4d 23:28:51
                    >  via sit0
::127.0.0.1/128    *[Local/0] 4d 23:28:51
                       Local via sit0
fe80::1/128        *[Direct/0] 4d 23:28:51
                    >  via lo
fe80::200:ff:fe00:0/128
                   *[Local/0] 4d 23:28:51
                       Local via ip6tnl0
fe80::1ca8:7cff:fe01:274e/128
                   *[Local/0] 4d 23:28:49
                       Local via irb
fe80::4475:46ff:fe30:383f/128
                   *[Local/0] 4d 23:28:50
                       Local via lo0.0
fe80::e44e:b4ff:feab:1920/128
                   *[Local/0] 4d 23:28:51
                       Local via lsi
ff02::2/128        *[INET6/0] 4d 23:28:51
                       MultiRecv

arrow_backward PREVIOUS Configure Settings on Host OS

NEXT arrow_forward Multitopology Routing in cRPD

cRPD Deployment Guide for Linux Server

ON THIS PAGE