Juniper SYSTEM BASICS - CONFIGURATION GUIDE V 11.1.X, JUNOSe 11.1 Configuration Manual

JUNOSe™ Software
for E Series™ Broadband Services Routers

System Basics Configuration Guide

Release 11.1.x

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, California 94089

USA

408-745-2000

www.juniper.net

Published: 2010-03-31

Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, ScreenOS, and Steel-Belted Radius are registered trademarks of Juniper Networks, Inc. in
the United States and other countries. JUNOSe is a trademark of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or
registered service marks are the property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or
otherwise revise this publication without notice.

Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed
to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347,
6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785.

JUNOSe™ Software for E Series™ Broadband Services Routers System Basics Configuration Guide

Release 11.1.x
Copyright © 2010, Juniper Networks, Inc.
All rights reserved. Printed in USA.

Writing: Mark Barnard, Diane Florio, Bruce Gillham, Sarah Lesway-Ball, Brian Wesley Simmons, Fran Singer, Megha Shaseendran, Krupa Chandrashekar,
Chander Aima, Poornima Goswami, Hema Priya J, Subash Babu Asokan, Sairam Venugopalan
Editing: Benjamin Mann
Illustration: Nathaniel Woodward
Cover Design: Edmonds Design

Revision History
April 2010—FRS JUNOSe 11.1.x

The information in this document is current as of the date listed in the revision history.

YEAR 2000 NOTICE

Juniper Networks hardware and software products are Year 2000 compliant. The JUNOS Software has no known time-related limitations through the year

2038. However, the NTP application is known to have some difficulty in the year 2036.

ii ■

END USER LICENSE AGREEMENT

READ THIS END USER LICENSE AGREEMENT (“AGREEMENT”) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE. BY DOWNLOADING,
INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS CONTAINED HEREIN, YOU (AS CUSTOMER
OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS
AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE,
AND (B) YOU MAY CONTACT JUNIPER NETWORKS REGARDING LICENSE TERMS.

1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer’s principal office is located in the Americas) or Juniper Networks
(Cayman) Limited (if the Customer’s principal office is located outside the Americas) (such applicable entity being referred to herein as “Juniper”), and (ii)
the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable license(s) for use of the Software (“Customer”)
(collectively, the “Parties”).

2. The Software. In this Agreement, “Software” means the program modules and features of the Juniper or Juniper-supplied software, for which Customer
has paid the applicable license or support fees to Juniper or an authorized Juniper reseller, or which was embedded by Juniper in equipment which Customer
purchased from Juniper or an authorized Juniper reseller. “Software” also includes updates, upgrades and new releases of such software. “Embedded
Software” means Software which Juniper has embedded in or loaded onto the Juniper equipment and any updates, upgrades, additions or replacements
which are subsequently embedded in or loaded onto the equipment.

3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer a non-exclusive
and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the following use restrictions:

a. Customer shall use Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by Customer from Juniper
or an authorized Juniper reseller.

b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units for which Customer
has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access Client software only, Customer shall use
such Software on a single computer containing a single physical random access memory space and containing any number of processors. Use of the
Steel-Belted Radius or IMS AAA software on multiple computers or virtual machines (e.g., Solaris zones) requires multiple licenses, regardless of whether
such computers or virtualizations are physically contained on a single chassis.

c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may specify limits to
Customer’s use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent users, sessions, calls,
connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of separate licenses to use particular features,
functionalities, services, applications, operations, or capabilities, or provide throughput, performance, configuration, bandwidth, interface, processing,
temporal, or geographical limits. In addition, such limits may restrict the use of the Software to managing certain kinds of networks or require the Software
to be used only in conjunction with other specific Software. Customer’s use of the Software shall be subject to all such limitations and purchase of all applicable
licenses.

d. For any trial copy of the Software, Customer’s right to use the Software expires 30 days after download, installation or use of the Software. Customer
may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not extend or create an additional trial
period by re-installing the Software after the 30-day trial period.

e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customer’s enterprise network.
Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the Steel-Belted Radius software to support any
commercial network access services.

The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase the applicable
license(s) for the Software from Juniper or an authorized Juniper reseller.

4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees not to and shall
not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized copies of the Software (except as
necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the Software, in any form, to any third party; (d) remove
any proprietary notices, labels, or marks on or in any copy of the Software or any product in which the Software is embedded; (e) distribute any copy of
the Software to any third party, including as may be embedded in Juniper equipment sold in the secondhand market; (f) use any ‘locked’ or key-restricted
feature, function, service, application, operation, or capability without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even
if such feature, function, service, application, operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper
to any third party; (h) use the Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper
reseller; (i) use Embedded Software on non-Juniper equipment; (j) use Embedded Software (or make it available for use) on Juniper equipment that the
Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking of the Software to
any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly provided herein.

5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper, Customer shall furnish
such records to Juniper and certify its compliance with this Agreement.

■ iii

6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper. As such, Customer
shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence, which at a minimum includes
restricting access to the Software to Customer employees and contractors having a need to use the Software for Customer’s internal business purposes.

7. Ownership. Juniper and Juniper’s licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to the Software,
associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance of any right, title, or interest in
the Software or associated documentation, or a sale of the Software, associated documentation, or copies of the Software.

8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty statement that
accompanies the Software (the “Warranty Statement”). Nothing in this Agreement shall give rise to any obligation to support the Software. Support services
may be purchased separately. Any such support shall be governed by a separate, written support services agreement. TO THE MAXIMUM EXTENT PERMITTED
BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA, OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES,
OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR
JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY
JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW,
JUNIPER DISCLAIMS ANY AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING
ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES JUNIPER
WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT ERROR OR INTERRUPTION,
OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Juniper’s or its suppliers’ or licensors’ liability to Customer, whether
in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid by Customer for the Software that gave rise to the claim, or
if the Software is embedded in another Juniper product, the price paid by Customer for such other product. Customer acknowledges and agrees that Juniper
has set its prices and entered into this Agreement in reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same
reflect an allocation of risk between the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss),
and that the same form an essential basis of the bargain between the Parties.

9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination of the license
granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related documentation in Customer’s
possession or control.

10. Taxes. All license fees payable under this agreement are exclusive of tax. Customer shall be responsible for paying Taxes arising from the purchase of
the license, or importation or use of the Software. If applicable, valid exemption documentation for each taxing jurisdiction shall be provided to Juniper prior
to invoicing, and Customer shall promptly notify Juniper if their exemption is revoked or modified. All payments made by Customer shall be net of any
applicable withholding tax. Customer will provide reasonable assistance to Juniper in connection with such withholding taxes by promptly: providing Juniper
with valid tax receipts and other required documentation showing Customer’s payment of any withholding taxes; completing appropriate applications that
would reduce the amount of withholding tax to be paid; and notifying and assisting Juniper in any audit or tax proceeding related to transactions hereunder.
Customer shall comply with all applicable tax laws and regulations, and Customer will promptly pay or reimburse Juniper for all costs and damages related
to any liability incurred by Juniper as a result of Customer’s non-compliance or delay with its responsibilities herein. Customer’s obligations under this
Section shall survive termination or expiration of this Agreement.

11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any applicable foreign
agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such restrictions, laws or regulations, or
without all necessary approvals. Customer shall be liable for any such violations. The version of the Software supplied to Customer may contain encryption
or other capabilities restricting Customer’s ability to export the Software without an export license.

12. Commercial Computer Software. The Software is “commercial computer software” and is provided with restricted rights. Use, duplication, or disclosure
by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS 227.7201 through 227.7202-4, FAR 12.212,
FAR 27.405(b)(2), FAR 52.227-19, or FAR 52.227-14(ALT III) as applicable.

13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer with the interface
information needed to achieve interoperability between the Software and another independently created program, on payment of applicable fee, if any.
Customer shall observe strict obligations of confidentiality with respect to such information and shall use such information in compliance with any applicable
terms and conditions upon which Juniper makes such information available.

14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products or technology
are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement, and such licensor or vendor
shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party software may be provided with the
Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent portions of the Software are distributed under and
subject to open source licenses obligating Juniper to make the source code for such portions publicly available (such as the GNU General Public License
(“GPL”) or the GNU Library General Public License (“LGPL”)), Juniper will make such source code portions (including Juniper modifications, as appropriate)
available upon request for a period of up to three years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194

N. Mathilda Ave., Sunnyvale, CA 94089, ATTN: General Counsel. You may obtain a copy of the GPL at http://www.gnu.org/licenses/gpl.html, and
a copy of the LGPL at http://www.gnu.org/licenses/lgpl.html.

15. Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws principles. The provisions
of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes arising under this Agreement, the Parties
hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal courts within Santa Clara County, California. This Agreement
constitutes the entire and sole agreement between Juniper and the Customer with respect to the Software, and supersedes all prior and contemporaneous

iv ■

agreements relating to the Software, whether oral or written (including any inconsistent terms contained in a purchase order), except that the terms of a
separate written agreement executed by an authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict
with terms contained herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in
writing by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity of the
remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the Parties agree that the English
version will govern. (For Canada: Les parties aux présentés confirment leur volonté que cette convention de même que tous les documents y compris tout
avis qui s'y rattaché, soient redigés en langue anglaise. (Translation: The parties confirm that this Agreement and all related documentation is and will be
in the English language)).

