Juniper Collapsed Spine with EVPN - Revision history

Admin: /* Verify inter-tenant is routed through Vsrx cluster */

2023-11-04T17:31:15Z

Verify inter-tenant is routed through Vsrx cluster

Admin: /* Verify the summary routes advertising by the Vsrx cluster to the spines */

2023-11-04T17:28:56Z

Verify the summary routes advertising by the Vsrx cluster to the spines

Admin: /* Verify that the VSRX received routes from Tenant2 coming from both spines */

2023-11-04T15:22:34Z

Verify that the VSRX received routes from Tenant2 coming from both spines

Admin: /* Verify that the VSRX received routes from Tenant1 coming from both spines = */

2023-11-04T15:17:14Z

Verify that the VSRX received routes from Tenant1 coming from both spines =

Admin: /* Verify BGP on the Vsrx cluster */

2023-11-04T15:13:45Z

Verify BGP on the Vsrx cluster

Admin: /* Verification/Testing */

2023-11-04T15:06:59Z

Verification/Testing

Admin: /* vSRX config */

2023-11-04T15:04:24Z

vSRX config

Admin: /* vSRX config */

2023-11-04T03:10:06Z

vSRX config

Admin: /* vSRX config */

2023-11-04T03:08:49Z

vSRX config

Admin: /* Verify that the MAC address are advertised as BGP routes */

2023-10-25T01:00:57Z

Verify that the MAC address are advertised as BGP routes

← Older revision		Revision as of 17:31, 4 November 2023
Line 1,422:		Line 1,422:
	Out: 10.192.176.200/2 --> 10.192.144.100/25694;icmp, Conn Tag: 0x0, If: reth1.46, Pkts: 0, Bytes: 0,		Out: 10.192.176.200/2 --> 10.192.144.100/25694;icmp, Conn Tag: 0x0, If: reth1.46, Pkts: 0, Bytes: 0,

−	As we can see above the in traffic is using reth1-42 witch is Tenant1 interface and the out traffic is using reth1-46 which is tenant2 interface	+	As we can see above the in traffic is using reth1-42 witch is Tenant1 interface and the out traffic is using reth1-46 which is tenant2 interface

← Older revision		Revision as of 17:28, 4 November 2023
Line 1,407:		Line 1,407:
	* 10.179.1.7/32 Self I		* 10.179.1.7/32 Self I
	* 10.192.128.0/17 Self I		* 10.192.128.0/17 Self I
		+
		+	===Verify inter-tenant is routed through Vsrx cluster===
		+
		+	SRV1 with IP address 10.192.144.100 is part of Tenant1 instance and SRV7 with IP address 10.192.176.200 is part of tenant2 instance both servers are connected to 2 different switches. We are going to ping SRV7 from SRV1 and verify the flow table on the Vsrx cluster.
		+
		+	root@mr-dfw> ... security flow session destination-prefix 10.192.176.200
		+	node0:
		+	--------------------------------------------------------------------------
		+	Session ID: 8388, Policy name: Allow_All/6, HA State: Active, Timeout: 20, Session State: Valid
		+	In: 10.192.144.100/25694 --> 10.192.176.200/1;icmp, Conn Tag: 0x0, If: reth1.42, Pkts: 1, Bytes: 84,
		+	Out: 10.192.176.200/1 --> 10.192.144.100/25694;icmp, Conn Tag: 0x0, If: reth1.46, Pkts: 0, Bytes: 0,
		+	Session ID: 8390, Policy name: Allow_All/6, HA State: Active, Timeout: 22, Session State: Valid
		+	In: 10.192.144.100/25694 --> 10.192.176.200/2;icmp, Conn Tag: 0x0, If: reth1.42, Pkts: 1, Bytes: 84,
		+	Out: 10.192.176.200/2 --> 10.192.144.100/25694;icmp, Conn Tag: 0x0, If: reth1.46, Pkts: 0, Bytes: 0,
		+
		+	As we can see above the in traffic is using reth1-42 witch is Tenant1 interface and the out traffic is using reth1-46 which is tenant2 interface

