Junos Clue

Some helpful things on junos

Junos filter BGP RIB routes based on prefix list

You need to add 'keep none' to the filter

set protocols bgp group eBGP-to-peer-v6 keep none

Shell Commands

start shell on the box

start shell 

use curl to get a file, but disable tcp keep alives which causes issues

v6
curl -6 --interface 2607:f138:0:2::5 --no-keepalive --connect-timeout 5 -vv -o /dev/null http://ubuntu-mirror-2.ps6.canonical.com/ubuntu/ls-lR.gz
v4
curl -4 --no-keepalive --connect-timeout 5 -vv -o /dev/null http://ubuntu-mirror-2.ps6.canonical.com/ubuntu/ls-lR.gz

Auto Firewall BGP peers

This is a neat way to auto configure your BGP peer firewall without having to update it all the time you add a peer.

Juniper's docs on this, but they make it overly complex.

example firewall

So here's an example firewall. Note that we record a count and log the errors here. With out the last deny term, it would not be counted or logged.

firewall {
            family inet {
                filter CONTROL-PLANE-IPV4 {
                    term ACCEPT-BGP {
                        from {
                            /* Two lists, and they are not interchangeable.
                             * AUTO-BGP-NEIGHBORS-IPV4 reads the top-level
                             * `protocols bgp` tree; AUTO-BGP-NEIGHBORS-V4
                             * reads the customer and route-server groups,
                             * which live inside routing instances. A peer
                             * missing from both falls through to
                             * DENY-UNCONFIGURED-BGP below and the session
                             * never leaves Active - the failure recorded at
                             *
                             * They cannot be one list. A prefix-list holds
                             * exactly one apply-path and a second one
                             * silently replaces the firs */
                            source-prefix-list {
                                AUTO-BGP-NEIGHBORS-IPV4;
                                AUTO-BGP-NEIGHBORS-V4;
                            }
                            protocol tcp;
                            destination-port bgp;
                        }
                        then {
                            count ACCEPT-BGP;
                            inactive: log;
                            accept;
                        }
                    }
                    term DENY-UNCONFIGURED-BGP {
                        from {
                            protocol tcp;
                            destination-port bgp;
                        }
                        then {
                            count DENY-UNCONFIGURED-BGP;
                            log;
                            discard;
                        }
                    }
                }
            }
        }

Prefix list

Now this will match any bgp group ending in -IPV4, extract the neighbor IP.

           prefix-list AUTO-BGP-NEIGHBORS-IPV4 {
               apply-path "protocols bgp group <*-IPV4> neighbor <*>";

and how it auto expands:

bryan@7> show configuration policy-options prefix-list AUTO-BGP-NEIGHBORS-V4 |display inheritance
##
## 'routing-instances <*> protocols bgp group <*-V4> neighbor <*>' was inherited from group 'BASE-PREFIX-LISTS'
## apply-path was expanded to:
##     206.108.114.11/32;
##     149.112.178.3/32;
##     149.112.178.4/32;
##     149.112.178.6/32;
##     149.112.178.7/32;
##     149.112.178.5/32;
##
apply-path "routing-instances <*> protocols bgp group <*-V4> neighbor <*>";