■ v

vi ■

Abbreviated Table of Contents

About the Documentation xxvii

Part 1 Chapters

Chapter 1 Planning Your Network 3

Chapter 2 Command-Line Interface 29

Chapter 3 Installing JUNOSe Software 125

Chapter 4 Configuring SNMP 147

Chapter 5 Managing the System 251

Chapter 6 Managing Modules 355

Chapter 7 Passwords and Security 417

Chapter 8 Writing CLI Macros 473

Chapter 9 Booting the System 509

Chapter 10 Configuring the System Clock 521

Chapter 11 Configuring Virtual Routers 539

Part 2 Reference Material

Appendix A Abbreviations and Acronyms 553

Appendix B References 571

Part 3 Index

Index 595

Abbreviated Table of Contents ■ vii

JUNOSe 11.1.x System Basics Configuration Guide

viii ■

Table of Contents

About the Documentation xxvii

E Series and JUNOSe Documentation and Release Notes ...........................xxvii

Audience ....................................................................................................xxvii

E Series and JUNOSe Text and Syntax Conventions ...................................xxvii

Obtaining Documentation ..........................................................................xxix

Documentation Feedback ...........................................................................xxix

Requesting Technical Support .....................................................................xxix

Self-Help Online Tools and Resources ...................................................xxx

Opening a Case with JTAC ....................................................................xxx

Part 1 Chapters

Chapter 1 Planning Your Network 3

Platform Considerations ..................................................................................3

Interface Specifiers ...................................................................................4

Edge Applications Overview ............................................................................4

Private Line Aggregation ...........................................................................4

xDSL Session Termination ........................................................................5

Layered Approach ...........................................................................................6

Line Modules, I/O Modules, and IOAs ..............................................................7

Interfaces ........................................................................................................8

Subinterfaces ............................................................................................8

interface Command ..................................................................................9

General Configuration Tasks ............................................................................9

Configuring Virtual Routers ...........................................................................10

Configuring IPSec ..........................................................................................10

Configuring Physical Layer Interfaces ............................................................10

Line Module Features ..............................................................................11

Configurable HDLC Parameters ..............................................................12

Configuring Channelized T3 Interfaces ...................................................12

Configuring T3 and E3 Interfaces ............................................................13

Configuring OCx/STMx and OC48 Interfaces ..........................................14

Configuring Channelized OCx/STMx Line Interfaces ...............................15

Configuring Ethernet Interfaces ..............................................................16

Configuring IPSec-Service Interfaces .......................................................16

Configuring Tunnel Service Interfaces .....................................................16

Table of Contents ■ ix

JUNOSe 11.1.x System Basics Configuration Guide

Configuring Data Link-Layer Interfaces ..........................................................17

Configuring IP/Frame Relay ....................................................................17

Configuring IP/ATM .................................................................................19

Configuring IP/PPP ..................................................................................20

Configuring IP/HDLC ...............................................................................22

Configuring IP/Ethernet ..........................................................................22

Configuring IP Tunnels, Shared IP Interfaces, and Subscriber Interfaces .......23

Configuring IP Tunnels ............................................................................23

Configuring Shared Interfaces and Subscriber Interfaces ........................23

Configuring Routing Protocols .......................................................................24

Configuring VRRP ..........................................................................................25

Configuring Routing Policy ............................................................................25

Configuring QoS ............................................................................................25

Configuring Policy Management ....................................................................26

Configuring Remote Access ...........................................................................26

Chapter 2 Command-Line Interface 29

Overview .......................................................................................................29

Command Modes ...................................................................................29

Command-Line Prompts .........................................................................31

Keywords and Parameters ......................................................................31

Keywords .........................................................................................31

Parameters .......................................................................................32

Keywords and Parameters Together .................................................32

Using CLI Commands .............................................................................33

Abbreviated Commands ...................................................................33

The ? Key .........................................................................................33

Backspace or Delete .........................................................................34

Enter ................................................................................................34

Tab ...................................................................................................34

Arrow Keys ......................................................................................34

The no Version .................................................................................35

run and do Commands .....................................................................35

show Commands .............................................................................37

Redirection of show Command Output ............................................40

Regular Expressions .........................................................................41

The - -More- - Prompt .......................................................................43

Responding to Prompts ....................................................................46

CLI Status Indicators ...............................................................................47

Levels of Access ......................................................................................48

User Level ........................................................................................48

Privileged Level ................................................................................48

Initialization Sequence ............................................................................48

Platform Considerations ................................................................................48

Accessing the CLI ..........................................................................................48

Logging In ...............................................................................................48

Privileged-Level Access ...........................................................................49

Defining CLI Levels of Privilege ........................................................49

Accessing the Privileged Exec Level ..................................................50

x ■ Table of Contents

Table of Contents

Moving from Privileged Exec to User Exec Mode ....................................51

Logging Out ............................................................................................52

CLI Command Privileges ...............................................................................52

CLI Privilege Groups ................................................................................52

Examples Using Privilege Group Membership .........................................53

CLI Command Exceptions .......................................................................57

CLI Keyword Mapping ............................................................................58

Setting Privileges for Ambiguous Commands ..........................................58

Setting Privilege Levels for no or default Versions ...................................59

Setting Privilege Levels for Multiple Commands ......................................59

Setting Privilege Levels for All Commands in a Mode .......................59

Setting Privilege Levels for a Group of Commands ...........................60

Using the Order of Precedence .........................................................60

Superseding Privilege Levels with the all Keyword ...........................61

Removing the all Keyword ...............................................................61

Setting Default Line Privilege ..................................................................61

Viewing CLI Privilege Information ...........................................................62

Viewing the Current User Privilege Level ..........................................62

Viewing Privilege Levels for All Connected Users ..............................63

Viewing Privilege Levels for Changed CLI Commands ......................63

Using Help .....................................................................................................63

? (Question Mark Key) .............................................................................64

help Command .......................................................................................66

Partial-keyword <Tab> .........................................................................66

Using Command-Line Editing ........................................................................67

Basic Editing ...........................................................................................67

Command-Line Editing Keys ...................................................................67

Command History Keys ..........................................................................68

Pagination Keys ......................................................................................69

Accessing Command Modes ..........................................................................69

Exec Modes ............................................................................................86

Password Protection .........................................................................87

Global Configuration Mode .....................................................................88

Executing a Script File ......................................................................88

AAA Profile Configuration Mode .............................................................89

Address Family Configuration Mode .......................................................89

ATM VC Configuration Mode ...................................................................90

ATM VC Class Configuration Mode ..........................................................90

Classifier Group Configuration Mode .......................................................91

Color Mark Profile Configuration Mode ...................................................91

Control Plane Configuration Mode ..........................................................92

Controller Configuration Mode ................................................................92

DHCP Local Pool Configuration Mode .....................................................93

Domain Map Configuration Mode ...........................................................93

Domain Map Tunnel Configuration Mode ...............................................94

DoS Protection Group Configuration Mode .............................................94

Drop Profile Configuration Mode ............................................................95

Explicit Path Configuration Mode ............................................................95

Flow Cache Configuration Mode .............................................................96

Interface Configuration Mode .................................................................96

IP NAT Pool Configuration Mode .............................................................97

Table of Contents ■ xi

JUNOSe 11.1.x System Basics Configuration Guide

IP PIM Data MDT Configuration Mode ....................................................97

IP Service Profile Configuration Mode .....................................................98

IPSec CA Identity Configuration Mode ....................................................98

IPSec Identity Configuration Mode ..........................................................98

IPSec IKE Policy Configuration Mode ......................................................99

IPSec Manual Key Configuration Mode ...................................................99

IPSec Peer Public Key Configuration Mode ...........................................100

IPSec Transport Profile Configuration Mode ..........................................100

IPSec Tunnel Profile Configuration Mode ..............................................100

IP Tunnel Destination Profile Mode .......................................................101

IPv6 Local Pool Configuration Mode .....................................................102

L2 Transport Load-Balancing-Circuit Configuration Mode ......................102

L2TP Destination Profile Configuration Mode .......................................103

L2TP Destination Profile Host Configuration Mode ...............................103

L2TP Tunnel Switch Profile Configuration Mode ...................................103

Layer 2 Control Configuration Mode .....................................................104

Layer 2 Control Neighbor Configuration Mode ......................................104

LDP Configuration Mode .......................................................................105

Line Configuration Mode .......................................................................105

Local IPSec Transport Profile Configuration ..........................................106

Local User Configuration Mode .............................................................106

Map Class Configuration Mode ..............................................................107

Map List Configuration Mode ................................................................107

Parent Group Configuration Mode .........................................................107

Policy List Configuration Mode .............................................................108

Policy List Parent Group Configuration Mode ........................................108

Policy Parameter Configuration Mode ...................................................109

PPPoE Service Name Table Configuration Mode ...................................109

Profile Configuration Mode ...................................................................110

QoS Interface Set Configuration Mode ..................................................110

QoS Interface Superset Configuration Mode ..........................................110

QoS Parameter Definition Configuration Mode .....................................111

QoS Profile Configuration Mode ............................................................111

QoS Shared Shaper Control Configuration ............................................112

Queue Profile Configuration Mode ........................................................112

RADIUS Configuration Mode .................................................................113

RADIUS Relay Configuration Mode .......................................................113

Rate Limit Profile Configuration Mode ..................................................114

Redundancy Configuration Mode ..........................................................115

Remote Neighbor Configuration Mode ..................................................115

Route Map Configuration Mode ............................................................116

Router Configuration Mode ...................................................................116

RSVP Configuration Mode .....................................................................117

RTR Configuration Mode .......................................................................117

Scheduler Profile Configuration Mode ...................................................118

Service Session Profile Configuration Mode ..........................................118

SNMP Event Manager Configuration Mode ...........................................119

Statistics Profile Configuration Mode ....................................................119

Subinterface Configuration Mode ..........................................................119

Subscriber Policy Configuration Mode ..................................................120

Traffic Class Configuration Mode ..........................................................120

xii ■ Table of Contents

Table of Contents

Traffic Class Group Configuration Mode ................................................121

Tunnel Group Configuration Mode ........................................................121

Tunnel Group Tunnel Configuration Mode ............................................121

Tunnel Profile Configuration Mode .......................................................122

Tunnel Server Configuration Mode ........................................................122

VRF Configuration Mode .......................................................................123

VR Group Configuration Mode ..............................................................123

Chapter 3 Installing JUNOSe Software 125

Overview .....................................................................................................125

Identifying the Software Release File ....................................................126

Platform Considerations ..............................................................................127

Installing Software When a Firewall Exists ..................................................127

Task 1: Obtain the Required Information ..............................................127

Task 2: Divert Network Traffic to Another Router .................................128

Task 3: Access Privileged Exec Mode ....................................................128

Task 4: Configure IP on an Interface .....................................................128

Task 5: Copy the Release Files to the Network Host ..............................129

Task 6: Configure Access to the Network Host ......................................129

Task 7: Enable the FTP Server on the Router ........................................130

Task 8: Identify the Files to Transfer .....................................................130

Task 9: Transfer Files to the User Space ................................................131

Task 10: Install Files on the System Space ............................................131

Task 11: Save the Current Configuration ...............................................131

Task 12: Reboot the System .................................................................131

Installing Software When a Firewall Does Not Exist ....................................132

Installing Software in Normal Operational Mode ...................................132

Task 1: Obtain the Required Information .......................................133

Task 2: Divert Network Traffic to Another Router ...........................133

Task 3: Access Privileged Exec Mode .............................................133

Task 4: Configure IP on an Interface ..............................................133

