Configuring Enhanced Switching Mode Features

This section describes how to configure enhanced switching mode features on SRX Series and J Series devices.

This section covers:

• Configuring VLANs—Quick Configuration
• Configuring a Spanning Tree—Quick Configuration
• Configuring LACP in J-Web
• Configuring 802.1X Features
• Configuring IGMP Snooping—Quick Configuration
• Configuring GVRP—Quick Configuration

Configuring VLANs—Quick Configuration

Each VLAN is a collection of network nodes that are grouped together to form separate broadcast domains. On an Ethernet network that is a single LAN, all traffic is forwarded to all nodes on the LAN. On VLANs, frames whose origin and destination are in the same VLAN are forwarded only within the local VLAN. Frames that are not destined for the local VLAN are the only ones forwarded to other broadcast domains. VLANs thus limit the amount of traffic flowing across the entire LAN, reducing the possible number of collisions and packet retransmissions within a VLAN and on the LAN as a whole.

On an Ethernet LAN, all network nodes must be physically connected to the same network. On VLANs, the physical location of the nodes is not important, so you can group network devices in any way that makes sense for your organization, such as by department or business function, by types of network nodes, or even by physical location. Each VLAN is identified by a single IP subnetwork and by standardized IEEE 802.1Q encapsulation.

To access the VLAN:

1. In the J-Web user interface, select Configure>Switching>VLAN.

   The VLAN configuration page displays a list of existing VLANs. If you select a specific VLAN, the specific VLAN details are displayed in the details section.

2. Click one:
   • Add—Creates a VLAN.
   • Edit—Edits an existing VLAN configuration.
   • Delete—Deletes an existing VLAN.

     Note: If you delete a VLAN, the VLAN configuration for all the associated interfaces is also deleted.

   When you are adding or editing a VLAN, enter information as described in Table 4.

3. Click one:
   • OK—Saves the configuration and returns to the main configuration page, then click Commit Options>Commit.
   • Cancel—Cancels your entries and returns to the main configuration page.

Configuring a Spanning Tree—Quick Configuration

Juniper devices provide Layer 2 loop prevention through Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). You can configure bridge protocols data unit (BPDU) protection on interfaces to prevent them from receiving BPDUs that could result in STP misconfigurations, which could lead to network outages.

You can use the J-Web Quick Configuration to add a spanning tree or to edit or delete an existing spanning tree.

To access the Spanning Tree Quick Configuration:

1. In the J-Web user interface, select Configure>Switching>Spanning Tree.

   The Spanning Tree Configuration page displays a list of existing spanning trees. If you select a specific spanning tree, the specific spanning tree details are displayed in the General and Interfaces tabs.

2. Click one of the following:
   • Add—Creates a spanning tree.
   • Edit—Edits an existing spanning-tree configuration.
   • Delete—Deletes an existing spanning tree.

   When you are adding a spanning tree, select a protocol name:

   • If you select STP, enter information as described in Table 5.
   • If you select RSTP, enter information as described in Table 6.
   • If you select MSTP, enter information as described in Table 7.

   Select the Ports tab to configure the ports associated with this spanning tree. Click one of the following:

   • Add—Creates a new spanning-tree interface configuration.
   • Edit—Modifies an existing spanning-tree interface configuration.
   • Delete—Deletes an existing spanning-tree interface configuration.

   When you are adding or editing a spanning-tree port, enter information as described in Table 8.

3. Click one:
   • Click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.
   • click Cancel to cancel the configuration without saving changes.

Configuring LACP in J-Web

Use the link aggregation feature to aggregate one or more Ethernet interfaces to form a virtual link or link aggregation group (LAG). The MAC client can treat this virtual link like a single link. Link aggregation increases bandwidth, provides graceful degradation as failure occurs, and increases availability.

You can use the J-Web interface to add a new LAG or to edit or delete an existing LAG.

Note: The interfaces that are already configured with MTU, duplex, flow control, or logical interfaces are displayed. However, when you select an already configured interface, a warning message is displayed.

To access the LACP Configuration:

1. In the J-Web user interface, select Configure>Interfaces>Link Aggregation.

   The Aggregated Interfaces list is displayed.

2. Click one of the following:
   • Device Count—Creates an aggregated Ethernet interface, or LAG. You can choose the number of device that you want to create. Information displayed on the link aggregation page are specified in Table 9 and the details of aggregation are specified in Table 10
   • Add—Adds a new aggregated Ethernet Interface, or LAG. Enter information as specified in Table 11.
   • Edit— Modifies a selected LAG
     • Aggregation—Modifies an selected LAG. Enter information as specified in Table 11.
     • VLAN—Specifies VLAN options for the selected LAG. See Table 12 for details on the options.
     • IP Option—Configuring IP address to LAG is not supported and when you try to configure the IP address an error message is displayed.
   • Delete—Deletes the selected LAG.
   • Disable Port or Enable Port—Disables or enables the administrative status on the selected interface.
3. Click one:
   • Click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.
   • Click Cancel to cancel the configuration without saving changes.

