Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Using the Enhanced Layer 2 Software CLI

    Enhanced Layer 2 Software (ELS) provides a uniform CLI for configuring and monitoring Layer 2 features on QFX Series switches, EX Series switches, and other Juniper Networks devices, such as MX Series routers. With ELS, you configure Layer 2 features in the same way on all these Juniper Networks devices.

    This topic explains how to know if your platform is running ELS. It also explains how to perform some common tasks using the ELS style of configuration.

    Understanding Which Devices Support ELS

    ELS is automatically supported if your device is running a Junos OS release that supports it. You do not need to take any action to enable ELS, and you cannot disable ELS. See Feature Explorer for information about which platforms and releases support ELS.

    Note: Keep in mind the following caveats for the QFX Series and QFabric systems:

    • For QFX3500 and QFX3600 switches, ELS is supported only on the software package that supports Virtual Chassis (the jinstall-qfx-3-* software package).
    • For QFX5100 switches, ELS is supported only on the jinstall-qfx-5-* software package.
    • ELS is not supported on software packages that can be installed in a QFabric system.

    Understanding How to Configure Layer 2 Features Using ELS

    Because ELS provides a uniform CLI, you can now perform the following tasks on supported devices in the same way:

    Configuring a VLAN

    You can configure one or more VLANs to perform Layer 2 bridging. The Layer 2 bridging functions include integrated routing and bridging (IRB) for support for Layer 2 bridging and Layer 3 IP routing on the same interface. EX Series and QFX Series switches can function as Layer 2 switches, each with multiple bridging, or broadcast, domains that participate in the same Layer 2 network. You can also configure Layer 3 routing support for a VLAN.

    To configure a VLAN:

    1. Create the VLAN by setting a unique VLAN name and configuring the VLAN ID:
      [edit]
      user@host# set vlans vlan-name vlan-id vlan-id-number

      Using the VLAN ID list option, you can optionally specify a range of VLAN IDs.

      [edit]
      user@host# set vlans vlan-name vlan-id-list vlan-ids | vlan-id--vlan-id
    2. Assign at least one interface to the VLAN:
      [edit]
      user@host# set interface interface-name family ethernet-switching vlan members vlan-name

    Configuring the Native VLAN Identifier

    EX Series and QFX Series switches support receiving and forwarding routed or bridged Ethernet frames with 802.1Q VLAN tags. Typically, trunk ports, which connect switches to each other, accept untagged control packets, but do not accept untagged data packets. You can enable a trunk port to accept untagged data packets by configuring a native VLAN ID on the interface on which you want the untagged data packets to be received.

    To configure the native VLAN ID:

    1. On the interface on which you want untagged data packets to be received, set the interface mode to trunk, which specifies that the interface is in multiple VLANs and can multiplex traffic between different VLANs.
      [edit interfaces]
      user@host# set interface-name unit logical-unit-number family ethernet-switching interface-mode trunk
    2. Configure the native VLAN ID and assign the interface to the native VLAN ID:
      [edit interfaces]
      user@host# set interface-name native-vlan-id number
    3. Assign the interface to the native VLAN ID:
      [edit interfaces]
      user@host# set interface-name unit logical-unit-number family ethernet-switching vlan members native-vlan-id-number

    Configuring Layer 2 Interfaces

    To ensure that your high-traffic network is tuned for optimal performance, explicitly configure some settings on the switch's network interfaces.

    To configure a Gigabit Ethernet interface or a 10-Gigabit Ethernet interface as a trunk interface:

    [edit]
    user@host# set interfaces interface-name unit logical-unit-number family ethernet-switching interface-mode trunk

    To configure a Gigabit Ethernet interface or a 10-Gigabit Ethernet interface as a access interface:

    [edit]
    user@host# set interfaces interface-name unit logical-unit-number family ethernet-switching interface-mode access

    To assign an interface to VLAN:

    [edit interfaces]
    user@host# set interface-name unit logical-unit-number family ethernet-switching vlan members [all | vlan-names | vlan-ids]

    Configuring Layer 3 Interfaces

    To configure a Layer 3 interface, you must assign an IP address to the interface. You assign an address to an interface by specifying the address when you configure the protocol family. For the inet or inet6 family, configure the interface IP address.

    You can configure interfaces with a 32-bit IP version 4 (IPv4) address and optionally with a destination prefix, sometimes called a subnet mask. An IPv4 address utilizes a 4-octet dotted decimal address syntax (for example, 192.168.1.1). An IPv4 address with destination prefix utilizes a 4-octet dotted decimal address syntax with a destination prefix appended (for example, 192.168.1.1/16).