Task 5: Configure Access to the Network Host ...............................134

Task 6: Copy the Release Files to the Network Host .......................135

Task 7: Copy the Software Release File to the Router .....................135

Task 8: Save the Current Configuration ..........................................136

Task 9: Reboot the System .............................................................136

Installing Software in Boot Mode ..........................................................137

Task 1: Obtain the Required Information .......................................137

Task 2: Divert Network Traffic to Another System ..........................137

Task 3: Access the Boot Mode ........................................................137

Task 4: Assign an IP Address ..........................................................138

Task 5: Configure Access to the Network Host ...............................138

Task 6: Resetting the SRP Module ..................................................138

Task 7: Copy the Release Files to the Network Host .......................138

Task 8: Copy the Software Release File to the Router .....................139

Task 9: Reboot the System .............................................................139

Copying Release Files from One Router to Another .....................................140

Upgrading Systems That Are Operating with Two SRP Modules ..................140

Table of Contents ■ xiii

JUNOSe 11.1.x System Basics Configuration Guide

Upgrading from Release 5.1.1 or Lower-Numbered Releases ......................142

Upgrading Software Remotely Through Telnet or FTP ..........................143

Upgrading Software from an NVS Card .................................................143

Upgrading a System That Contains One SRP Module .....................143

Upgrading a System That Contains Two SRP Modules ....................144

Downgrading JUNOSe Software ...................................................................144

Chapter 4 Configuring SNMP 147

Overview .....................................................................................................147

Terminology .........................................................................................148

SNMP Features Supported ....................................................................149

SNMP Client ..........................................................................................149

SNMP Server .........................................................................................150

SNMP MIBs ...........................................................................................150

Standard SNMP MIBs ......................................................................150

Juniper Networks E Series Enterprise MIBs .....................................150

Accessing Supported SNMP MIBs ...................................................150

SNMP Versions .....................................................................................150

Security Features ..................................................................................151

Management Features ..........................................................................152

Virtual Routers ......................................................................................153

Creating SNMP Proxy .....................................................................153

Disabling and Reenabling SNMP Proxy ..........................................154

Communicating with the SNMP Engine ................................................154

SNMP Attributes ....................................................................................155

SNMP Operations ..................................................................................155

SNMP PDU Types ..................................................................................156

Platform Considerations ..............................................................................156

References ..................................................................................................157

Before You Configure SNMP ........................................................................157

SNMP Configuration Tasks ..........................................................................158

Enabling SNMP .....................................................................................159

Configuring SNMP v1/v2c Community ..................................................159

Community Name ..........................................................................159

Privilege Levels ...............................................................................159

IP Access List ..................................................................................160

Configuring SNMPv3 Users ...................................................................160

Configuring SNMP Dynamic Groups and Views .....................................160

Setting Server Parameters .....................................................................161

Configuring SNMP Packet Size ..............................................................162

Configuring Memory Warning ..............................................................162

Configuring Encoding Method ...............................................................162

Managing Interface Sublayers ...............................................................163

Compressing Interfaces ..................................................................163

Controlling Interface Numbering ....................................................165

Monitoring Interface Tables ............................................................166

Configuring Traps ........................................................................................167

IP Hosts ................................................................................................167

Trap Categories .....................................................................................168

xiv ■ Table of Contents

Table of Contents

Trap Severity Levels ..............................................................................169

Specifying an Egress Point for SNMP Traps ...........................................174

Configuring Trap Queues ......................................................................174

Configuring Trap Notification Logs ........................................................175

Recovering Lost Traps ...........................................................................176

Configuring the SNMP Server Event Manager ..............................................177

Event MIB Purpose ...............................................................................177

Event MIB Structure ..............................................................................178

Trigger Table ..................................................................................178

Objects Table .................................................................................179

Event Table ....................................................................................179

Configuration Tasks ..............................................................................179

Defining a Boolean Test ..................................................................182

Defining an Existence Test .............................................................182

Defining a Threshold Test ...............................................................183

Monitoring Events .................................................................................189

Collecting Bulk Statistics ..............................................................................195

Interface Strings ....................................................................................196

Understanding Counter Discontinuity ...................................................198

Configuring Collectors and Receivers ....................................................199

Deleting All Bulkstats Configurations ....................................................204

Monitoring Collection Statistics .............................................................204

Understanding Schemas .......................................................................215

If-Stats Schema Objects ..................................................................215

IGMP Schema Objects ....................................................................217

Policy Schema Objects ...................................................................217

QoS Schema Objects ......................................................................218

Configuring Schemas ............................................................................220

Mapping Bulkstats Output to MIB Flies and CLI Configurations for Bulk

Statistics Schema ............................................................................223

Monitoring Schema Statistics ................................................................235

Configuring Interface Numbering Mode ................................................236

Using the Bulk Statistics Formatter ..............................................................237

Setting Remote Filenames ....................................................................237

Guidelines ......................................................................................238

Specifying End of Line Format ..............................................................238

Managing Virtual Routers ............................................................................238

Monitoring SNMP ........................................................................................239

Establishing a Baseline ..........................................................................239

Viewing SNMP Status ............................................................................240

Output Filtering ....................................................................................249

Chapter 5 Managing the System 251

Overview .....................................................................................................252

Platform Considerations ..............................................................................252

Naming the System .....................................................................................252

Configuring the Switch Fabric Bandwidth ....................................................253

Configuring Timing .....................................................................................253

Monitoring Timing ................................................................................255

Table of Contents ■ xv

JUNOSe 11.1.x System Basics Configuration Guide

Using the CLI ...............................................................................................255

Managing vty Lines .....................................................................................258

Configuring vty Lines ............................................................................259

Monitoring vty Lines .............................................................................260

Clearing Lines ..............................................................................................261

Monitoring the Current Configuration ..........................................................261

Defining the Configuration Output Format ............................................262

Customizing the Configuration Output ..................................................266

Detecting Corrupt File Configurations ...................................................271

Automatically Recovering Corrupt Configuration Files ..........................272

Configuring the System Automatically .........................................................276

Saving the Current Configuration ................................................................277

Using the Desktop Tool for Viewing Uncompressed Text Configuration ......280

Installation Prerequisites for the Desktop Tool ......................................280

Requirements for Microsoft Windows Systems ..............................280

Requirements for Sun Solaris Systems ...........................................280

Requirements for Linux Systems ....................................................281

Usage Notes for the Perl Script ..............................................................281

Customizing the User Interface ...................................................................281

Setting the Console Speed .....................................................................282

Configuring the Display Terminal .........................................................282

Specifying the Character Set .................................................................283

Configuring Login Conditions ................................................................284

Setting Time Limits for User Login ........................................................284

Setting Time Limits for User Input ........................................................285

Configuring CLI Messages .....................................................................285

Monitoring the Console Settings ...........................................................287

Sending Messages .......................................................................................288

Managing Memory ......................................................................................290

Managing Files ............................................................................................290

Managing the User Space from a Network Host ....................................292

File Commands and FTP Servers ..........................................................293

Renaming Files .....................................................................................293

Deleting Files ........................................................................................294

Monitoring Files ....................................................................................296

Viewing Files .........................................................................................299

Transferring Files ........................................................................................300

References ............................................................................................301

Copying and Redirecting Files ...............................................................301

Using the copy Command .....................................................................302

copy Command Examples ....................................................................307

Using TFTP to Transfer Files .................................................................309

Configuring the FTP Server ...................................................................309

Features .........................................................................................309

FTP Passive Mode ..........................................................................309

Configuring Authentication .............................................................310

Configuration Tasks ........................................................................310

Configuration Example ...................................................................310

Monitoring the FTP Server ....................................................................312

Copying Partial Releases .......................................................................313

xvi ■ Table of Contents

Table of Contents

Configuring the NFS Client ..........................................................................316

References ............................................................................................316

Prerequisites .........................................................................................316

Configuration Tasks ..............................................................................316

Monitoring the NFS Client .....................................................................317

Using a Loopback Interface .........................................................................318

Using the Telnet Client ................................................................................318

Configuring DNS ..........................................................................................319

References ............................................................................................320

Assigning Name Servers .......................................................................320

Using One Name Resolver for Multiple Virtual Routers .........................322

Monitoring DNS ....................................................................................322

Troubleshooting the System ........................................................................323

Creating Core Dump Files .....................................................................323

Boot Mode ......................................................................................323

Global Configuration Mode .............................................................324

Managing Core Dump Files ...................................................................326

Enabling and Disabling the Core Dump Monitor .............................327

Specifying the Core Dump Monitor Interval ....................................328

Viewing Core Dump Monitor Status ................................................328

Accessing the Core Dump File ..............................................................329

Capturing and Writing Core Dumps ......................................................330

Understanding the Core Dump File .......................................................331

Tracking IP Prefix Reachability .............................................................332

Gathering Information for Customer Support ........................................333

Managing and Monitoring Resources ...........................................................335

Enabling and Disabling the Resource Threshold Monitor ......................335

Viewing Resource Threshold Information .............................................335

Monitoring the System ................................................................................337

Chapter 6 Managing Modules 355

Overview .....................................................................................................355

Platform Considerations ..............................................................................356

ERX7xx Models, ERX14xx Models, and the ERX310 Broadband Services

Router ............................................................................................356

Line Modules and I/O Modules .......................................................356

SRP Modules ..................................................................................356

E120 and E320 Broadband Services Routers ........................................357

Line Modules and IOAs ...................................................................357

SRP Modules and SFMs ..................................................................359

Disabling and Reenabling Line Modules, SRP Modules, and SFMs ...............360

Disabling and Reenabling IOAs ...................................................................362

Removing an SRP Module ...........................................................................363

Replacing Line Modules on ERX Routers, the E120 Router, and the E320

Router ...................................................................................................364

Replacing a Line Module by Erasing the Slot Configuration ...................365

Replacing a Line Module Without Erasing the Slot Configuration ..........366

Replacing IOAs on the E120 Router and the E320 Router ...........................368

Replacing SRP Modules and SFMs .........................................................368

Table of Contents ■ xvii

JUNOSe 11.1.x System Basics Configuration Guide

Software Compatibility ................................................................................372

Line Modules ........................................................................................372

I/O Modules and IOAs ...........................................................................372

Configuring Performance Rate of Line Modules on ERX7xx Models and the

ERX1410 Router ...................................................................................373

Choosing a Combination of Line Modules .............................................373

Slot Groups .....................................................................................373

SRP Modules Bandwidth .................................................................374