Configuring 802.1X Features

IEEE 802.1X and MAC RADIUS authentication both provide network edge security, protecting Ethernet LANs from unauthorized user access by blocking all traffic to and from devices at the interface until the supplicant's credential or MAC address is presented and matched on the authentication server (a RADIUS server). When the supplicant is authenticated, the switch stops blocking access and opens the interface to the supplicant.

See the Junos OS Documentation for EX Series Switches for detailed examples of configuring 802.1X features.

Configuring Authentication Features (J-Web)

To configure 802.1X settings using the J-Web interface:

1. From the Configure menu, select Security > 802.1X.

   The 802.1X screen displays a list of interfaces, whether 802.1X security has been enabled, and the assigned port role.

   When you select a particular interface, the Details section displays 802.1X details for the selected interface.

   Note: After you make changes to the configuration, click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.

2. Click one:
   • RADIUS Servers—specifies the RADIUS server to be used for authentication. Select the check box to select the server. Click Add or Edit to add or modify the RADIUS server settings. Enter information as specified in Table 13.
   • Exclusion List—implements the authentication bypass option by listing the MAC address of each host to be excluded from 802.1X authentication. Click Add or Edit in the Exclusion list screen to include or modify the MAC address list. Enter information as specified in Table 14.
   • Edit—specifies 802.1X settings for the selected interface.
     • Apply 802.1X Profile—applies a predefined 802.1X profile based on the port role. If a message appears asking if you want to configure a RADIUS server, click Yes and enter information as specified in Table 13.
     • 802.1X Configuration—configures custom 802.1X settings for the selected interface. If a message appears asking if you want to configure a RADIUS server, click Yes and enter information as specified in Table 13. To configure 802.1X settings, enter information as specified in Table 15.
   • Delete—deletes the existing 802.1X authentication configuration on the selected interface.

Specifying RADIUS Server Connections on an SRX Series or J Series Device (CLI)

To use 802.1X or MAC RADIUS authentication, you must specify the connections on the SRX Series or J Series device for each RADIUS server to which you will connect.

To configure a RADIUS server:

1. Navigate to the access hierarchy and define the RADIUS server by its IP address and secret password. The secret password on the SRX Series or J Series device must match the secret password on the server.

   Note: For 802.1X authentication, the RADIUS server must be configured at the access hierarchy level.

   
   

   [edit]user@host# edit access[edit access]user@host# set radius-server 10.0.0.100 port 1812 secret abc

   To define more than one RADIUS server, you need to enter separate radius-server commands.

2. (Optional) Specify the IP address that the RADIUS server uses to identify the SRX Series or J Series device.

   By default, the RADIUS server uses the address of the interface sending the RADIUS request to determine the source of a request. If the request has been diverted on an alternate route to the RADIUS server, however, the interface relaying the request might not be an interface on the SRX Series or J Series device. To ensure that the source is identified correctly, specify its IP address explicitly.

   
   

   [edit access]user@host# set radius-server 10.0.0.100 source-address 10.93.14.100
3. Create a profile and configure the authentication order, making radius the first method of authentication.
   
   

   [edit access]user@host# set profile profile1 authentication-order radius

   
   
4. Specify one or more RADIUS servers to be associated with profile1.
   
   

   [edit access]user@host# set profile profile1 radius authentication-server 10.0.0.100

   
   
5. Navigate to the top of the hierarchy and define profile1 as the authentication profile for 802.1X or MAC RADIUS authenticator.
   
   

   [edit access]user@host# top [edit]user@host# set protocols dot1x authenticator authentication-profile-name profile1

   
   
6. Configure the IP address of the SRX Series or J Series device in the list of clients on the RADIUS server. For specifics on configuring the RADIUS server, consult the documentation for your server.

Configuring 802.1X Interface Settings (CLI)

To configure 802.1X authentication on an interface:

1. Navigate to the [edit protocols dot1x] hierarchy and configure the supplicant mode as single (authenticates the first supplicant), single-secure (authenticates only one supplicant), or multiple (authenticates multiple supplicants).
   
   

   [edit]user@host# edit protocols dot1x [edit protocols dot1x]user@host# set authenticator interface ge-0/0/5 supplicant multiple
2. Enable reauthentication and specify the reauthentication interval.
   
