Introduction to Interfaces
Junos OS supports different types of interfaces on which the devices function. The following topics provide information of types of interfaces used on security devices, the naming conventions and how to monitor the interfaces.
Understanding Interfaces
Interfaces act as a doorway through which traffic enters and exits a device. Juniper Networks devices support a variety of interface types:
Network interfaces—Networking interfaces primarily provide traffic connectivity.
Services interfaces—Services interfaces manipulate traffic before it is delivered to its destination.
Special interfaces—Special interfaces include management interfaces, the loopback interface, and the discard interface.
Each type of interface uses a particular medium to transmit data. The physical wires and Data Link Layer protocols used by a medium determine how traffic is sent. To configure and monitor interfaces, you need to understand their media characteristics, as well as physical and logical properties such as IP addressing, link-layer protocols, and link encapsulation.
Most interfaces are configurable, but some internally generated interfaces are not configurable.
Network Interfaces
All Juniper Networks devices use network interfaces to make physical connections to other devices. A connection takes place along media-specific physical wires through an I/O card (IOC) in the SRX Series Services Gateway. Networking interfaces primarily provide traffic connectivity.
You must configure each network interface before it can operate on the device. Configuring an interface can define both the physical properties of the link and the logical properties of a logical interface on the link.
Table 1 describes network interfaces that are available on SRX Series Firewalls.
Interface Name |
Description |
|---|---|
|
Aggregated Ethernet interface. See Understanding Aggregated Ethernet Interfaces. |
|
ATM-over-ADSL or ATM-over-SHDSL WAN interface. |
|
Physical interface for the 3G wireless modem or LTE Mini-PIM. See Understanding the 3G Wireless Modem Physical Interface and LTE Mini-PIM Overview. Starting with Junos OS Release 15.1X49-D100, SRX320, SRX340, SRX345, and SRX550HM devices support the LTE interface. The dialer interface is used for initiating wireless WAN connections over LTE networks. |
|
Dialer interface for initiating USB modem or wireless WAN connections. See USB Modem Interface Overview and LTE Mini-PIM Overview. |
|
E1 (also called DS1) WAN interface. See Understanding T1 and E1 Interfaces. |
|
E3 (also called DS3) WAN interface. See Understanding T3 and E3 Interfaces. |
|
Fast Ethernet interface. See Understanding Ethernet Interfaces. |
|
Gigabit Ethernet interface. See Understanding Ethernet Interfaces. |
|
VDSL2 interface. See Example: Configuring VDSL2 Interfaces (Detail). |
|
For chassis cluster configurations only, redundant Ethernet interface. See Understanding Ethernet Interfaces. |
|
Serial interface (either RS-232, RS-422/499, RS-530, V.35, or X.21). See Serial Interfaces Overview. |
|
T1 (also called DS1) WAN interface. See Understanding T1 and E1 Interfaces. |
|
T3 (also called DS3) WAN interface. See Understanding T3 and E3 Interfaces. |
|
WXC Integrated Services Module (ISM 200) interface for WAN acceleration. See the WXC Integrated Services Module Installation and Configuration. |
|
10-Gigabit Ethernet interface. See Understanding the 2-Port 10-Gigabit Ethernet XPIM. |
The affected interfaces are these: ATM-over-ADSL or ATM-over-SHDSL
(at) interface, dialer interface (dl), E1 (also
called DS1) WAN interface, E3 (also called DS3) WAN interface, VDSL2
interface (pt), serial interface (se), T1 (also
called DS1) WAN interface, T3 (also called DS3) WAN interface. However,
starting from Junos OS Release 15.1X49-D40 and onwards, SRX300, SRX320,
SRX340, SRX345, SRX380, and SRX550HM devices support VDSL2 (pt), serial (se), T1 (t1) , and E1 (e1) interfaces.
Services Interfaces
Services interfaces provide specific capabilities for manipulating traffic before it is delivered to its destination. On Juniper Networks M Series and T Series routing platforms, individual services such as IP-over-IP encapsulation, link services such as multilink protocols, adaptive services such as stateful firewall filters and NAT, and sampling and logging capabilities are implemented by services Physical Interface Cards (PICs). On SRX Series Firewalls, services processing is handled by the Services Processing Card (SPC).