Line Modules Bandwidth and Switch Usage ....................................374

Allowed Combinations for Line Rate Performance .........................375

Specifying the Type of Performance .....................................................376

Monitoring Bandwidth Oversubscription ...............................................377

Troubleshooting Bandwidth Oversubscription ......................................378

Managing Flash Cards on SRP Modules .......................................................378

Flash Features .......................................................................................378

Flash Features on the E120 Router and the E320 Router ......................379

Installing and Removing Flash Cards ....................................................380

Synchronizing Flash Cards ....................................................................381

Synchronizing Flash Cards of Different Capacities ..........................383

Disabling Autosynchronization .......................................................383

Validating and Recovering Redundant SRP File Integrity ......................384

Reformatting the Primary Flash Card ....................................................387

Copying the Image on the Primary SRP Module ....................................388

Scanning Flash Cards ............................................................................389

Monitoring Flash Cards .........................................................................391

Updating the Router with JUNOSe Hotfix Files ............................................392

Hotfix Compatibility and Dependency ..................................................393

Removing Hotfixes ...............................................................................394

Hotfixes and Backup Settings ................................................................394

Hotfixes and Standby SRP Modules ......................................................394

Hotfixes and Line Modules ....................................................................394

Monitoring Hotfixes ..............................................................................397

Example: Using and Monitoring Hotfixes .......................................400

Managing the Ethernet Port on the SRP Module ..........................................402

Monitoring Statistics .............................................................................403

Monitoring the Ethernet Configuration for the SRP Module ...................403

Enabling Warm Restart Diagnostics on Modules .........................................404

Enabling Warm Restart Diagnostics ......................................................405

Enabling Diagnostics .............................................................................406

Ignoring Diagnostic Test Failures .................................................................406

Monitoring Modules ....................................................................................408

Chapter 7 Passwords and Security 417

Overview .....................................................................................................417

Platform Considerations ..............................................................................417

Setting Basic Password Parameters .............................................................418

xviii ■ Table of Contents

Creating Encrypted Passwords ..............................................................418

Creating Secrets ....................................................................................419

Encrypting Passwords in Configuration File ..........................................419

Table of Contents

Commands and Guidelines ...................................................................419

Setting and Erasing Passwords ....................................................................421

Privilege Levels .....................................................................................421

Accessing Privilege Levels ..............................................................422

Setting Enable Passwords .....................................................................422

Erasing Enable Passwords ....................................................................422

Setting a Console Password ..................................................................424

Erasing the Console Password ..............................................................425

Monitoring Passwords ...........................................................................426

Vty Line Authentication and Authorization ..................................................427

Configuring Simple Authentication .......................................................427

Configuring AAA Authentication and AAA Authorization .......................430

Virtual Terminal Access Lists .......................................................................434

Secure System Administration with SSH .....................................................435

Transport ..............................................................................................436

User Authentication ..............................................................................437

Connection ...........................................................................................437

Key Management ..................................................................................437

User Key Management ...................................................................437

Host Key Management ...................................................................437

Performance .........................................................................................438

Security Concerns .................................................................................438

Before You Configure SSH ....................................................................439

SSH Configuration Tasks .......................................................................439

Configuring Encryption ..................................................................439

Configuring User Authentication .....................................................440

Configuring Message Authentication ..............................................442

Enabling and Disabling SSH ...........................................................443

Displaying SSH Status .....................................................................444

Terminating an SSH Session ...........................................................445

Restricting User Access ...............................................................................446

Restricting Access to Commands with RADIUS .....................................446

Per-User Enable Authentication ............................................................447

Restricting Access to Virtual Routers .....................................................447

VSA Configuration Examples ..........................................................448

Commands Available to Users ........................................................449

Denial of Service (DoS) Protection ...............................................................450

Suspicious Control Flow Detection ........................................................451

Suspicious Control Flow Monitoring ......................................................452

Configurable Options ............................................................................453

Display Options ....................................................................................453

Traps and Logs .....................................................................................453

Suspicious Control Flow Commands .....................................................454

Monitoring Suspicious Control Flow ......................................................456

Denial-of-Service Protection Groups ......................................................461

Group Parameters .................................................................................461

Attaching Groups ..................................................................................462

Protocol Mapping ..................................................................................462

DoS Protection Group Configuration Example ......................................465

DoS Protection Group Commands ........................................................466

Monitoring DoS Protection Groups ........................................................472

Table of Contents ■ xix

JUNOSe 11.1.x System Basics Configuration Guide

Chapter 8 Writing CLI Macros 473

Platform Considerations ..............................................................................473

Writing Macros ............................................................................................473

Environment Commands ......................................................................475

Capturing Output of Commands ...........................................................476

Adding Regular Expression Matching to Macros ...................................476

Extracting a Substring Based on Regular Expression Matching .............477

Adding Global Variables for Availability to the onError Macro ...............477

Unique IDs for Macros ..........................................................................478

Accurate Use of Error Status When Accessed Ourside of onError

Macro .............................................................................................478

Variables ...............................................................................................479

Literals ..................................................................................................479

Operators ..............................................................................................480

Assignment ....................................................................................482

Increment and Decrement .............................................................482

String Operations ...........................................................................483

Extraction Operations ....................................................................483

Arithmetic Operations ..........................................................................484

Relational Operations .....................................................................484

Logical Operations ..........................................................................484

Miscellaneous Operations ...............................................................485

Conditional Execution ...........................................................................486

If Constructs ...................................................................................486

While Constructs ............................................................................487

Passing Parameters in Macros ..............................................................488

Generating Macro Output ......................................................................489

Invoking Other Macros .........................................................................489

Detecting and Recording Macro Errors ........................................................491

Detectable Macro Errors .......................................................................491

Logging Macro Results ..........................................................................492

Viewing Macro Errors ...........................................................................492

onError Macro Examples ......................................................................493

Detecting Invalid Command Formats .............................................493

Detecting Invalid Commands .........................................................494

Detecting Missing Macros ...............................................................495

Running Macros ..........................................................................................496

Scheduling Macros ......................................................................................499

Practical Examples ......................................................................................502

Configuring Frame Relay ......................................................................502

Configuring ATM Interfaces ..................................................................506

Chapter 9 Booting the System 509

Platform Considerations ..............................................................................509

Configuring Your System for Booting ..........................................................509

xx ■ Table of Contents

Booting the GE-2 Line Module ...............................................................510

Table of Contents

Rebooting Your System ...............................................................................514

Rebooting When a Command Takes a Prolonged Time to Execute .......516

Configuration Caching ..........................................................................517

Operations in Boot Mode .............................................................................517

Displaying Boot Information .......................................................................517

Output Filtering ....................................................................................520

Chapter 10 Configuring the System Clock 521

Overview .....................................................................................................521

NTP .......................................................................................................521

System Operation as an NTP Client ......................................................522

Synchronization .............................................................................523

System Operation as an NTP Server .....................................................524

Platform Considerations ..............................................................................524

References ..................................................................................................524

Setting the System Clock Manually ..............................................................525

Before You Configure NTP ...........................................................................527

Choosing NTP Servers ...........................................................................527

NTP Configuration Tasks .............................................................................527

Enabling NTP Services ..........................................................................527

NTP Client Configuration ......................................................................528

Directing Responses from NTP Servers ..........................................529

Refusing Broadcasts from NTP Servers ...........................................530

NTP Server Configuration .....................................................................530

Configuration Examples ........................................................................532

Monitoring NTP ...........................................................................................533

Chapter 11 Configuring Virtual Routers 539

Overview .....................................................................................................539

Default Virtual Router ...........................................................................539

Virtual Router Instances ........................................................................539

Routing Protocols ..................................................................................540

VPNs and VRFs .....................................................................................540

VPNs ..............................................................................................540

VRFs ...............................................................................................540

Platform Considerations ..............................................................................541

References ..................................................................................................541

Configuring Virtual Routers .........................................................................541

Monitoring Virtual Routers ..........................................................................545

Table of Contents ■ xxi

JUNOSe 11.1.x System Basics Configuration Guide

Part 2 Reference Material

Appendix A Abbreviations and Acronyms 553

Appendix B References 571

RFCs ............................................................................................................571

Draft RFCs ...................................................................................................584

Other Software Standards ...........................................................................587

Hardware Standards ....................................................................................590

Part 3 Index

Index ...........................................................................................................595

xxii ■ Table of Contents

List of Figures

Part 1 Chapters

Chapter 1 Planning Your Network 3

Figure 1: Private Line Aggregation with the E Series Router ............................5

Figure 2: B-RAS Application .............................................................................6

Figure 3: Network Configuration Using a Bottom-Up Approach .......................7

Figure 4: E Series Router Support for Fractional T1/E1 Through T3/E3

Interfaces ................................................................................................11

Figure 5: Channelized T3 Interface Configuration Parameters .......................13

Figure 6: T3 Interface Configuration Parameters ...........................................14

Figure 7: SONET Interfaces ...........................................................................14

Figure 8: Parameters for T1 over DS3 Interface Configuration ......................15

Figure 9: Frame Relay Interface Design .........................................................17

Figure 10: Structure of Frame Relay Protocols ...............................................18

Figure 11: Serial Interface Configuration Parameters for a Frame Relay

Connection .............................................................................................18

Figure 12: E Series Router IP/ATM Access Connection ...................................19

Figure 13: Structure of the ATM Interface Design ..........................................19

Figure 14: Structure of ATM Protocol .............................................................20

Figure 15: ATM Interface Configuration Parameters ......................................20

Figure 16: IP/PPP Connections from the CPE on an E Series Router ..............21

Figure 17: Structure of PPP ...........................................................................21

Figure 18: PPP Interface Configuration Parameters .......................................21

Figure 19: Structure of Cisco HDLC Protocol .................................................22

Figure 20: Example of IP over Ethernet Stacking Configuration Steps ...........23

Chapter 2 Command-Line Interface 29

Figure 21: Command Mode Architecture .......................................................30

Chapter 5 Managing the System 251

Figure 22: Transferring System Files to the E Series Router .........................301

Figure 23: FTP Configuration Example ........................................................311

Figure 24: DNS Hierarchy Example .............................................................320

Chapter 7 Passwords and Security 417

Figure 25: Location of the Software Reset Button ........................................423

Figure 26: Typical Control Packet Processing ..............................................451

Chapter 10 Configuring the System Clock 521

Figure 27: Example of an NTP Hierarchy ....................................................522