← Older revision		Revision as of 15:22, 4 November 2023
Line 1,378:		Line 1,378:
	mgmt_junos.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)		mgmt_junos.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
	inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)		inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
		+
		+	===Verify the summary routes advertising by the Vsrx cluster to the spines===
		+
		+	root@mr-dfw> show route advertising-protocol bgp 172.16.4.2
		+	inet.0: 21 destinations, 34 routes (21 active, 0 holddown, 0 hidden)
		+	Prefix Nexthop MED Lclpref AS path
		+	* 10.179.1.7/32 Self I
		+	* 10.192.128.0/17 Self I
		+
		+	{primary:node0}
		+	root@mr-dfw> show route advertising-protocol bgp 172.16.4.3
		+	inet.0: 21 destinations, 34 routes (21 active, 0 holddown, 0 hidden)
		+	Prefix Nexthop MED Lclpref AS path
		+	* 10.179.1.7/32 Self I
		+	* 10.192.128.0/17 Self I
		+
		+	{primary:node0}
		+	root@mr-dfw> show route advertising-protocol bgp 172.16.5.2
		+	inet.0: 21 destinations, 34 routes (21 active, 0 holddown, 0 hidden)
		+	Prefix Nexthop MED Lclpref AS path
		+	* 10.179.1.7/32 Self I
		+	* 10.192.128.0/17 Self I
		+
		+	{primary:node0}
		+	root@mr-dfw> show route advertising-protocol bgp 172.16.5.3
		+	inet.0: 21 destinations, 34 routes (21 active, 0 holddown, 0 hidden)
		+	Prefix Nexthop MED Lclpref AS path
		+	* 10.179.1.7/32 Self I
		+	* 10.192.128.0/17 Self I

@@ Line 1,321: / Line 1,321: @@
     inet.0: 6/7/7/0
-=== Verify that the VSRX received routes from Tenant1 coming from both spines ====
+=== Verify that the VSRX received routes from Tenant1 coming from both spines ===
   {primary:node0}
   root@mr-dfw> show route receive-protocol bgp 172.16.4.2
@@ Line 1,347: / Line 1,347: @@
 .192.160.100/32       172.16.4.3                              65113 I
 .192.160.200/32       172.16.4.3                              65113 I
   mgmt_junos.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
   inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

← Older revision		Revision as of 15:13, 4 November 2023
Line 1,320:		Line 1,320:
	172.16.5.3 65113 16 11 0 0 4:00 Establ		172.16.5.3 65113 16 11 0 0 4:00 Establ
	inet.0: 6/7/7/0		inet.0: 6/7/7/0
		+
		+	=== Verify that the VSRX received routes from Tenant1 coming from both spines ====
		+	{primary:node0}
		+	root@mr-dfw> show route receive-protocol bgp 172.16.4.2
		+	inet.0: 21 destinations, 34 routes (21 active, 0 holddown, 0 hidden)
		+	Prefix Nexthop MED Lclpref AS path
		+	* 10.179.1.3/32 172.16.4.2 65112 I
		+	10.179.1.4/32 172.16.4.2 65112 65100 I
		+	* 10.192.144.0/22 172.16.4.2 65112 I
		+	* 10.192.144.100/32 172.16.4.2 65112 I
		+	* 10.192.160.0/22 172.16.4.2 65112 I
		+	* 10.192.160.100/32 172.16.4.2 65112 I
		+	* 10.192.160.200/32 172.16.4.2 65112 I
		+	mgmt_junos.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
		+	inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
		+
		+	{primary:node0}
		+	root@mr-dfw> show route receive-protocol bgp 172.16.4.3
		+	inet.0: 21 destinations, 34 routes (21 active, 0 holddown, 0 hidden)
		+	Prefix Nexthop MED Lclpref AS path
		+	10.179.1.3/32 172.16.4.3 65113 65100 I
		+	* 10.179.1.4/32 172.16.4.3 65113 I
		+	10.192.144.0/22 172.16.4.3 65113 I
		+	10.192.144.100/32 172.16.4.3 65113 I
		+	10.192.160.0/22 172.16.4.3 65113 I
		+	10.192.160.100/32 172.16.4.3 65113 I
		+	10.192.160.200/32 172.16.4.3 65113 I
		+	mgmt_junos.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
		+	inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

← Older revision		Revision as of 15:06, 4 November 2023
Line 1,302:		Line 1,302:

