Table of Contents

About the Documentation
E Series and JunosE Documentation and Release Notes
Audience
E Series and JunosE Text and Syntax Conventions
Obtaining Documentation
Documentation Feedback
Requesting Technical Support
Chapters
Configuring Routing Policy
Overview
Platform Considerations
References
Route Maps
Route Map Configuration Example
Multiple Values in a Match Entry
Negating Match Clauses
Matching a Community List Exactly
Removing Community Lists from a Route Map
Matching a Policy List
Redistributing Access Routes
Setting Multicast Bandwidths
Match Policy Lists
Access Lists
Filtering Prefixes
Configuration Example 1
Configuration Example 2
Configuration Example 3
Filtering AS Paths
Configuration Example 1
Using Access Lists in a Route Map
Configuration Example 1
Using Access Lists for PIM Join Filters
Clearing Access List Counters
Creating Table Maps
Using the Null Interface
Prefix Lists
Using a Prefix List
Prefix Trees
Using a Prefix Tree
Community Lists
Extended Community Lists
Using Regular Expressions
AS-path Lists
Community Lists
Community Numbers
Metacharacters
Using Metacharacters as Literal Tokens
Regular Expression Examples
Managing the Routing Table
Troubleshooting Routing Policy
Monitoring Routing Policy
Configuring NAT
Overview
Platform Considerations
Module Requirements
References
NAT Configurations
Traditional NAT
Basic NAT
NAPT
Bidirectional NAT
Twice NAT
Network and Address Terms
Inside Local Addresses
Inside Global Addresses
Outside Local Addresses
Outside Global Addresses
Understanding Address Translation
Inside Source Translation
Outside Source Translation
Address Assignment Methods
Static Translations
Dynamic Translations
Order of Operations
Inside-to-Outside Translation
Outside-to-Inside Translation
PPTP and GRE Tunneling Through NAT
Packet Discard Rules
Before You Begin
Configuring a NAT License
Limiting Translation Entries
Specifying Inside and Outside Interfaces
Defining Static Address Translations
Creating Static Inside Source Translations
Creating Static Outside Source Translations
Defining Dynamic Translations
Creating Access List Rules
Defining Address Pools
Defining Dynamic Translation Rules
Creating Dynamic Inside Source Translation Rules
Creating Dynamic Outside Source Translation Rules
Defining Translation Timeouts
Clearing Dynamic Translations
NAT Configuration Examples
NAPT Example
Bidirectional NAT Example
Twice NAT Example
Cross-VRF Example
Tunnel Configuration Through NAT Examples
Clients on an Inside Network
Clients on an Outside Network
GRE Flows Through NAT
Monitoring NAT
Displaying the NAT License Key
Displaying Translation Statistics
Displaying Translation Entries
Displaying Address Pool Information
Displaying Inside and Outside Rule Settings
Configuring J-Flow Statistics
Overview
Interface Sampling
Aggregation Caches
Flow Collection
Main Flow Cache Contents
Cache Flow Export
Aging Flows
Operation with NAT
Operation with High Availability
Platform Considerations
Before You Configure J-Flow Statistics
Configuring Flow-Based Statistics Collection
Enabling Flow-Based Statistics
Enabling Flow-Based Statistics on an Interface
Defining a Sampling Interval
Setting Cache Size
Defining Aging Timers
Specifying the Activity Timer
Specifying the Inactivity Timer
Specifying Flow Export
Configuring Aggregation Flow Caches
Monitoring J-Flow Statistics
Clearing J-Flow Statistics
J-Flow show Commands
Configuring BFD
Bidirectional Forwarding Detection Overview
How BFD Works
Negotiation of the BFD Liveness Detection Interval
BFD Platform Considerations
BFD References
Configuring a BFD License
BFD Version Support
Configuring BFD
Managing BFD Adaptive Timer Intervals
Clearing BFD Sessions
Monitoring BFD
System Event Logs
Viewing BFD Information
Configuring IPsec
Overview
IPsec Terms and Acronyms
Platform Considerations