    To specify an IP4 address for the logical unit:

    [edit]
    user@host# set interfaces interface-name unit logical-unit-number family inet address ip-address

    You represent IP version 6 (IPv6) addresses in hexadecimal notation by using a colon-separated list of 16-bit values. You assign a 128-bit IPv6 address to an interface.

    To specify an IP6 address for the logical unit:

    [edit]
    user@host# set interfaces interface-name unit logical-unit-number family inet6 address ip-address

    Configuring an IRB Interface

    Integrated routing and bridging (IRB) provides support for Layer 2 bridging and Layer 3 IP routing on the same interface. IRB enables you to route packets to another routed interface or to another VLAN that has a Layer 3 protocol configured. IRB interfaces enable the device to recognize packets that are being sent to local addresses so that they are bridged (switched) whenever possible and are routed only when necessary. Whenever packets can be switched instead of routed, several layers of processing are eliminated. An interface named irb functions as a logical router on which you can configure a Layer 3 logical interface for VLAN. For redundancy, you can combine an IRB interface with implementations of the Virtual Router Redundancy Protocol (VRRP) in both bridging and virtual private LAN service (VPLS) environments.

    To configure an IRB interface:

    1. Create a Layer 2 VLAN by assigning it a name and a VLAN ID:
      [edit]
      user@host# set vlans vlan-name vlan-id vlan-id
    2. Create an IRB logical interface:
      [edit]
      user@host# set interface irb unit logical-unit-number family inet address ip-address
    3. Associate the IRB interface with the VLAN:
      [edit]
      user@host# set vlans vlan-name l3-interface irb.logical-unit-number

    Configuring an Aggregated Ethernet Interface and Configuring LACP on That Interface

    Use the link aggregation feature to aggregate one or more links to form a virtual link or link aggregation group (LAG). The MAC client can treat this virtual link as if it were a single link to increase bandwidth, provide graceful degradation as failure occurs, and increase availability.

    To configure an aggregated Ethernet interface:

    1. Specify the number of aggregated Ethernet interfaces to be created:
      [edit chassis]
      user@host# set aggregated-devices ethernet device-count number
    2. Specify the name of the link aggregation group interface:
      [edit]
      user@host# set interfaces aex
    3. Specify the minimum number of links for the aggregated Ethernet interface (aex)– that is, the defined bundle– to be labeled up:
      [edit interfaces]
      user@host# set aex aggregated-ether-options minimum-links number
    4. Specify the link speed for the aggregated Ethernet bundle:
      [edit interfaces]
      user@host# set aex aggregated-ether-options link-speed link-speed
    5. Specify the members to be included within the aggregated Ethernet bundle:
      [edit interfaces]
      user@host# set interface-name ether-options 802.3ad aex
      user@host# set interface-name ether-options 802.3ad aex
    6. Specify an interface family for the aggregated Ethernet bundle:
      [edit interfaces]
      user@host# set aex unit 0 family inet address ip-address

    For aggregated Ethernet interfaces on the device, you can configure the Link Aggregation Control Protocol (LACP). LACP bundles several physical interfaces to form one logical interface. You can configure aggregated Ethernet with or without LACP enabled.

    When LACP is enabled, the local and remote sides of the aggregated Ethernet links exchange protocol data units (PDUs), containing information about the state of the link. You can configure Ethernet links to actively transmit PDUs, or you can configure the links to passively transmit them, sending out LACP PDUs only when they receive them from another link. One side of the link must be configured as active for the link to be up.

    To configure LACP:

    1. Enable one side of the aggregated Ethernet link as active:
      [edit interfaces]
      user@host# set aex aggregated-ether-options lacp active
    2. Specify the interval at which the interfaces send LACP packets:
      [edit interfaces]
      user@host# set aex aggregated-ether-options lacp periodic interval

    Understanding ELS Configuration Statement and Command Changes

    ELS was introduced in Junos OS Release 12.3R2 for EX9200 switches. ELS changes the CLI for some of the Layer 2 features on supported EX Series and QFX Series switches.

    The following sections provide a list of existing commands that were moved to new hierarchy levels or changed on EX Series switches as part of this CLI enhancement effort. These sections are provided as a high-level reference only. For detailed information about these commands, use the links to the configuration statements provided or see the technical documentation.

    Changes to the ethernet-switching-options Hierarchy Level

    This section outlines the changes to the ethernet-switching-options hierarchy level.

    Note: The ethernet-switching-options hierarchy level has been renamed as switch-options.