	==Verification/Testing==		==Verification/Testing==
		+
		+	=== Verify BGP on the Vsrx cluster===
		+
		+	root@mr-dfw> show bgp summary
		+	Threading mode: BGP I/O
		+	Default eBGP mode: advertise - accept, receive - accept
		+	Groups: 1 Peers: 4 Down peers: 0
		+	Table Tot Paths Act Paths Suppressed History Damp State Pending
		+	inet.0 27 23 0 0 0 0
		+	Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State\|#Active/Received/Accepted/Damped...
		+	172.16.4.2 65112 20 17 0 0 6:38 Establ
		+	inet.0: 6/7/7/0
		+	172.16.4.3 65113 16 11 0 0 4:10 Establ
		+	inet.0: 6/7/7/0
		+	172.16.5.2 65112 21 17 0 0 6:38 Establ
		+	inet.0: 5/6/6/0
		+	172.16.5.3 65113 16 11 0 0 4:00 Establ
		+	inet.0: 6/7/7/0

@@ Line 1,272: / Line 1,272: @@
   set interfaces reth1 unit 46 vlan-id 46
   set interfaces reth1 unit 46 family inet address 172.16.5.1/29
   set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from protocol static
   set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from route-filter 10.192.128.0/17 exact

@@ Line 1,216: / Line 1,216: @@
 ===vSRX config===
-set system login user ppaul uid 2003
+ set system login user ppaul uid 2003
-set system login user ppaul class super-user
+ set system login user ppaul class super-user
-set system login user ppaul authentication ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDST4EbXJc9l/AdrVmOZEPl3sxi6qjGIZyPwkupthSdooFHxPxUIh/a5PC9bMk5go6KvRoChpc4L8XuMRsxLTd6Ro6DsWIZieGHFuO/AL9SRUtmevGiSC2q4ibR7ACosJBUvKPRVK8anYnMSL9YWd7lnmVLnW5mvOM3Alhd8aTNKE3/H9ogDt9UfndEJXmieMTLJzGvx65sw6riqa5hh6iOcw02qb3QQCKLSRJmUJQuToY4oo/ZdLl/prEDKQ0I9DSnOxRYIvZxvUsTzwoXVq9X9dWGkKAAMDw7f2DJfa/4uCNT2dKPydApeN0ea2/69VRL3fmTz47y0CC1RTEd8j1j U18pc "
+ set system login user ppaul authentication ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDST4EbXJc9l/AdrVmOZEPl3sxi6qjGIZyPwkupthSdooFHxPxUIh/a5PC9bMk5go6KvRoChpc4L8XuMRsxLTd6Ro6DsWIZieGHFuO/AL9SRUtmevGiSC2q4ibR7ACosJBUvKPRVK8anYnMSL9YWd7lnmVLnW5mvOM3Alhd8aTNKE3/H9ogDt9UfndEJXmieMTLJzGvx65sw6riqa5hh6iOcw02qb3QQCKLSRJmUJQuToY4oo/ZdLl/prEDKQ0I9DSnOxRYIvZxvUsTzwoXVq9X9dWGkKAAMDw7f2DJfa/4uCNT2dKPydApeN0ea2/69VRL3fmTz47y0CC1RTEd8j1j U18pc "
-set chassis cluster control-link-recovery
+ set chassis cluster control-link-recovery
-set chassis cluster reth-count 5
+ set chassis cluster reth-count 5
-set chassis cluster redundancy-group 0 node 0 priority 100
+ set chassis cluster redundancy-group 0 node 0 priority 100
-set chassis cluster redundancy-group 0 node 1 priority 1
+ set chassis cluster redundancy-group 0 node 1 priority 1
-set chassis cluster redundancy-group 1 node 0 priority 200
+ set chassis cluster redundancy-group 1 node 0 priority 200
-set chassis cluster redundancy-group 1 node 1 priority 100
+ set chassis cluster redundancy-group 1 node 1 priority 100
-set chassis cluster redundancy-group 1 preempt
+ set chassis cluster redundancy-group 1 preempt
-set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255
+ set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255
-set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255
+ set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255
-set chassis cluster redundancy-group 1 interface-monitor ge-7/0/4 weight 255
+ set chassis cluster redundancy-group 1 interface-monitor ge-7/0/4 weight 255
-set chassis cluster redundancy-group 1 interface-monitor ge-7/0/5 weight 255
+ set chassis cluster redundancy-group 1 interface-monitor ge-7/0/5 weight 255
-set chassis cluster redundancy-group 2 node 0 priority 200
+ set chassis cluster redundancy-group 2 node 0 priority 200
-set chassis cluster redundancy-group 2 node 1 priority 100
+ set chassis cluster redundancy-group 2 node 1 priority 100
-set chassis cluster redundancy-group 2 preempt
+ set chassis cluster redundancy-group 2 preempt
-set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match source-address any
+ set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match source-address any
-set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match destination-address any
+ set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match destination-address any
-set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match application any
+ set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match application any
-set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All then permit
+ set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All then permit
-set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match source-address any