Although the same Junos OS image supports the services features across all routing platforms, on
SRX Series Firewalls, services interfaces are not associated with a physical interface.
To configure services on these devices, you configure one or more internal interfaces by
specifying slot 0, interface carrier 0, and port
0—for example, gr-0/0/0 for GRE.
Table 2 describes services interfaces that you can configure on SRX Series Firewalls.
Interface Name |
Description |
|---|---|
|
Configurable generic routing encapsulation (GRE) interface. GRE allows the encapsulation of one routing protocol inside another routing protocol. Packets are routed to this internal interface, where they are first encapsulated with a GRE packet and then sent. You can create multiple instances of this interface for forwarding encapsulated data to multiple destination addresses by using the default interface as the parent and creating extensions, for example, gr-0/0/0.1, gr-0/0/0.2, and so on. The GRE interface is an internal interface only and is not associated with a physical interface. It is used only for processing GRE traffic. See the Junos OS Services Interfaces Library for Routing Devices for information about tunnel services. |
|
Configurable IP-over-IP encapsulation (IP-IP tunnel) interface. IP tunneling allows the encapsulation of one IP packet inside another IP packet. With IP routing, you can route IP packets directly to a particular address or route the IP packets to an internal interface where they are encapsulated inside an IP-IP tunnel and forwarded to the encapsulating packet’s destination address. You can create multiple instances of this interface for forwarding IP-IP tunnel data to multiple destination addresses by using the default interface as the parent and creating extensions, for example, ip-0/0/0.1, ip-0/0/0.2, and so on. The IP-IP interface is an internal interface only and is not associated with a physical interface. It is used only for processing IP-IP tunnel traffic. See the Junos OS Services Interfaces Library for Routing Devices for information about tunnel services. |
|
Configurable link services queuing interface. Link services include the multilink services MLPPP, MLFR, and Compressed Real-Time Transport Protocol (CRTP). Packets are routed to this internal interface for link bundling or compression. The link services interface is an internal interface only and is not associated with a physical interface. You must configure the interface for it to perform multilink services. Note:
The ls-0/0/0 interface has been deprecated. All multiclass multilink features supported by ls-0/0/0 are now supported by lsq-0/0/0. |
|
Configurable logical tunnel interface that interconnects logical systems on SRX Series Firewalls. See the Logical Systems and Tenant Systems User Guide for Security Devices. |
|
Configurable PPPoE encapsulation interface. PPP packets being routed in an Ethernet network use PPPoE encapsulation. Packets are routed to this internal interface for PPPoE encapsulation. The PPPoE encapsulation interface is an internal interface only and is not associated with a physical interface. You must configure the interface for it to forward PPPoE traffic. |
|
Protocol Independent Multicast (PIM) de-encapsulation interface. In PIM sparse mode, the first-hop routing platform encapsulates packets destined for the rendezvous point device. The packets are encapsulated with a unicast header and are forwarded through a unicast tunnel to the rendezvous point. The rendezvous point then de-encapsulates the packets and transmits them through its multicast tree. Within a device, packets are routed to this internal interface
for de-encapsulation. The PIM de-encapsulation interface is an internal
interface only and is not associated with a physical interface. You
must configure PIM with the Use the |
|
Protocol Independent Multicast (PIM) encapsulation interface. In PIM sparse mode, the first-hop routing platform encapsulates packets destined for the rendezvous point device. The packets are encapsulated with a unicast header and are forwarded through a unicast tunnel to the rendezvous point. The rendezvous point then de-encapsulates the packets and transmits them through its multicast tree. Within a device, packets are routed to this internal interface
for encapsulation. The PIM encapsulation interface is an internal
interface only and is not associated with a physical interface. You
must configure PIM with the |
|
Secure tunnel interface used for IPSec VPNs. See the IPsec VPN User Guide for Security Devices. |
|
Configurable USB modem physical interface. This interface is detected when a USB modem is connected to the USB port on the device. |
|
|
Multicast tunnel interface. This interface is automatically generated, but you can configure properties on it if needed. |
Table 3 describes non-configurable services interfaces for SRX Series Firewalls.