    Table 1: Renaming the ethernet-switching-options hierarchy

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options {authentication-whitelist {...}}
    switch-options {...authentication-whitelist {...}}
    ethernet-switching-options { interfaces interface-name {no-mac-learning;...}}
    switch-options { interfaces interface-name { no-mac-learning;...}}
    switch-options {unknown-unicast-forwarding {(...)}}
    ethernet-switching-options { voip { interface (all | [interface-name | access-ports]) { forwarding-class (assured-forwarding | best-effort | expedited-forwarding | network-control); vlan vlan-name;...}}}
    switch-options { voip { interface (all | [interface-name | access-ports]) { forwarding-class (assured-forwarding | best-effort | expedited-forwarding | network-control); vlan vlan-name;...}}}

    Table 2: RTG Statements

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options {redundant-trunk-group {group name {description;interface interface-name {primary;}preempt-cutover-timer seconds;...}}}
    switch-options {redundant-trunk-group {group name {description;interface interface-name {primary;}preempt-cutover-timer seconds;...}}}

    Table 3: Deleted Statements

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options {mac-notification {notification-interval seconds;...}}

    The statements have been removed from the switch-options hierarchy.

    ethernet-switching-options { traceoptions {file filename <files number> <no-stamp> <replace>
    <size size> <world-readable | no-world-readable>;
    flag flag <disable>;...}
    }

    The statements have been removed from the switch-options hierarchy.

    ethernet-switching-options {port-error-disable {disable-timeout timeout;...}}

    Note: The port-error-disable statement has been replaced with a new statement.

    interfaces interface-name family ethernet-switching {recovery-timeout seconds;}

    Changes to the Port Mirroring Hierarchy Level

    Note: Statements have moved from the ethernet-switching-options hierarchy level to the forwarding-options hierarchy level.

    Table 4: Port Mirroring hierarchy

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options {analyzer (Port Mirroring) { name {...}}}
    forwarding-options {analyzer (Port Mirroring) { name {...}}}

    Changes to the Layer 2 Control Protocol Hierarchy Level

    The Layer 2 control protocol statements have moved from the ethernet-switching-options hierarchy to the protocols hierarchy.

    Table 5: Layer 2 Control Protocol

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options { bpdu-block {...}}
    protocols { layer2-control {bpdu-block {...}}}

    Changes to the dot1q-tunneling Statement

    The dot1q-tunneling statement has been replaced with a new statement and moved to a different hierarchy level.

    Table 6: dot1q-tunneling

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options { dot1q-tunneling { ether-type (0x8100 | 0x88a8 | 0x9100);...}}
    interfaces interface-name {ether-options {ethernet-switch-profile {tag-protocol-id [tpids];}}}
    interfaces interface-name {aggregated-ether-options {ethernet-switch-profile {tag-protocol-id [tpids];}}}

    Changes to the L2 Learning Protocol

    The mac-table-aging-time statement has been replaced with a new statement and moved to a different hierarchy level.

    Table 7: mac-table-aging-time statement

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options {mac-table-aging-time seconds;...}
    protocols { l2-learning {global-mac-table-aging-time seconds;...}}

    Changes to Nonstop Bridging

    The nonstop-bridging statement has moved to a different hierarchy level.

    Table 8: Nonstop Bridging statement

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options {nonstop-bridging;}
    protocols {layer2-control {nonstop-bridging {}}}

    Changes to Port Security and DHCP Snooping

    Port security and DHCP snooping statements have moved to different hierarchy levels.

    Note: The statement examine-dhcp does not exist in the changed hierarchy. DHCP snooping is now enabled automatically when other DHCP security features are enabled on a VLAN. See Configuring Port Security Features for additional information.

    Table 9: Port Security statements

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options { secure-access-port { interface (all | interface-name) {(dhcp-trusted | no-dhcp-trusted ); static-ip ip-address { mac mac-address; vlan vlan-name;}} vlan (all | vlan-name) {(arp-inspection | no-arp-inspection ); dhcp-option82 {disable; circuit-id { prefix hostname; use-interface-description; use-vlan-id;} remote-id { prefix (hostname | mac | none); use-interface-description; use-string string;} vendor-id [string];}(examine-dhcp | no-examine-dhcp);}(ip-source-guard | no-ip-source-guard);}}
    vlans vlan-name forwarding-options{dhcp-security {arp-inspection; group group-name {interfaceiinterface-name {static-ip ip-address {mac mac-address;}}overrides {no-option82; trusted; }}ip-source-guard; no-dhcp-snooping; option-82 {circuit-id {prefix {host-name; routing-instance-name;}use-interface-description (device | logical); use-vlan-id; }remote-id {host-name; use-interface-description (device | logical); use-string string;}vendor-id {use-string string;}}}

    Note: DHCP snooping statements have moved to a different hierarchy level.