Chapter 11 Configuring Virtual Routers 539

Figure 28: Virtual Routers ............................................................................540

List of Figures ■ xxiii

JUNOSe 11.1.x System Basics Configuration Guide

xxiv ■ List of Figures

List of Tables

About the Documentation xxvii

Table 1: Notice Icons ................................................................................xxviii

Table 2: Text and Syntax Conventions ......................................................xxviii

Part 1 Chapters

Chapter 1 Planning Your Network 3

Table 3: Common Access/Uplink Pairings .......................................................5

Chapter 2 Command-Line Interface 29

Table 4: Redirect Operators ...........................................................................40

Table 5: Supported Regular Expression Metacharacters ................................42

Table 6: Help Commands ..............................................................................64

Table 7: Command-Line Editing Keys ............................................................67

Table 8: Command History Keys ...................................................................69

Table 9: Pagination Keys ...............................................................................69

Table 10: Command Mode Overview ............................................................70

Chapter 3 Installing JUNOSe Software 125

Table 11: Software Release Files .................................................................126

Table 12: Software Installation Procedure When a Firewall Exists ...............127

Table 13: Software Installation Procedure When a Firewall Does Not

Exist .....................................................................................................133

Table 14: Software Installation Procedure in Boot Mode ..............................137

Table 15: Release Compatibility ..................................................................142

Chapter 4 Configuring SNMP 147

Table 16: SNMP Terminology ......................................................................148

Table 17: Relationship Among Groups, Security Levels, and Views .............152

Table 18: SnmpEngineID Structure Object ..................................................154

Table 19: Relationship Between SNMPv1/v2c and SNMPv3 Attributes .........155

Table 20: SNMP Operations .........................................................................156

Table 21: SNMP PDU Types .........................................................................156

Table 22: Trap Severity Descriptions ...........................................................169

Table 23: Interface Strings ...........................................................................196

Table 24: Data Retrieved According to Schema ...........................................215

Table 25: if-stats Schema Objects ................................................................216

Table 26: IGMP Schema Objects ..................................................................217

Table 27: Policy Schema Objects .................................................................217

Table 28: QoS Schema Objects ....................................................................218

Table 29: Mapping Bulkstats Output to MIB Flies and CLI Configurations for

Policy Schema ......................................................................................224

Table 30: Mapping Bulkstats Output to MIB Flies and CLI Configurations for

QoS schema ..........................................................................................231

List of Tables ■ xxv

JUNOSe 11.1.x System Basics Configuration Guide

Chapter 5 Managing the System 251

Table 31: Output Locations for Layer 2 and Layer 3 Interface

Configurations ......................................................................................262

Table 32: Categories of Router Settings .......................................................267

Table 33: Types of System Files and Corresponding Extensions ..................290

Table 34: FTP Commands That the System Supports ..................................292

Table 35: File Types You Can Rename ........................................................293

Table 36: File Types You Can Delete ...........................................................295

Table 37: File Types You Can Transfer Using the copy Command ...............303

Table 38: Chassis Slot Numbers Versus Hardware Slot Numbers .................331

Chapter 6 Managing Modules 355

Table 39: IOA Management Information .....................................................358

Table 40: Bandwidth Statistics for Line Modules ..........................................374

Table 41: Combinations of Line Modules for Line Rate Performance—SRP-10G

Module in an ERX7xx Model .................................................................375

Table 42: Combinations of Line Modules for Line Rate Performance—SRP-10G

Module in an ERX1410 Router ..............................................................376

Table 43: Combinations of Line Modules for Line Rate

Performance—SRP-5G+ Module in an ERX705 Router ........................376

Table 44: Supported Line Modules ..............................................................405

Chapter 7 Passwords and Security 417

Table 45: Commands Available at Different Privilege Levels .......................421

Table 46: CLI User Access Levels .................................................................446

Table 47: Juniper Networks–Specific CLI Access VSA Descriptions ..............447

Table 48: Juniper Networks–Specific Virtual Router Access VSA

Descriptions ..........................................................................................448

Table 49: Layer 2-Related Protocols ............................................................462

Table 50: IP-Related Protocols .....................................................................464

Chapter 8 Writing CLI Macros 473

Table 51: Environment Commands .............................................................475

Table 52: Macro Operators ..........................................................................480

Table 53: Operator Actions ..........................................................................480

Table 54: Contents of ds1mac.mac .............................................................503

Part 2 Reference Material

Appendix B References 571

Table 55: E Series RFCs ...............................................................................571

Table 56: E Series Draft RFCs ......................................................................584

Table 57: E Series Non-RFC Software Standards ..........................................587

Table 58: E Series Hardware Standards .......................................................590

xxvi ■ List of Tables

About the Documentation

■ E Series and JUNOSe Documentation and Release Notes on page xxvii

■ Audience on page xxvii

■ E Series and JUNOSe Text and Syntax Conventions on page xxvii

■ Obtaining Documentation on page xxix

■ Documentation Feedback on page xxix

■ Requesting Technical Support on page xxix

E Series and JUNOSe Documentation and Release Notes

For a list of related JUNOSe documentation, see

http://www.juniper.net/techpubs/software/index.html .

If the information in the latest release notes differs from the information in the
documentation, follow the JUNOSe Release Notes.

To obtain the most current version of all Juniper Networks® technical documentation,
see the product documentation page on the Juniper Networks website at

http://www.juniper.net/techpubs/.

Audience

This guide is intended for experienced system and network specialists working with
Juniper Networks E Series Broadband Services Routers in an Internet access
environment.

E Series and JUNOSe Text and Syntax Conventions

Table 1 on page xxviii defines notice icons used in this documentation.

E Series and JUNOSe Documentation and Release Notes ■ xxvii

JUNOSe 11.1.x System Basics Configuration Guide

Table 1: Notice Icons

Table 2 on page xxviii defines text and syntax conventions that we use throughout the
E Series and JUNOSe documentation.

DescriptionMeaningIcon

Indicates important features or instructions.Informational note

Indicates a situation that might result in loss of data or hardware damage.Caution

Alerts you to the risk of personal injury or death.Warning

Alerts you to the risk of personal injury from a laser.Laser warning

Table 2: Text and Syntax Conventions

Represents commands and keywords in text.Bold text like this

Bold text like this

Fixed-width text like this

Represents text that the user must type.

Represents information as displayed on your
terminal’s screen.

Italic text like this

Emphasizes words.

■

Identifies variables.

■

Identifies chapter, appendix, and book

■

names.

Plus sign (+) linking key names

keys simultaneously.

Syntax Conventions in the Command Reference Guide

ExamplesDescriptionConvention

Issue the clock source command.

■

Specify the keyword exp-msg.

■

host1(config)#traffic class low-loss1

host1#show ip ospf 2

Routing Process OSPF 2 with Router
ID 5.5.0.250
Router is an Area Border Router
(ABR)

There are two levels of access: user and

■

privileged.

clusterId, ipAddress.

■

Appendix A, System Specifications

■

Press Ctrl + b.Indicates that you must press two or more

terminal lengthRepresents keywords.Plain text like this

| (pipe symbol)

xxviii ■ E Series and JUNOSe Text and Syntax Conventions

mask, accessListNameRepresents variables.Italic text like this

diagnostic | lineRepresents a choice to select one keyword
or variable to the left or to the right of this
symbol. (The keyword or variable can be
either optional or required.)

Table 2: Text and Syntax Conventions (continued)

About the Documentation

ExamplesDescriptionConvention

[ internal | external ]Represent optional keywords or variables.[ ] (brackets)

[ ]* (brackets and asterisk)

that can be entered more than once.

Represent required keywords or variables.{ } (braces)

Obtaining Documentation

To obtain the most current version of all Juniper Networks technical documentation,
see the Technical Documentation page on the Juniper Networks Web site at

http://www.juniper.net/.

To download complete sets of technical documentation to create your own
documentation CD-ROMs or DVD-ROMs, see the Offline Documentation page at

http://www.juniper.net/techpubs/resources/cdrom.html

Copies of the Management Information Bases (MIBs) for a particular software release
are available for download in the software image bundle from the Juniper Networks
Web site athttp://www.juniper.net/.

Documentation Feedback

[ level1 | level2 | l1 ]*Represent optional keywords or variables

{ permit | deny } { in | out }

{ clusterId | ipAddress }

We encourage you to provide feedback, comments, and suggestions so that we can
improve the documentation to better meet your needs. Send your comments to

[email protected], or fill out the documentation feedback form at

https://www.juniper.net/cgi-bin/docbugreport/. If you are using e-mail, be sure to include

the following information with your comments:

■ Document or topic name

■ URL or page number

■ Software release version

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical
Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support
contract, or are covered under warranty, and need post-sales technical support, you
can access our tools and resources online or open a case with JTAC.

■ JTAC policies—For a complete understanding of our JTAC procedures and policies,

review the JTAC User Guide located at

http://www.juniper.net/customers/support/downloads/7100059-EN.pdf .

Obtaining Documentation ■ xxix

JUNOSe 11.1.x System Basics Configuration Guide

■ Product warranties—For product warranty information, visit

http://www.juniper.net/support/warranty/ .

■ JTAC hours of operation—The JTAC centers have resources available 24 hours a

day, 7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online
self-service portal called the Customer Support Center (CSC) that provides you with
the following features:

■

Find CSC offerings: http://www.juniper.net/customers/support/

■

Search for known bugs: http://www2.juniper.net/kb/

■

Find product documentation: http://www.juniper.net/techpubs/

■ Find solutions and answer questions using our Knowledge Base:

http://kb.juniper.net/

■ Download the latest versions of software and review release notes:

http://www.juniper.net/customers/csc/software/

■ Search technical bulletins for relevant hardware and software notifications:

https://www.juniper.net/alerts/

■ Join and participate in the Juniper Networks Community Forum:

http://www.juniper.net/company/communities/

■

Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

To verify service entitlement by product serial number, use our Serial Number
Entitlement (SNE) Tool: https://tools.juniper.net/SerialNumberEntitlementSearch/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

■

Use the Case Management tool in the CSC at http://www.juniper.net/cm/ .

■ Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

For international or direct-dial options in countries without toll-free numbers, see

http://www.juniper.net/support/requesting support.html .

xxx ■ Requesting Technical Support

Part 1

Chapters

■ Planning Your Network on page 3

■ Command-Line Interface on page 29

■ Installing JUNOSe Software on page 125

■ Configuring SNMP on page 147

■ Managing the System on page 251

■ Managing Modules on page 355

■ Passwords and Security on page 417

■ Writing CLI Macros on page 473

■ Booting the System on page 509

■ Configuring the System Clock on page 521

■ Configuring Virtual Routers on page 539

Chapters ■ 1

JUNOSe 11.1.x System Basics Configuration Guide

2 ■ Chapters

Chapter 1

Planning Your Network

This chapter describes planning steps that will make it easier to configure the physical
interfaces, logical interfaces, and routing protocols for the Juniper Networks E Series
Broadband Services Routers in:

■ A new network that you are creating and implementing

■ An existing network that you are expanding

This chapter contains the following sections:

■ Platform Considerations on page 3

■ Edge Applications Overview on page 4

■ Layered Approach on page 6

■ Line Modules, I/O Modules, and IOAs on page 7

■ Interfaces on page 8

■ General Configuration Tasks on page 9

■ Configuring Virtual Routers on page 10

■ Configuring IPSec on page 10

■ Configuring Physical Layer Interfaces on page 10

■ Configuring Data Link-Layer Interfaces on page 17

■ Configuring IP Tunnels, Shared IP Interfaces, and Subscriber Interfaces on page 23

■ Configuring Routing Protocols on page 24

■ Configuring VRRP on page 25

■ Configuring Routing Policy on page 25

■ Configuring QoS on page 25

■ Configuring Policy Management on page 26

■ Configuring Remote Access on page 26

Platform Considerations

For information about the modules supported on E Series routers:

■ See the ERX Module Guide for modules supported on ERX7xx models, ERX14xx

models, and the Juniper Networks ERX310 Broadband Services Router.

Platform Considerations ■ 3

JUNOSe 11.1.x System Basics Configuration Guide

■ See the E120 and E320 Module Guide for modules supported on the Juniper

Networks E120 and E320 Broadband Services Routers.

Interface Specifiers

The configuration task examples in this chapter use the slot/port format to specify
an interface. However, the interface specifier format that you use depends on the
router that you are using.

For ERX7xx models, ERX14xx models, and ERX310 router, use the slot/port format.
For example, the following command specifies an ATM interface on slot 0, port 1 of
an ERX7xx model, ERX14xx model, or ERX310 router.

host1(config)#interface atm 0/1

For E120 and E320 routers, use the slot/adapter/port format, which includes an
identifier for the bay in which the I/O adapter (IOA) resides. In the software, adapter
0 identifies the right IOA bay (E120 router) and the upper IOA bay (E320 router);
adapter 1 identifies the left IOA bay (E120 router) and the lower IOA bay (E320
router). For example, the following command specifies an ATM interface on slot 5,
adapter 0, port 0 of an E320 router.

host1(config)#interface atm 5/0/0

For more information about supported interface types and specifiers on E Series
routers, see Interface Types and Specifiers in JUNOSe Command Reference Guide.

Edge Applications Overview

The E Series router can be used for a number of edge aggregation applications. Two
of the most common are:

■ Private line aggregation

■ xDSL session termination

Private Line Aggregation

A major application of the E Series router is for private line aggregation—the
consolidation of multiple high-speed access lines into one access point. See Figure
1 on page 5.

In this application, the service provider can use a single router to offer high-speed
access (FT1/FE1 through T3/E3) to thousands of subscribers. The individual subscriber
lines can be multiplexed into T3 lines by the service provider and fed into the router.
(The router can also accept unchannelized T3 or E3 connections from high-speed
users and channelized E1 connections directly into the unit.) Once the traffic is
received, the router then handles all IP packet processing, including the assignment
of QoS and routing policies. The packets are then routed into the backbone network.

4 ■ Edge Applications Overview

Figure 1: Private Line Aggregation with the E Series Router

Chapter 1: Planning Your Network

The router supports a number of access and uplink methods; the most common
pairings are listed in Table 3 on page 5.

Table 3: Common Access/Uplink Pairings

Frame Relay

ATM

xDSL Session Termination

The router supports Broadband Remote Access Server (B-RAS) applications, as shown
in Figure 2 on page 6. In this application, the router handles the aggregated output
from the digital subscriber line access multiplexers (DSLAMs). Directly connected to
the subscriber premises, the DSLAMs handle the copper termination and aggregate
the traffic into a higher-speed uplink. The output from the DSLAM is fed into the
router through a DS3 or OC3 link.

UplinkAccess

ATM, Fast Ethernet, Gigabit Ethernet, or POSPPP

Edge Applications Overview ■ 5

JUNOSe 11.1.x System Basics Configuration Guide

Figure 2: B-RAS Application

The router then performs several functions:

■ PPP session termination and authentication checking through PAP or CHAP

■ Coordination with DHCP servers and local IP pools to assign IP addresses

■ Connection to RADIUS servers or use of domain names to associate subscribers

with user profile information

■ Support for RADIUS accounting to gather detailed billing information

■ Application of the user profile to the user traffic flow, which could include QoS,

VPN, and routing profiles

The output of the router is typically a high-speed link, such as OC3/STM1 to feed a
core backbone router. Virtual routers can also be used to keep the traffic logically
separate and to direct packets to different destinations. As shown in Figure 2 on
page 6, the packets can be directed to a CLEC, ISP, corporate VPN, or the Internet.

A large number of xDSL protocols are supported, including:

■ IP/PPP/ATM

■ IP/PPP/Ethernet/ATM

■ IP/bridged Ethernet/ATM

See JUNOSe Broadband Access Configuration Guide, for information about configuring
B-RAS.

Layered Approach

The JUNOSe CLI enables you to configure your network based on the hierarchy of
the OSI model. Therefore, the JUNOSe configuration guides use a bottom-up approach
to describe the configuration process. Figure 3 on page 7 shows the relationship of
layers, protocols, and interfaces to the configuration process. Software functions are

6 ■ Layered Approach

Chapter 1: Planning Your Network

layered on top of physical (copper or optical) interfaces. The router supports a number
of access protocols (PPP/POS, Frame Relay, ATM) that allow service providers to
offer a number of access methods and line speeds to their subscribers. The router
is optimized to handle IP connections regardless of the access protocol used. The
router also supports a number of protocols that are specific to the B-RAS application.
These are shown in Figure 3 on page 7, and include IP/PPP/ATM and
IP/PPP/Ethernet/ATM.

Figure 3: Network Configuration Using a Bottom-Up Approach

Layer 2 (data link) defines how the data is packaged and sent to an IP data connection
point in layer 3 (IP interfaces). In layer 3, you define the global attributes for IP
services that serve as a platform from which you add routing information.

Line Modules, I/O Modules, and IOAs

A range of line modules, I/O modules, and I/O adapters (IOAs) are available for the
router. On the ERX14xx models, ERX7xx models, and the ERX310 router, most line
modules pair with a corresponding I/O module. On the E120 and E320 routers, a
single line module pairs with all available IOAs.

I/O modules and IOAs provide the input and output connections from the network
to the router. Line modules connect to their corresponding I/O modules or IOAs
through a passive midplane. A line module receives packets through its I/O module
or IOA and processes those packets. The router then routes the packets out to the
network through the designated I/O module or IOA.

Each line module, I/O module, and IOA has a label on its faceplate. In this
documentation, these modules are identified by that label. For example, the
high-density Gigabit Ethernet line module has two ports, and is called the GE-HDE
line module. Its corresponding I/O modules are the GE-HDE I/O module and the GE-2
SFP I/O module.

When we refer to a related set of line modules, I/O modules, or IOAs, the generic
information from the module labels is used in this documentation. For example, the
term “ OCx/STMx line modules” refers to both the OCx/STMx ATM and the OCx/STMx

Line Modules, I/O Modules, and IOAs ■ 7

JUNOSe 11.1.x System Basics Configuration Guide

POS line modules. Similarly, the term “ GE I/O modules” refers to both the GE
Multimode I/O module and the GE Single Mode I/O module.

For a complete list of the line modules and I/O modules available for ERX14xx models,
ERX7xx models, and the ERX310 router, see ERX Module Guide, Table 1, Module
Combinations. For more information about line modules and IOAs available with the
E120 and E320 routers, see E120 and E320 Module Guide, Table 1, Modules and IOAs.

For more information about managing these modules, see “Managing Modules” on
page 355.

Interfaces

The term interfaces is used in a very specific way in the JUNOSe CLI and this
documentation. Interfaces are both physical and logical channels on the router that
define how data is transmitted to and received from lower layers in the protocol
stack. Conceptually, you configure an interface as part of the physical layer, layer 1.

Subinterfaces

For example, you can configure the physical and logical characteristics of T3 and T1
lines coming directly from the customer premises or from a central office switch and
OC3 lines going out to the core of your network infrastructure. These physical and
logical characteristics define an interface.

Interface layering must always be configured in order from the lowest layer to the
highest layer. For example, if you have already configured IP to run over ATM and
you want to reconfigure the interface to run IP over PPP over ATM, you must first
remove the IP interface, apply PPP, and then reapply IP.

A subinterface is a mechanism that allows a single physical interface to support
multiple logical interfaces or networks. Several logical interfaces or networks can be
associated with a single physical interface. Configuring multiple virtual interfaces, or
subinterfaces, on a single physical interface allows greater flexibility and connectivity
on the network.

Protocols such as Frame Relay and ATM require that you create one or more virtual
circuits over which your data traffic is transmitted to higher layers in the protocol
stack. The router requires that you define a subinterface on top of a physical interface
as a platform for a virtual circuit, such as a permanent virtual circuit (PVC).

Once you have defined the underlying characteristics of an interface, use the interface
command to:

1. Assign an interface type, such as POS or ATM.

2. Assign the associated interface specifier to the interface, such as the slot/port or

slot/adapter/port and channel/subchannel.

3. Assign one or more subinterfaces.

8 ■ Interfaces

interface Command

The interface command has the following format:

interface interfaceType interfaceSpecifier

Each interface type has an interface specifier associated with it. The interface specifier
identifies the physical location of the interface on the router, such as the chassis slot
and port number, and logical interface information, such as a T1 channel on a
channelized T3 interface.

For detailed information about interface types and specifiers and for specific syntax
for the interface command, see the Interface Types and Specifiers in JUNOSe
Command Reference Guide.

General Configuration Tasks

Chapter 1: Planning Your Network

The configuration process for E Series routers involves the following general tasks:

1. Determine IP-addressing information and information about the physical and

logical characteristics of the various interfaces that you want to configure.