Interface Name |
Description |
|---|---|
|
|
Internally generated Generic Routing Encapsulation (GRE) interface created by Junos OS to handle GRE traffic. It is not a configurable interface. |
|
|
Internally generated IP-over-IP interface created by Junos OS to handle IP tunnel traffic. It is not a configurable interface. |
|
|
Internally generated link services interface created by Junos OS to handle multilink services like MLPPP, MLFR, and CRTP. It is not a configurable interface. |
|
|
Internally configured interface used by the system as a control path between the WXC Integrated Services Module and the Routing Engine. It is not a configurable interface. See the WX and WXC Series. |
|
|
Internally generated Protocol Independent Multicast (PIM) de-encapsulation interface created by Junos OS to handle PIM de-encapsulation. It is not a configurable interface. |
|
|
Internally generated Protocol Independent Multicast (PIM) encapsulation interface created by Junos OS to handle PIM encapsulation. It is not a configurable interface. |
|
|
Internally generated interface created by Junos OS to monitor and record traffic during passive monitoring. Packets discarded by the Packet Forwarding Engine are placed on this interface. It is not a configurable interface. |
|
|
Adaptive services interface. The logical interface
|
Special Interfaces
Special interfaces include management interfaces, which are primarily intended for accessing the device remotely, the loopback interface, which has several uses depending on the particular Junos OS feature being configured, and the discard interface.
Table 4 describes special interfaces for SRX Series Firewalls.
Interface Name |
Description |
|---|---|
|
On SRX Series Firewalls, the fxp0 management interface is a dedicated port located on the Routing Engine. |
|
Loopback address. The loopback address has several uses, depending on the particular Junos feature being configured. |
|
Discard interface. |
Interface Naming Conventions
Each device interface has a unique name that follows a naming convention. If you are familiar with Juniper Networks M Series and T Series routing platforms, be aware that device interface names are similar to but not identical to the interface names on those routing platforms.
The unique name of each network interface identifies its type and location and indicates whether it is a physical interface or an optional logical unit created on a physical interface.
The name of each network interface has the following format to identify the physical device that corresponds to a single physical network connector:
type-slot/pim-or-ioc/port
Network interfaces that are fractionalized into time slots include a channel number in the name, preceded by a colon (:):
type-slot/pim-or-ioc/port:
channelEach logical interface has an additional logical unit identifier, preceded by a period (.):
type-slot/pim-or-ioc/port:<channel>.unit
The parts of an interface name are summarized in Table 5.
Name Part |
Meaning |
Possible Values |
|---|---|---|
|
Type of network medium that can connect to this interface. |
ae, at, ei, e3, fe, fxp0, fxp1, ge, lo0, lsq, lt, ppo, pt, sto, t1, t3, xe, and so on. |
|
Number of the chassis slot in which a PIM or IOC is installed. |
SRX5600 and SRX5800 devices: The slot number begins at
SRX3400 and SRX3600 devices: The Switch Fabric Board
(SFB) is always
|
|
Number of the PIM or IOC on which the physical interface is located. |
SRX5600 and SRX5800 devices: For 40-port Gigabit Ethernet IOCs
or 4-port 10-Gigabit Ethernet IOCs, this number can be SRX3400, SRX3600, and SRX 4600 devices: This number is always |
|
Number of the port on a PIM or IOC on which the physical interface is located. |
On SRX5600 and SRX5800 devices:
On SRX3400, SRX3600, and SRX 4600 devices:
Port numbers appear on the PIM or IOC faceplate. |
|
Number of the channel (time slot) on a fractional or channelized T1 or E1 interface. |
|
|
Number of the logical interface created on a physical interface. |
A value from If no logical interface number is specified, unit In addition to user-configured interfaces, there are some logical interfaces that are created dynamically. Hence, for Junos OS, the maximum limit for configuring logical interfaces is 2,62,143 (user configured and dynamically created). Based on performance, for each platform, the maximum number of logical interfaces supported can vary. |
Platform support depends on the Junos OS release in your installation.