+ set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match source-address any
-set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match destination-address any
+ set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match destination-address any
-set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match application any
+ set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match application any
-set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All then permit
+ set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All then permit
-set security zones security-zone Tennant1 host-inbound-traffic system-services ping
+ set security zones security-zone Tennant1 host-inbound-traffic system-services ping
-set security zones security-zone Tennant1 host-inbound-traffic protocols bgp
+ set security zones security-zone Tennant1 host-inbound-traffic protocols bgp
-set security zones security-zone Tennant1 host-inbound-traffic protocols bfd
+ set security zones security-zone Tennant1 host-inbound-traffic protocols bfd
-set security zones security-zone Tennant1 interfaces reth1.42
+ set security zones security-zone Tennant1 interfaces reth1.42
-set security zones security-zone Tennant2 host-inbound-traffic system-services ping
+ set security zones security-zone Tennant2 host-inbound-traffic system-services ping
-set security zones security-zone Tennant2 host-inbound-traffic protocols bgp
+ set security zones security-zone Tennant2 host-inbound-traffic protocols bgp
-set security zones security-zone Tennant2 host-inbound-traffic protocols bfd
+ set security zones security-zone Tennant2 host-inbound-traffic protocols bfd
-set security zones security-zone Tennant2 interfaces reth1.46
+ set security zones security-zone Tennant2 interfaces reth1.46
-set interfaces ge-0/0/4 description "To cc1 | xe-0/0/9"
+ set interfaces ge-0/0/4 description "To cc1 | xe-0/0/9"
-set interfaces ge-0/0/4 gigether-options no-auto-negotiation
+ set interfaces ge-0/0/4 gigether-options no-auto-negotiation
-set interfaces ge-0/0/4 gigether-options redundant-parent reth1
+ set interfaces ge-0/0/4 gigether-options redundant-parent reth1
-set interfaces ge-0/0/5 description "To cc2 | xe-0/0/9"
+ set interfaces ge-0/0/5 description "To cc2 | xe-0/0/9"
-set interfaces ge-0/0/5 gigether-options no-auto-negotiation
+ set interfaces ge-0/0/5 gigether-options no-auto-negotiation
-set interfaces ge-0/0/5 gigether-options redundant-parent reth1
+ set interfaces ge-0/0/5 gigether-options redundant-parent reth1
-set interfaces ge-7/0/4 description "To cc1 | xe-0/0/8"
+ set interfaces ge-7/0/4 description "To cc1 | xe-0/0/8"
-set interfaces ge-7/0/4 gigether-options no-auto-negotiation
+ set interfaces ge-7/0/4 gigether-options no-auto-negotiation
-set interfaces ge-7/0/4 gigether-options redundant-parent reth1
+ set interfaces ge-7/0/4 gigether-options redundant-parent reth1
-set interfaces ge-7/0/5 description "To cc2 | xe-0/0/8"
+ set interfaces ge-7/0/5 description "To cc2 | xe-0/0/8"
-set interfaces ge-7/0/5 gigether-options no-auto-negotiation
+ set interfaces ge-7/0/5 gigether-options no-auto-negotiation
-set interfaces ge-7/0/5 gigether-options redundant-parent reth1
+ set interfaces ge-7/0/5 gigether-options redundant-parent reth1
-set interfaces lo0 unit 0 family inet address 10.179.1.7/32
+ set interfaces lo0 unit 0 family inet address 10.179.1.7/32
-set interfaces reth1 vlan-tagging
+ set interfaces reth1 vlan-tagging
-set interfaces reth1 redundant-ether-options redundancy-group 1
+ set interfaces reth1 redundant-ether-options redundancy-group 1
-set interfaces reth1 redundant-ether-options lacp active
+ set interfaces reth1 redundant-ether-options lacp active
-set interfaces reth1 redundant-ether-options lacp periodic fast
+ set interfaces reth1 redundant-ether-options lacp periodic fast
-set interfaces reth1 unit 42 description "Spine Interconect for Tennant1"
+ set interfaces reth1 unit 42 description "Spine Interconect for Tennant1"
-set interfaces reth1 unit 42 vlan-id 42
+ set interfaces reth1 unit 42 vlan-id 42
-set interfaces reth1 unit 42 family inet address 172.16.4.1/29
+ set interfaces reth1 unit 42 family inet address 172.16.4.1/29
-set interfaces reth1 unit 46 description "Spine Interconect for Tennant2"
+ set interfaces reth1 unit 46 description "Spine Interconect for Tennant2"
-set interfaces reth1 unit 46 vlan-id 46
+ set interfaces reth1 unit 46 vlan-id 46