2. Determine information about the link-layer protocols.

3. Determine how to organize virtual routers on the router.

4. Determine how IPSec will be used to provide security.

5. Determine routing information that defines all or part of the network.

6. Create the virtual routers.

7. Configure the interfaces and subinterfaces (such as channelized T3, OCx/STMx,

and HDLC data channels) over which the higher-layer protocols run.

8. Configure the data link-layer protocols, such as Frame Relay, PPP, and ATM, that

run over these physical interfaces.

9. Configure the general IP information from which the other routing protocols will

operate.

10. Configure IP tunnels, shared interfaces, and subscriber interfaces.

11. Configure IPSec.

12. Configure the routing protocols that will run on the router, such as IP multicasting

protocols, OSPF, IS-IS, RIP, BGP-4, and MPLS.

13. Configure the Virtual Router Redundancy Protocol (VRRP) on IP/Ethernet

interfaces.

14. Configure QoS and policy management.

15. Configure the router for remote access.

16. Use the appropriate show commands to display network activity on each of the

interfaces that you have configured. Do this to verify that they are operating as
you expect and to help improve the management of your network.

General Configuration Tasks ■ 9

JUNOSe 11.1.x System Basics Configuration Guide

Configuring Virtual Routers

Multiple distinct virtual routers are supported within a single router, which allows
service providers to configure multiple, separate, secure routers within a single
chassis. These routers are identified as virtual routers (VRs). Applications for this
function include the creation of individual routers dedicated to wholesale customers,
corporate virtual private network (VPN) users, or a specific traffic type.

The router implements the virtual routers by maintaining a separate instance of each
data structure for each virtual router and allowing each protocol to be enabled on a
case-by-case basis. Virtual routers provide full support for all supported routing
protocols (unicast, multicast, and MPLS).

For information about configuring virtual routers, see “Configuring Virtual Routers”
on page 539.

Configuring IPSec

IPSec provides security to IP flows through the use of authentication and encryption.

■ Authentication verifies that data is not altered during transmission and ensures

that users are communicating with the individual or organization that they believe
they are communicating with.

■ Encryption makes data confidential by making it unreadable to everyone except

the sender and intended recipient.

IPSec comprises two encapsulating protocols:

■ Encapsulating Security Payload (ESP) provides confidentiality and authentication

functions to every data packet.

■ Authentication header (AH) provides authentication to every data packet.

For information about configuring IPSec, see JUNOSe IP Services Configuration Guide.

Configuring Physical Layer Interfaces

The router supports a number of line rates; some of these are listed per line module
below.

■ COCX-F3 line module supports unchannelized E3.

■ Channelized OCx/STMx (cOCx/STMx) line module supports DS3 channelized to

DS1, fractional DS1, or the DS0 level; unchannelized DS3; E1/T1 channelized to
fractional DS1; unframed E1.

■ CT3 12-F0 line modules support DS3 channelized to DS1, fractional DS1, or the

DS0 level. CT3 12-F0 line modules also support unchannelized T3.

■ IPSec Service module provides tunnel service for secure tunnels.

■ GE/FE line module supports Gigabit Ethernet and Fast Ethernet.

10 ■ Configuring Virtual Routers

Chapter 1: Planning Your Network

■ GE-2 line module and GE-HDE line module support Gigabit Ethernet.

■ OCx/STMx ATM line module supports OC3/STM1 ATM, OC12/STM4 ATM, and

unchannelized T3.

■ OCx/STMx POS line module supports OC3/STM1 POS and OC12/STM4 POS.

■ OC48 line module supports OC48/STM16 POS.

■ OC3/STM1 GE/FE line module supports OC3/STM1 ATM and Gigabit Ethernet.

■ ES2 4G line module (LM) supports OC48/STM16 POS, OC12/STM1 POS, OC3/STM1

ATM, OC12/STM1 ATM, Gigabit Ethernet, 10-Gigabit Ethernet, and tunnel-service
interfaces.

■ ES2 10G Uplink LM, ES2 10G LM, and ES2 10G ADV LM supports 10-Gigabit

Ethernet interfaces.

■ COCX-F3 line module supports unchannelized T3.

■ Service Module (SM) provides tunnel service for IP tunnels and LNS termination.

A variety of protocols are supported over these interfaces, including IP/Frame Relay,
IP/ATM, IP/PPP, as well as the protocols to enable B-RAS services. The router’s DSx
and E1/E3 implementations support termination, statistics gathering, alarm
surveillance, and performance monitoring. These links can be used for either network
ingress or network egress.

Figure 4: E Series Router Support for Fractional T1/E1 Through T3/E3 Interfaces

As shown in Figure 4 on page 11, the router can support fractional, full, and
channelized interfaces.

NOTE: See ERX Hardware Guide, Chapter 4, Installing Modules and E120 and E320
Hardware Guide, Chapter 4, Installing Modules, for a discussion of slot groups and

modules. See the ERX Module Guide and the E120 and E320 Module Guide, for a
discussion of the combination of line modules allowed in E Series routers.

Line Module Features

The following features are supported by the system line modules:

■ Three different clocking options: internal timing, loop timing, and chassis timing

■ DS3 framing type—Both M23 framing and C-bit parity

Configuring Physical Layer Interfaces ■ 11

JUNOSe 11.1.x System Basics Configuration Guide

■ DS1 framing type—Both D4 framing mode and ESF framing mode

■ DS3 loopback—For line, payload, diagnostic, and DS1 loopbacks

■ DS1 loopback—For line, payload, and diagnostic loopbacks

■ DS3/DS1 line status/alarm monitoring

■ DS1 line coding type—Both AMI line encoding and B8ZS line encoding

■ Unique IP interface support—For each PPP or Frame Relay PVC interface

Configurable HDLC Parameters

The following HDLC parameters are configurable:

■ Mapping of DS0 timeslots for T1/FT1 DS0 mapping

■ Setting the speed of the DS0 to Nx56 or Nx64

■ HDLC CRC checking (enable/disable)

■ HDLC CRC algorithm (CRC16 or CRC32)

■ Channel data inversion (enable/disable)

■ Maximum receive unit (MRU)

■ Maximum transmit unit (MTU)

Statistics are also gathered per line module.

Configuring Channelized T3 Interfaces

There12 T3 controllers available on each CT3 12-F0 line module. When you configure
these T3 controllers, you are actually configuring T3 (DS3) lines. Each T3 controller
has, by definition, 28 T1 controllers representing T1 (DS1) lines.

Use the T3 and T1 commands described in JUNOSe Physical Layer Configuration Guide,
to:

■ Specify the line characteristics, such as framing format and clock source, for T3s

and associated T1s.

■ Assign full and fractional T1 channels (DS0) to a virtual channel.

Figure 5 on page 13 shows sample parameters for a channelized T3 interface
configuration.

12 ■ Configuring Physical Layer Interfaces

Chapter 1: Planning Your Network

Figure 5: Channelized T3 Interface Configuration Parameters

The following sample command sequence configures a serial interface for a
CT3 12-F0 module. See JUNOSe Physical Layer Configuration Guide, for details.

host1(config)#controller t3 0/1
host1(config-controll)#framing c-bit
host1(config-controll)#clock source line
host1(config-controll)#cablelength 220
host1(config-controll)#t1 2/1
host1(config-controll)#t1 2 framing esf
host1(config-controll)#t1 2 lineCoding b8zs
host1(config-controll)#t1 2/1 timeslots 2/1 1,3-8,10-12
host1(config-controll)#interface serial 0/1:2/1

Configuring T3 and E3 Interfaces

The COCX-F3 line module supports the following wide area network (WAN) protocol
encapsulations:

■ IP over PPP

■ IP over ATM

■ IP over PPP over ATM

■ IP over PPP over PPPoE over ATM

■ IP over Frame Relay

Figure 6 on page 14 shows sample configuration parameters for a T3 interface
configuration.

Configuring Physical Layer Interfaces ■ 13

JUNOSe 11.1.x System Basics Configuration Guide

Figure 6: T3 Interface Configuration Parameters

The following sample command sequence configures a serial interface for a T3
module. See JUNOSe Physical Layer Configuration Guide, for details.

host1(config)#controller t3 0/1
host1(config-controll)#framing m23
host1(config-controll)#cablelength 300
host1(config-controll)#ds3-scramble
host1(config-controll)#exit
host1(config)#interface serial 0/1
host1(config-if)#invert data
host1(config-if)#mtu 1600
host1(config-if)#mru 1600

Configuring OCx/STMx and OC48 Interfaces

The router supports IP/ATM, IP/Frame Relay, and IP/PPP over SONET on the
OCx/STMx interfaces. OC48 interfaces support IP/Frame Relay and IP/PPP over
SONET, but do not support ATM operation. This interface support allows service
providers to accept incoming optical connections or connect the router to the
backbone network through optical connections. The router’s SONET implementation
supports termination, statistic gathering, and alarm surveillance at the section, line,
and path layers of a SONET interface.

Figure 7: SONET Interfaces

The following sample command sequence configures POS for an OC3 interface. See
JUNOSe Link Layer Configuration Guide, for details.

host1(config)#interface pos 0/1
host1(config-if)#encapsulation ppp
host1(config-if)#clock source internal module
host1(config-if)#loopback line

14 ■ Configuring Physical Layer Interfaces

host1(config-if)#pos framing sdh
host1(config-if)#mtu 1600
host1(config-if)#mru 1600
host1(config-if)#pos scramble-atm

Configuring Channelized OCx/STMx Line Interfaces

The cOCx/STMx modules are generally used for circuit aggregration on the router.
These line modules support the following controllers over OC3/STM1 or OC12/STM4,
depending on the I/O module used with the line module:

■ Fractional T1/E1 over SONET/SDH virtual tributaries or T3

■ Unframed E1

■ Unchannelized DS3

Figure 8 on page 15 shows the configuration parameters for a sample T1 over DS3
interface configuration.

Chapter 1: Planning Your Network

Figure 8: Parameters for T1 over DS3 Interface Configuration

The following sample command sequence configures T1 over DS3 on a channelized
SONET interface as described in Figure 8 on page 15. See JUNOSe Physical Layer
Configuration Guide, for details.

host1(config)#controller sonet 3/0
host1(config-controller)#path 12 oc1 4/1
host1(config-controller)#path 12 ds3 1 channelized
host1(config-controller)#path 12 ds3 1 t1 4
host1(config-controller)#path 12 ds3 1 t1 4/2 timeslots 1, 3-8, 10-12
host1(config)#interface serial 3/0:12/1/4/2

Configuring Physical Layer Interfaces ■ 15

JUNOSe 11.1.x System Basics Configuration Guide

Configuring Ethernet Interfaces

Ethernet interfaces support IP, PPPoE, multinetting (multiple IP addresses), and
VLANs (subinterfaces). Ethernet modules use the Address Resolution Protocol (ARP)
to obtain MAC addresses for outgoing Ethernet frames and support quality of service
(QoS) classification. See JUNOSe Physical Layer Configuration Guide, for a description
of limitations of individual modules.