References
IPsec Concepts
Secure IP Interfaces
RFC 2401 Compliance
IPsec Protocol Stack
Security Parameters
Manual Versus Signaled Interfaces
Operational Virtual Router
Transport Virtual Router
Transport VR Definition
Transport VR Definitions with an FQDN
Perfect Forward Secrecy
Lifetime
Inbound and Outbound SAs
Transform Sets
Encapsulation Protocols
Encapsulation Modes
Supported Transforms
Negotiating Transforms
Other Security Features
IP Security Policies
ESP Processing
AH Processing
IPsec Maximums Supported
DPD and IPsec Tunnel Failover
Tunnel Failover
IKE Overview
Main Mode and Aggressive Mode
Aggressive Mode Negotiations
IKE Policies
Priority
Encryption
Hash Function
Authentication Mode
Diffie-Hellman Group
Lifetime
IKE SA Negotiation
Generating Private and Public Key Pairs
Configuration Tasks
Configuring an IPsec License
Configuring IPsec Parameters
Creating an IPsec Tunnel
Configuring DPD and IPsec Tunnel Failover
Defining an IKE Policy
Refreshing SAs
Enabling Notification of Invalid Cookies
Configuration Examples
Configuration Notes
Monitoring IPsec
System Event Logs
show Commands
Configuring Dynamic IPsec Subscribers
Dynamic IPsec Subscribers Overview
Dynamic Connection Setup
Dynamic Connection Teardown
Dynamic IPsec Subscriber Recognition
Licensing Requirements
Inherited Subscriber Functionality
Using IPsec Tunnel Profiles
Relocating Tunnel Interfaces
User Authentication
Dynamic IPsec Subscribers Platform Considerations
Dynamic IPsec Subscribers References
Creating an IPsec Tunnel Profile
Configuring IPsec Tunnel Profiles
Limiting Interface Instantiations on Each Profile
Specifying IKE Settings for IPsec Tunnels
Setting the IKE Local Identity
Setting the IKE Peer Identity
Appending a Domain Suffix to a Username
Overriding IPsec Local and Peer Identities for SA Negotiations
Specifying an IP Profile for IP Interface Instantiations
Defining the Server IP Address
Specifying Local Networks
Defining IPsec Security Association Lifetime Parameters
Defining User Reauthentication Protocol Values
Specifying IPsec Security Association Transforms
Specifying IPsec Security Association PFS and DH Group Parameters
Defining the Tunnel MTU
Defining IKE Policy Rules for IPsec Tunnels
Specification of a Virtual Router for an IKE Policy Rule Overview
Configuring a Virtual Router for an IKE Policy Rule
Defining Aggressive Mode for an IKE Policy Rule
Monitoring IPsec Tunnel Profiles
System Event Logs Used to Troubleshoot and Monitor Dynamic IPsec Subscribers
Monitoring IPsec Tunnel Profiles
Monitoring Active Subscribers
Configuring ANCP
Access Node Control Protocol Overview
Access Topology Discovery
Line Configuration
Transactional Multicast
OAM
Retrieval of DSL Line Rate Parameters
Learning the Partition ID from an Access Node
ANCP Platform Considerations
ANCP References
Configuring ANCP
Creating a Listening TCP Socket for ANCP
Accessing L2C Configuration Mode for ANCP
Defining the ANCP Session Timeout
Learning the Access Node Partition ID
Configuring ANCP Interfaces
Creating GSMP Output Labels
Configuring the Maximum Number of Branches for the ANCP User
Creating GSMP Input Labels
Configuring ANCP Neighbors
Accessing L2C Neighbor Configuration Mode for ANCP
Defining an ANCP Neighbor
Limiting Discovery Table Entries
Clearing ANCP Neighbors
Configuring Topology Discovery
Configuring ANCP for QoS Adaptive Mode
Overview of Configuring ANCP for QoS Adaptive Mode
Clearing Entries from the Topology Discovery Table
Enabling QoS Adaptive Mode for ANCP
Triggering ANCP Line Configuration
Adjusting the Data Rate Reported by ANCP for DSL Lines Overview
Configuring a QoS Adjustment Factor Applied to the ANCP Reported Data Rate
Example: Configuring Transactional Multicast for IGMP
Overview of Triggering ANCP OAM
Triggering ANCP OAM
Monitoring ANCP
Monitoring ANCP Configuration