   

   [edit protocols dot1x]user@host# set authenticator interface ge-0/0/5/0 reauthentication 120
3. Configure the interface timeout value for the response from the supplicant.
   
   

   [edit protocols dot1x]user@host# set authenticator interface ge-0/0/5 supplicant-timeout 5
4. Configure the timeout for the interface before it resends an authentication request to the RADIUS server.
   
   

   [edit protocols dot1x]user@host# set authenticator interface ge-0/0/5 server-timeout 5
5. Configure how long, in seconds, the interface waits before retransmitting the initial EAPOL PDUs to the supplicant.
   
   

   [edit protocols dot1x]user@host# set authenticator interface ge-0/0/5 transmit-period 60
6. Configure the maximum number of times an EAPOL request packet is retransmitted to the supplicant before the authentication session times out.
   
   

   [edit protocols dot1x]user@host# set authenticator interface ge-0/0/5 maximum-requests 5

Example: Configuring a Guest VLAN (CLI)

802.1X provides LAN access to nonresponsive hosts (hosts where 802.1X is not enabled). These hosts, referred to as guests, typically are provided access only to the Internet.

To create a guest VLAN and to verify the configuration:

1. Configure a VLAN named visitor-vlan.
   
   

   [edit]

   
   

   user@host# set vlans visitor-vlan vlan-id 300
2. Navigate to the top of the hierarchy to configure visitor-vlan as the guest VLAN.
   
   

   top [edit] user@host# set protocols dot1x authenticator interface all guest-vlan visitor-vlan
3. Check the configuration.
   
   

   [edit] user@host> show configuration
   protocols {dot1x {authenticator {interface {all {guest-vlan {visitor-vlan;}}}}}}vlans {visitor-vlan {vlan-id 300;}}
4. If you are finished configuring the VLAN, commit the configuration.

Configuring IGMP Snooping—Quick Configuration

IGMP snooping regulates multicast traffic in a switched network. With IGMP snooping enabled, the Juniper device monitors the IGMP transmissions between a host (a network device) and a multicast router, keeping track of the multicast groups and associated member interfaces. The Juniper device uses that information to make intelligent multicast-forwarding decisions and forward traffic to the intended destination interfaces.

You can use the J-Web Quick Configuration to add a new IGMP snooping configuration or to edit or delete an existing configuration.

To access the IGMP Snooping Quick Configuration:

1. In the J-Web user interface, select Configure>Switching>IGMP Snooping.

   The VLAN Configuration page displays a list of existing IGMP snooping configurations.

2. Click one:
   • Add—Creates an IGMP snooping configuration for the VLAN.
   • Edit—Edits an existing IGMP snooping configuration for the VLAN.
   • Delete—Deletes member settings for the interface.

     Note: If you delete a configuration, the VLAN configuration for all the associated interfaces is also deleted.

   • Disable Vlan—Disables IGMP snooping on the selected VLAN.

   When you are adding or editing a VLAN, enter information as described in Table 16.

3. Click one:
   • Click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.
   • Click Cancel to cancel the configuration without saving changes.

Configuring GVRP—Quick Configuration

As a network expands and the number of clients and VLANs increases, VLAN administration becomes complex, and the task of efficiently configuring VLANs on multiple EX Series switches becomes increasingly difficult. To automate VLAN administration, you can enable GARP VLAN Registration Protocol (GVRP) on the network.

GVRP learns VLANs on a particular 802.1Q trunk port, and adds the corresponding trunk interface to the VLAN if the advertised VLAN is preconfigured or existing already on the switch. For example, a VLAN named “sales” is advertised to trunk interface 1 on the GVRP-enabled switch. The switch adds trunk interface 1 to the sales VLAN if the sales VLAN already exists on the switch.

As individual interfaces become active and send requests to join a VLAN, the VLAN configuration is updated and propagated among the switches. Limiting the VLAN configuration to active participants reduces the network overhead. GVRP also provides the benefit of pruning VLANs to limit the scope of broadcast, unknown unicast, and multicast (BUM) traffic to interested network devices only.

You can use the J-Web Quick Configuration to enable or disable GVRP on an interface.

To access the GVRP Quick Configuration:

1. In the J-Web user interface, select Configure>Switching>GVRP.

   The GVRP Configuration page displays a list of interfaces on which GVRP is enabled.

2. Click one:
   • Global Settings—Modifies GVRP timers. Enter the information as described in Table 17.
   • Add—Enables GVRP on an interface.
   • Disable Port—Disables an interface.
   • Delete—Deletes an interface.
3. Click one:
   • Click OK to check your configuration and save it as a candidate configuration, then click Commit Options>Commit.
   • Click Cancel to cancel the configuration without saving changes.