    Table 10: DHCP Snooping Statements

    Original Hierarchy

    Changed Hierarchy

    ethernet-switching-options { secure-access-port {dhcp-snooping-file {location local_pathname | remote_URL;timeout seconds;write-interval seconds;}
    system [processes [dhcp-servicedhcp-snooping-file local_pathname | remote_URL;write-interval interval;}}

    Changes to Configuring VLANs

    The statements for configuring VLANs have moved to a different hierarchy level.

    Note: Starting with Junos OS Release 14.1X53-D10 for EX4300 and EX4600 switches, when enabling xSTP, you can enable it on some or all interfaces included in a VLAN. For example, if you configure VLAN 100 to include interfaces ge-0/0/0, ge-0/0/1, and ge-0/0/2, and you want to enable MSTP on interfaces ge-0/0/0 and ge-0/0/2, you can specify the set protocols mstp interface ge-0/0/0 and set protocols mstp interface ge-0/0/2 commands. In this example, you did not explicitly enable MSTP on interface ge-0/0/1; therefore, MSTP is not enabled on this interface.

    Table 11: VLAN hierarchy

    Original Hierarchy

    Changed Hierarchy

    vlans vlan-name switch-options {mac-move-limit}
    ethernet-switching-options {static {vlan vlan-id {mac mac-address next-hop interface-name;...}}}

    Note: Statement is replaced with a new statement and has moved to a different hierarchy level.

    vlans {vlan-name {switch-options {interface interface-name {static-mac mac-address;...}}}}
    vlans {vlan-name {interface interface-name { egress;ingress;mapping (native (push | swap) | policy | tag (push | swap));pvlan-trunk;...}}}

    These statements have been removed. You can assign interfaces to a VLAN using the [edit interfaces interface-name unit logical-unit-number family ethernet-switching vlan members vlan-name] hierarchy.

    vlans {vlan-name {isolation-id id-number;...}}

    Statements have been removed.

    vlans {vlan-name {l3-interface vlan.logical-interface-number;...}}

    Note: Syntax is changed.

    vlans {vlan-name {l3-interface irb.logical-interface-number;...}}
    vlans {vlan-name {l3-interface-ingress-counting layer-3-interface-name; ...}}

    Statement is removed. Ingress traffic is automatically tracked.

    vlans {vlan-name {no-local-switching;...}}

    Statement is removed.

    vlans {vlan-name {no-mac-learning;...}}

    Statement has been moved to different hierarchy.

    vlans {vlan-name {switch-options {no-mac-learning limit ...}}}
    vlans {vlan-name {primary-vlan vlan-name;...}}

    Statement has been removed.

    vlans {vlan-name {vlan-prune;...}}

    Statement is removed.

    vlans {vlan-name {vlan-range vlan-id-low-vlan-id-high;...}}

    Note: Statement has been replaced with a new statement.

    vlans {vlan-name {vlan-id-list [vlan-id-numbers];...}}
    vlans {vlan-name {l3-interface vlan.logical-interface-number;...}}

    Note: Syntax is changed.

    vlans {vlan-name {l3-interface irb.logical-interface-number;...}}

    Table 12: Statements Moved to a Different Hierarchy

    Original Hierarchy

    Changed Hierarchy

    vlans {vlan-name {dot1q-tunneling {customer-vlans (id | native | range);layer2-protocol-tunneling all | protocol-name {drop-threshold number;shutdown-threshold number;...}}}}
    interface interface-name {encapsulation extended-vlan-bridge; flexible-vlan-tagging; native-vlan-id number; unit logical-unit-number {input-vlan-map action; output-vlan-map action;vlan-id number;vlan-id-list [vlan-id vlan-idvlan-id];}}
    vlans {vlan-name {filter{input filter-nameoutput filter-name;...}}}
    vlans {vlan-name {forwarding-options {filter{input filter-nameoutput filter-name;...}}}}
    vlans {vlan-name {mac-limit limit action action;...}}
    vlans {vlan-name {switch-options {interface-mac-limit limit {packet-action action;...}}}}
    vlans {vlan-name {switch-options {interface interface-name {interface-mac-limit limit {packet-action action;...}}}}}
    vlans {vlan-name {mac-table-aging-time seconds;...}}
    protocols { l2-learning {global-mac-table-aging-time seconds;...}}

    Changes to Storm Control Profiles

    Storm control is configured in two steps. The first step is to create a storm control profile at the [edit forwarding-options] hierarchy level, and the second step is to bind the profile to a logical interface at the [edit interfaces] hierarchy level. See Example: Configuring Storm Control to Prevent Network Outages on EX Series Switches for the changed procedure.