Monitoring ANCP Discovery Table Entries
Monitoring Configured Values for the Adjustment Rate
Monitoring ANCP Labels
Monitoring ANCP Neighbors
Monitoring ANCP Statistics
Configuring Digital Certificates
Overview
Digital Certificate Terms and Acronyms
Platform Considerations
References
IKE Authentication with Digital Certificates
Signature Authentication
Generating Public/Private Key Pairs
Obtaining a Root CA Certificate
Obtaining a Public Key Certificate
Offline Certificate Enrollment
Online Certificate Enrollment
Authenticating the Peer
Verifying CRLs
File Extensions
Certificate Chains
IKE Authentication Using Public Keys Without Digital Certificates
Configuration Tasks
Public Key Format
Configuring Digital Certificates Using the Offline Method
Configuring Digital Certificates Using the Online Method
Configuring Peer Public Keys Without Digital Certificates
Monitoring Digital Certificates and Public Keys
Configuring IP Tunnels
Overview
GRE Tunnels
DVMRP Tunnels
Platform Considerations
Module Requirements
ERX7xx Models, ERX14xx Models, and the ERX310 Router
E120 Router and E320 Router
Redundancy and Tunnel Distribution
References
Configuration Tasks
Configuration Example
Configuring IP Tunnels to Forward IP Frames
Preventing Recursive Tunnels
Creating Multicast VPNs Using GRE Tunnels
Monitoring IP Tunnels
Configuring Dynamic IP Tunnels
Understanding Dynamic IP Tunnels
Data MDT for Multicast VPNs and Dynamic IP Tunnels
Mobile IP and Dynamic IP Tunnels
Combining Dynamic and Static IP Tunnels in the Same Chassis
Changing and Removing Existing Dynamic IP Tunnels
Dynamic IP Tunnel Platform Considerations
Module Requirements
ERX7xx Models, ERX14xx Models, and the ERX310 Router
E120 Router and E320 Router
Redundancy and Tunnel Distribution
Dynamic IP Tunnel References
Modifying the Configuration of the Default Destination Profile
Configuring a Destination Profile for Dynamic GRE Tunnels
Configuring a Destination Profile for Dynamic DVMRP Tunnels
Monitoring DVMRP Destination Profiles
Monitoring Dynamic DVMRP Tunnels
Monitoring GRE Destination Profiles
Monitoring Dynamic GRE Tunnels
IP Reassembly for Tunnels
Overview
Platform Considerations
Module Requirements
ERX7xx Models, ERX14xx Models, and the ERX310 Router
E120 Router and E320 Router
Configuring IP Reassembly
Monitoring IP Reassembly
Setting Statistics Baselines
Displaying Statistics
Securing L2TP and IP Tunnels with IPsec
Overview
Tunnel Creation
IPsec Secured-Tunnel Maximums
Platform Considerations
Module Requirements
References
L2TP/IPsec Tunnels
Setting Up the Secure L2TP Connection
L2TP with IPsec Control and Data Frames
Compatibility and Requirements
Client Software Supported
Interactions with NAT
Interaction Between IPsec and PPP
LNS Change of Port
Group Preshared Key
NAT Passthrough Mode
NAT Traversal
How NAT-T Works
UDP Encapsulation
UDP Statistics
NAT Keepalive Messages
Configuring and Monitoring NAT-T
Single-Shot Tunnels
Configuration Tasks for Client PC
Configuration Tasks for E Series Routers
Enabling IPsec Support for L2TP
Configuring NAT-T
Configuring Single-Shot Tunnels
GRE/IPsec and DVMRP/IPsec Tunnels
Setting Up the Secure GRE or DVMRP Connection
Configuration Tasks
Enabling IPsec Support for GRE and DVMRP Tunnels
Configuring IPsec Transport Profiles
Monitoring DVMRP/IPsec, GRE/IPsec, and L2TP/IPsec Tunnels
System Event Logs
show Commands
Configuring the Mobile IP Home Agent
Mobile IP Overview
Mobile IP Agent Discovery
Mobile IP Registration
Home Address Assignment
Authentication
AAA
Subscriber Management
Mobile IP Routing and Forwarding
Mobile IP Platform Considerations
Mobile IP References
Before You Configure the Mobile IP Home Agent
Configuring the Mobile IP Home Agent
Monitoring the Mobile IP Home Agent
Index
Index
Copyright© 1999-2012 Juniper Networks, Inc. All rights reserved.