Understanding the Data Link Layer
The Data Link Layer is Layer 2 in the Open Systems Interconnection (OSI) model. The Data Link Layer is responsible for transmitting data across a physical network link. Each physical medium has link-layer specifications for network and link-layer protocol characteristics such as physical addressing, network topology, error notification, frame sequencing, and flow control.
- Physical Addressing
- Network Topology
- Error Notification
- Frame Sequencing
- Flow Control
- Data Link Sublayers
- MAC Addressing
Physical Addressing
Physical addressing is different from network addressing. Network addresses differentiate between nodes or devices in a network, allowing traffic to be routed or switched through the network. In contrast, physical addressing identifies devices at the link-layer level, differentiating between individual devices on the same physical medium. The primary form of physical addressing is the media access control (MAC) address.
Network Topology
Network topology specifications identify how devices are linked in a network. Some media allow devices to be connected by a bus topology, while others require a ring topology. The bus topology is used by Ethernet technologies, which are supported on Juniper Networks devices.
Error Notification
The Data Link Layer provides error notifications that alert higher layer protocols that an error has occurred on the physical link. Examples of link-level errors include the loss of a signal, the loss of a clocking signal across serial connections, or the loss of the remote endpoint on a T1 or T3 link.
Frame Sequencing
The frame sequencing capabilities of the Data Link Layer allow frames that are transmitted out of sequence to be reordered on the receiving end of a transmission. The integrity of the packet can then be verified by means of the bits in the Layer 2 header, which is transmitted along with the data payload.
Flow Control
Flow control within the Data Link Layer allows receiving devices on a link to detect congestion and notify their upstream and downstream neighbors. The neighbor devices relay the congestion information to their higher layer protocols so that the flow of traffic can be altered or rerouted.
Data Link Sublayers
The Data Link Layer is divided into two sublayers: logical link control (LLC) and media access control (MAC). The LLC sublayer manages communications between devices over a single link of a network. This sublayer supports fields in link-layer frames that enable multiple higher layer protocols to share a single physical link.
The MAC sublayer governs protocol access to the physical network medium. Through the MAC addresses that are typically assigned to all ports on a device, multiple devices on the same physical link can uniquely identify one another at the Data Link Layer. MAC addresses are used in addition to the network addresses that are typically configured manually on ports within a network.
MAC Addressing
A MAC address is the serial number permanently stored in a device adapter to uniquely identify the device. MAC addresses operate at the Data Link Layer, while IP addresses operate at the Network Layer. The IP address of a device can change as the device is moved around a network to different IP subnets, but the MAC address remains the same, because it is physically tied to the device.
Within an IP network, devices match each MAC address to its corresponding configured IP address by means of the Address Resolution Protocol (ARP). ARP maintains a table with a mapping for each MAC address in the network.
Most Layer 2 networks use one of three primary numbering spaces—MAC-48, EUI-48 (extended unique identifier), and EUI-64—which are all globally unique. MAC-48 and EUI-48 spaces each use 48-bit addresses, and EUI-64 spaces use a 64-bit addresses, but all three use the same numbering format. MAC-48 addresses identify network hardware, and EUI-48 addresses identify other devices and software.
The Ethernet and ATM technologies supported on devices use the MAC-48 address space. IPv6 uses the EUI-64 address space.
MAC-48 addresses are the most commonly used MAC addresses in most networks. These addresses are 12-digit hexadecimal numbers (48 bits in length) that typically appear in one of the following formats:
MM:MM:MM:SS:SS:SSMM-MM-MM-SS-SS-SS
The first three octets (MM:MM:MM or MM-MM-MM) are the ID number of
the hardware manufacturer. Manufacturer ID numbers are assigned by
the Institute of Electrical and Electronics Engineers (IEEE). The
last three octets (SS:SS:SS or SS-SS-SS) make up the serial number for
the device, which is assigned by the manufacturer. For example, an
Ethernet interface card might have a MAC address of 00:05:85:c1:a6:a0.
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.