    Table 13: Changes to the Storm Control Profile hierarchy level

    Original Hierarchy

    Changed Hierarchy

    forwarding-options {storm-control-profiles profile-name {(...)}}
    interfaces interface-name unit number family ethernet-switching {storm-control storm-control-profile;}

    Changes to the Interfaces Hierarchy

    Note: Statements have been moved to a different hierarchy.

    Table 14: Changes to the Interfaces hierarchy

    Original Hierarchy

    Changed Hierarchy

    interfaces interface-name {ether-options {link-mode mode;speed (auto-negotiation | speed)}}
    interfaces interface-name {link-mode mode;speed speed)}
    interfaces interface-name {unit logical-unit-number {family ethernet-switching {native-vlan-id vlan-id }}}
    interfaces interface-name {native-vlan-id vlan-id}
    interfaces interface-name {unit logical-unit-number {family ethernet-switching {port-mode mode }}}

    Note: Statement has been replaced with a new statement.

    interfaces interface-name {unit logical-unit-number {family ethernet-switching {interface-mode mode }}}

    Note: Statement has been replaced with a new statement.

    interfaces irb

    Changes to IGMP Snooping

    Table 15: IGMP Snooping hierarchy

    Original Hierarchy

    Changed Hierarchy

    protocols {igmp-snooping {traceoptions {file filename <files number> <no-stamp> <replace> <size maximum-file-size> <world-readable | no-world-readable>;flag flag <flag-modifier> <disable>;}vlan (all | vlan-identifier) {disable;data-forwarding {receiver {install;source-vlans vlan-name;}source {groups ip-address;}}immediate-leave;interface (all | interface-name) {multicast-router-interface;static {group multicast-ip-address;}}proxy {source-address ip-address;}robust-count number;}}}
    protocols {igmp-snooping {vlan vlan-name {immediate-leave;interface (all | interface-name) {group-limit <1..65535>host-only-interfacemulticast-router-interface;immediate-leave;static {group multicast-ip-address {source <>}}}}l2-querier {source-address ip-address;}proxy {source-address ip-address;}query-interval number;query-last-member-interval number;query-response-interval number;robust-count number;traceoptions {file filename <files number> <no-stamp> <replace> <size maximum-file-size> <world-readable | no-world-readable>;flag flag <flag-modifier>;}}}}

    Understanding the ELS Translator

    ELS Translator is a Web-based tool that converts Junos OS Layer 2 configurations to Enhanced Layer 2 Software (ELS) configurations. This conversion tool supports all Juniper Networks EX Series, MX Series, and QFX Series devices with ELS installed. ELS Translator is hosted on the Juniper Networks Customer Support website for EX Series switches, MX Series routers, and QFX Series switches and is available to registered users, internal users, partners, and premium service contract customers. You need to log in using your Juniper Networks username and password to access the ELS Translator.

    Click here to access the ELS translator.

    If you are upgrading from a version of Junos OS that does not support ELS to a version of Junos OS that supports ELS, we recommend that you update your configuration with the ELS Translator using the following procedure:

    1. Log in to your device by using the console port.

      Note: Perform this procedure only from the console port. You will lose connectivity to your device if you perform this procedure from a management port or any other interface.

    2. Copy the entire existing configuration to another file. Save the file in a remote location. See Saving a Configuration to a File.
    3. Retain the portion of your existing configuration related to management network connectivity (such as [edit system] hierarchy level). Delete all other top-level configuration hierarchy levels (such as the [edit interfaces], [edit protocols], and [edit vlans]). Issue the commit command to remove the deleted configuration hierarchy levels.
    4. Perform the software upgrade. Reboot your device to complete the upgrade. See Software Installation Overview.

      Note: Ensure that the console port connection is up during the reboot.

    5. Click here to access the ELS Translator in a web browser. Follow the instructions on the page to update your configuration.
    6. Return to your console port connection. When the switch has rebooted to complete the software upgrade, copy the configuration from the ELS Translator to your switch. See Uploading a Configuration File.
    7. Commit the new configuration.

    Note: It is possible that scripts do not translate correctly. Therefore, review translated scripts carefully before loading the converted configuration on your switch or other device.

    Modified: 2017-05-24