-set interfaces reth1 unit 46 family inet address 172.16.5.1/29
+ set interfaces reth1 unit 46 family inet address 172.16.5.1/29
-set interfaces reth2 unit 0 family inet address 10.192.0.202/24
+ set interfaces reth2 unit 0 family inet address 10.192.0.202/24
-set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from protocol static
+ set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from protocol static
-set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from route-filter 10.192.128.0/17 exact
+ set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from route-filter 10.192.128.0/17 exact
-set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate then accept
+ set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate then accept
-set policy-options policy-statement INTERCONNECT-EXPORT term loopback from protocol direct
+ set policy-options policy-statement INTERCONNECT-EXPORT term loopback from protocol direct
-set policy-options policy-statement INTERCONNECT-EXPORT term loopback from route-filter 10.179.1.7/32 exact
+ set policy-options policy-statement INTERCONNECT-EXPORT term loopback from route-filter 10.179.1.7/32 exact
-set policy-options policy-statement INTERCONNECT-EXPORT term loopback then accept
+ set policy-options policy-statement INTERCONNECT-EXPORT term loopback then accept
-set policy-options policy-statement INTERCONNECT-EXPORT term Reject_All then reject
+ set policy-options policy-statement INTERCONNECT-EXPORT term Reject_All then reject
-set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes from route-filter 10.192.128.0/17 longer
+ set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes from route-filter 10.192.128.0/17 longer
-set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes from route-filter 10.179.0.0/16 longer
+ set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes from route-filter 10.179.0.0/16 longer
-set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes then accept
+ set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes then accept
-set policy-options policy-statement INTERCONNECT-IMPORT term DEFAULT then reject
+ set policy-options policy-statement INTERCONNECT-IMPORT term DEFAULT then reject
-set protocols bgp group INTERCONNECT type external
+ set protocols bgp group INTERCONNECT type external
-set protocols bgp group INTERCONNECT traceoptions file bgp_trace
+ set protocols bgp group INTERCONNECT traceoptions file bgp_trace
-set protocols bgp group INTERCONNECT traceoptions flag state
+ set protocols bgp group INTERCONNECT traceoptions flag state
-set protocols bgp group INTERCONNECT import INTERCONNECT-IMPORT
+ set protocols bgp group INTERCONNECT import INTERCONNECT-IMPORT
-set protocols bgp group INTERCONNECT family inet unicast
+ set protocols bgp group INTERCONNECT family inet unicast
-set protocols bgp group INTERCONNECT authentication-key "$9$rXzlWxN-wgaUVwQnCuEhVwY24ZUjH"
+ set protocols bgp group INTERCONNECT authentication-key "$9$rXzlWxN-wgaUVwQnCuEhVwY24ZUjH"
-set protocols bgp group INTERCONNECT export INTERCONNECT-EXPORT
+ set protocols bgp group INTERCONNECT export INTERCONNECT-EXPORT
-set protocols bgp group INTERCONNECT local-as 65200
+ set protocols bgp group INTERCONNECT local-as 65200
-set protocols bgp group INTERCONNECT multipath multiple-as
+ set protocols bgp group INTERCONNECT multipath multiple-as
-set protocols bgp group INTERCONNECT bfd-liveness-detection minimum-interval 1000
+ set protocols bgp group INTERCONNECT bfd-liveness-detection minimum-interval 1000
-set protocols bgp group INTERCONNECT bfd-liveness-detection multiplier 3
+ set protocols bgp group INTERCONNECT bfd-liveness-detection multiplier 3
-set protocols bgp group INTERCONNECT neighbor 172.16.4.3 peer-as 65113
+ set protocols bgp group INTERCONNECT neighbor 172.16.4.3 peer-as 65113
-set protocols bgp group INTERCONNECT neighbor 172.16.4.2 peer-as 65112
+ set protocols bgp group INTERCONNECT neighbor 172.16.4.2 peer-as 65112
-set protocols bgp group INTERCONNECT neighbor 172.16.5.2 peer-as 65112
+ set protocols bgp group INTERCONNECT neighbor 172.16.5.2 peer-as 65112
-set protocols bgp group INTERCONNECT neighbor 172.16.5.3 peer-as 65113
+ set protocols bgp group INTERCONNECT neighbor 172.16.5.3 peer-as 65113
-set routing-options static route 10.192.128.0/17 discard
+ set routing-options static route 10.192.128.0/17 discard
-set routing-options static route 172.16.0.0/16 discard
+ set routing-options static route 172.16.0.0/16 discard
 ==Verification/Testing==

← Older revision		Revision as of 03:08, 4 November 2023
Line 1,215:		Line 1,215:

	===vSRX config===		===vSRX config===
		+
		+	set system login user ppaul uid 2003
		+	set system login user ppaul class super-user
		+	set system login user ppaul authentication ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDST4EbXJc9l/AdrVmOZEPl3sxi6qjGIZyPwkupthSdooFHxPxUIh/a5PC9bMk5go6KvRoChpc4L8XuMRsxLTd6Ro6DsWIZieGHFuO/AL9SRUtmevGiSC2q4ibR7ACosJBUvKPRVK8anYnMSL9YWd7lnmVLnW5mvOM3Alhd8aTNKE3/H9ogDt9UfndEJXmieMTLJzGvx65sw6riqa5hh6iOcw02qb3QQCKLSRJmUJQuToY4oo/ZdLl/prEDKQ0I9DSnOxRYIvZxvUsTzwoXVq9X9dWGkKAAMDw7f2DJfa/4uCNT2dKPydApeN0ea2/69VRL3fmTz47y0CC1RTEd8j1j U18pc "
		+	set chassis cluster control-link-recovery
		+	set chassis cluster reth-count 5
		+	set chassis cluster redundancy-group 0 node 0 priority 100
		+	set chassis cluster redundancy-group 0 node 1 priority 1
		+	set chassis cluster redundancy-group 1 node 0 priority 200
		+	set chassis cluster redundancy-group 1 node 1 priority 100
		+	set chassis cluster redundancy-group 1 preempt
		+	set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255
		+	set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255
		+	set chassis cluster redundancy-group 1 interface-monitor ge-7/0/4 weight 255
		+	set chassis cluster redundancy-group 1 interface-monitor ge-7/0/5 weight 255
		+	set chassis cluster redundancy-group 2 node 0 priority 200
		+	set chassis cluster redundancy-group 2 node 1 priority 100
		+	set chassis cluster redundancy-group 2 preempt
		+	set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match source-address any
		+	set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match destination-address any
		+	set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All match application any
		+	set security policies from-zone Tennant1 to-zone Tennant2 policy Allow_All then permit
		+	set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match source-address any
		+	set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match destination-address any
		+	set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All match application any
		+	set security policies from-zone Tennant2 to-zone Tennant1 policy Allow_All then permit
		+	set security zones security-zone Tennant1 host-inbound-traffic system-services ping
		+	set security zones security-zone Tennant1 host-inbound-traffic protocols bgp
		+	set security zones security-zone Tennant1 host-inbound-traffic protocols bfd
		+	set security zones security-zone Tennant1 interfaces reth1.42
		+	set security zones security-zone Tennant2 host-inbound-traffic system-services ping
		+	set security zones security-zone Tennant2 host-inbound-traffic protocols bgp
		+	set security zones security-zone Tennant2 host-inbound-traffic protocols bfd
		+	set security zones security-zone Tennant2 interfaces reth1.46
		+	set interfaces ge-0/0/4 description "To cc1 \| xe-0/0/9"
		+	set interfaces ge-0/0/4 gigether-options no-auto-negotiation
		+	set interfaces ge-0/0/4 gigether-options redundant-parent reth1
		+	set interfaces ge-0/0/5 description "To cc2 \| xe-0/0/9"
		+	set interfaces ge-0/0/5 gigether-options no-auto-negotiation
		+	set interfaces ge-0/0/5 gigether-options redundant-parent reth1
		+	set interfaces ge-7/0/4 description "To cc1 \| xe-0/0/8"
		+	set interfaces ge-7/0/4 gigether-options no-auto-negotiation
		+	set interfaces ge-7/0/4 gigether-options redundant-parent reth1
		+	set interfaces ge-7/0/5 description "To cc2 \| xe-0/0/8"
		+	set interfaces ge-7/0/5 gigether-options no-auto-negotiation
		+	set interfaces ge-7/0/5 gigether-options redundant-parent reth1
		+	set interfaces lo0 unit 0 family inet address 10.179.1.7/32
		+	set interfaces reth1 vlan-tagging
		+	set interfaces reth1 redundant-ether-options redundancy-group 1
		+	set interfaces reth1 redundant-ether-options lacp active
		+	set interfaces reth1 redundant-ether-options lacp periodic fast
		+	set interfaces reth1 unit 42 description "Spine Interconect for Tennant1"
		+	set interfaces reth1 unit 42 vlan-id 42
		+	set interfaces reth1 unit 42 family inet address 172.16.4.1/29
		+	set interfaces reth1 unit 46 description "Spine Interconect for Tennant2"
		+	set interfaces reth1 unit 46 vlan-id 46
		+	set interfaces reth1 unit 46 family inet address 172.16.5.1/29
		+	set interfaces reth2 unit 0 family inet address 10.192.0.202/24
		+	set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from protocol static
		+	set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate from route-filter 10.192.128.0/17 exact
		+	set policy-options policy-statement INTERCONNECT-EXPORT term Tenant_Aggregate then accept
		+	set policy-options policy-statement INTERCONNECT-EXPORT term loopback from protocol direct
		+	set policy-options policy-statement INTERCONNECT-EXPORT term loopback from route-filter 10.179.1.7/32 exact
		+	set policy-options policy-statement INTERCONNECT-EXPORT term loopback then accept
		+	set policy-options policy-statement INTERCONNECT-EXPORT term Reject_All then reject
		+	set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes from route-filter 10.192.128.0/17 longer
		+	set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes from route-filter 10.179.0.0/16 longer
		+	set policy-options policy-statement INTERCONNECT-IMPORT term Tenant_Routes then accept
		+	set policy-options policy-statement INTERCONNECT-IMPORT term DEFAULT then reject
		+	set protocols bgp group INTERCONNECT type external
		+	set protocols bgp group INTERCONNECT traceoptions file bgp_trace
		+	set protocols bgp group INTERCONNECT traceoptions flag state
		+	set protocols bgp group INTERCONNECT import INTERCONNECT-IMPORT
		+	set protocols bgp group INTERCONNECT family inet unicast
		+	set protocols bgp group INTERCONNECT authentication-key "$9$rXzlWxN-wgaUVwQnCuEhVwY24ZUjH"
		+	set protocols bgp group INTERCONNECT export INTERCONNECT-EXPORT
		+	set protocols bgp group INTERCONNECT local-as 65200
		+	set protocols bgp group INTERCONNECT multipath multiple-as
		+	set protocols bgp group INTERCONNECT bfd-liveness-detection minimum-interval 1000
		+	set protocols bgp group INTERCONNECT bfd-liveness-detection multiplier 3
		+	set protocols bgp group INTERCONNECT neighbor 172.16.4.3 peer-as 65113
		+	set protocols bgp group INTERCONNECT neighbor 172.16.4.2 peer-as 65112
		+	set protocols bgp group INTERCONNECT neighbor 172.16.5.2 peer-as 65112
		+	set protocols bgp group INTERCONNECT neighbor 172.16.5.3 peer-as 65113
		+	set routing-options static route 10.192.128.0/17 discard
		+	set routing-options static route 172.16.0.0/16 discard

	==Verification/Testing==		==Verification/Testing==

@@ Line 1,154: / Line 1,154: @@
                         AS path: I, validation-state: unverified
                       >  to 172.16.3.1 via ae0.0
 ==vSRX configuration==