Use the Fast Ethernet, Gigabit Ethernet, and 10-Gigabit Ethernet commands described
in JUNOSe Physical Layer Configuration Guide to:

■ Configure with IP only, with PPPoE only, with both IP and PPPoE, and with or

without VLANs.

■ Specify the line speed and duplex mode.

■ Specify the MTU.

The following sample command sequence configures an IP interface on a VLAN on
an Ethernet interface:

host1(config)#interface fastEthernet 2/0
host1(config-if)#encapsulation vlan
host1(config-if)#interface fastEthernet 2/0.1
host1(config-if)#vlan id 201
host1(config-if)#ip address 192.168.129.5 255.255.255.0

The following sample command sequence adds an IP interface over PPPoE to the
same VLAN:

host1(config)#interface fastEthernet 2/0.1.2
host1(config-if)#encapsulation pppoe
host1(config-if)#interface fastEthernet 2/0.1.2.1
host1(config-if)#encapsulation ppp
host1(config-if)#ip address 192.2.2.1 255.255.255.0

Configuring IPSec-Service Interfaces

IPSec Service modules support interfaces associated with secure IP tunnels. You
configure and delete these interfaces statically; however, the router assigns tunnels
to the interfaces dynamically. This mechanism means that you must manage the
interfaces for tunnels manually; however, the router will add and remove tunnels
when required.

For information about configuring secure IP interfaces, see JUNOSe IP Services

Configuration Guide . For information about managing IPSec service interfaces, see
JUNOSe Physical Layer Configuration Guide.

Configuring Tunnel Service Interfaces

You can configure both dynamic tunnels associated with L2TP and static IP tunnels
on your E Series router; however, you must first install a Service Module (SM).
Dynamic tunnels, which are not associated with a particular interface, are described

16 ■ Configuring Physical Layer Interfaces

in JUNOSe Broadband Access Configuration Guide. Static tunnels, in which the tunnel
is assigned to a particular interface and specified in slot/port format, are described
in JUNOSe IP Services Configuration Guide.

For information about managing these types of tunnels on the router, see JUNOSe
Physical Layer Configuration Guide.

Configuring Data Link-Layer Interfaces

You can configure the following data link-layer interfaces:

■ IP/Frame Relay or multilink Frame Relay

■ IP/ATM

■ IP/PPP or multilink PPP

■ IP/Cisco HDLC

■ IP/Ethernet

Chapter 1: Planning Your Network

Configuring IP/Frame Relay

The router supports IP over Frame Relay PVCs on the CT3 12-F0 and OCx/STMx POS
modules. The interface presented to the incoming traffic is an IP/Frame Relay router.
In addition, IP/PPP/Frame Relay is supported on the T3 and E3 modules. With this
interface, the service provider can:

■ Receive traffic from subscribers that have CPE equipment, such as routers with

Frame Relay interfaces

■ Take in traffic from other network devices that use Frame Relay, such as DSLAMs

and Frame Relay switches

■ Use Frame Relay as an uplink technology on an unchannelized T3 or E3 link

Figure 9 on page 17 shows the structure of the Frame Relay interface. Each Frame
Relay major interface sits on top of an HDLC interface. The Frame Relay
implementation is divided into two levels: a major interface and one or more
subinterfaces. This division allows a single physical interface to support multiple
logical interfaces. Multiple IP interfaces can also be assigned to each Frame Relay
major interface through the subinterfaces.

Figure 9: Frame Relay Interface Design

Configuring Data Link-Layer Interfaces ■ 17

JUNOSe 11.1.x System Basics Configuration Guide

Figure 10 on page 18 shows the structure of the Frame Relay protocols with the
physical layer as the foundation. For Frame Relay, the physical layer can be
channelized E1, E3, channelized T1, T3, or a fractional service, as supported by the
different line module ports. The HDLC layer is on top of the physical layer and can
support flexible assignment of physical resources.

For example, an HDLC channel can support one DS0, a fractional T1, or an entire
T1. The major Frame Relay interface sits on top of the HDLC resource, and the
subinterfaces sit on top of the major interface. The Frame Relay subinterfaces connect
to the IP interface layer.

Figure 10: Structure of Frame Relay Protocols

The router supports Frame Relay LMI (local management interface) to provide the
operator with configuration and status information relating to the Frame Relay VCs
in operation. LMI specifies a polling mechanism to receive incremental and full-status
updates from the network. The router can represent either side of the User-to-Network
Interface (UNI) and supports unidirectional LMI. Bidirectional support for the
Network-to-Network Interface (NNI) is also supported.

Figure 11 on page 18 shows sample configuration parameters for Frame Relay on
a serial interface.

Figure 11: Serial Interface Configuration Parameters for a Frame Relay Connection

The following sample command sequence configures a serial interface for Frame
Relay. See JUNOSe Link Layer Configuration Guide, for information.

host1(config)#interface serial 0/1:1/5
host1(config-if)#encapsulation frame-relay ietf
host1(config-if)#frame-relay intf-type dte
host1(config-if)#frame-relay lmi-type ansi
host1(config-if)#interface serial 0/1:1/5.1
host1(config-subif)#frame-relay interface-dlci 17 ietf
host1(config-subif)#ip address 192.32.10.2 255.255.255.0

18 ■ Configuring Data Link-Layer Interfaces

Configuring IP/ATM

Chapter 1: Planning Your Network

The router supports IP over ATM PVCs on ATM line modules. This support allows
service providers to receive traffic from subscribers who have CPE equipment, such
as routers with ATM interfaces, to take in traffic from other network devices that use
ATM, such as DSLAMs, and to connect to service providers with ATM backbone
structures.

Figure 12 on page 19 shows an IP/ATM access connection.

Figure 12: E Series Router IP/ATM Access Connection

Figure 13 on page 19 shows the structure of the ATM interface. For ATM, this can
be SONET, DS3, or E3 as supported by the different line modules. The major ATM
interface sits on top of the SONET/DS3/E3 resource, and the subinterfaces sit on top
of the major interface. The ATM subinterfaces connect to the IP interface layer.

Figure 13: Structure of the ATM Interface Design

Figure 14 on page 20 shows the structure of the ATM protocols. The physical layer
(SONET and/or DSx/Ex) is the foundation and provider of layer 1 framing service.
The ATM layer is on top and provides cell, circuit, and OAM services. The AAL5 layer

Configuring Data Link-Layer Interfaces ■ 19

JUNOSe 11.1.x System Basics Configuration Guide

provides a frame-oriented interface to the ATM layer. The integrated local
management interface (ILMI) provides local management across the UNI.

Figure 14: Structure of ATM Protocol

Configuring IP/PPP

Figure 15 on page 20 shows sample configuration parameters for a typical ATM
interface configuration.

Figure 15: ATM Interface Configuration Parameters

The following sample command sequence configures an ATM interface on port 0 of
the line module in slot 1. See JUNOSe Link Layer Configuration Guide, for information
about how to configure an ATM interface.

host1(config)#interface atm 0/1
host1(config-if)#interface atm 0/1.22
host1(config-if)#atm pvc 22 100 10 aal5snap
host1(config-subif)#ip address 192.32.10.20 255.255.255.0

The router supports IP/PPP on the channelized T3, E1, and T3/E3 interfaces and
IP/PPP/SONET on the OC3/STM1 and OC12/STM4 interfaces. This support allows
service providers to accept traffic from subscribers who have CPE equipment, such
as routers with PPP interfaces, and to transmit traffic in PPP format to other network
devices.

Figure 16 on page 21 shows that the router supports the incoming IP/PPP traffic
from the CPE. This traffic can then be routed to the uplink(s) attached to the router
or to other CPEs that are attached to the router.

20 ■ Configuring Data Link-Layer Interfaces

Chapter 1: Planning Your Network

Figure 16: IP/PPP Connections from the CPE on an E Series Router

As shown in Figure 17 on page 21, the PPP protocol can exist directly on top of the
HDLC layer or on top of a layer 2 Frame Relay or ATM interface. In either case, IP
rides on top of PPP, providing support for IP/PPP/ATM, IP/PPP/HDLC, and
IP/PPP/Frame Relay. Both SONET and DSx/Ex interfaces are supported at the physical
layer.

Figure 17: Structure of PPP

Figure 18 on page 21 shows sample configuration parameters for PPP on a serial
interface.

Figure 18: PPP Interface Configuration Parameters

The following sample command sequence configures PPP on a serial interface. See
JUNOSe Link Layer Configuration Guide, for details.

host1(config)#interface serial 3/0:2/5
host1(config-if)#encapsulation ppp
host1(config-if)#ip address 192.32.22.10 255.255.255.0

Configuring Data Link-Layer Interfaces ■ 21

JUNOSe 11.1.x System Basics Configuration Guide

Configuring IP/HDLC

The E Series router supports IP over Cisco HDLC on many types of serial interfaces.
Cisco HDLC monitors line status on a serial interface by exchanging keepalive request
messages with peer network devices. It also allows routers to discover IP addresses
of neighbors by exchanging Serial Link Address Resolution Protocol (SLARP) address
request and address response messages with peer network devices.

The E Series router Cisco HDLC is compatible with the Cisco Systems Cisco-HDLC
protocol, the default protocol for all Cisco serial interfaces.

The router supports the following framing features:

■ HDLC for data-link framing

■ 18,000-byte information field size

Figure 19: Structure of Cisco HDLC Protocol

As shown in Figure 19 on page 22, the Cisco HDLC protocol can exist directly on
top of the HDLC layer or ATM or SONET interface. Both SONET and DSx/Ex interfaces
are supported at the physical layer.

The following example configures HDLC on a serial interface. See JUNOSe Link Layer
Configuration Guide , for details.

Configuring IP/Ethernet

The E Series router supports IP/Ethernet. When you select an Ethernet interface, you
can assign an IP address to it, as the following example shows:

Figure 20 on page 23 shows an IP/Ethernet interface stack.

host1(config)#interface serial 3/1:2/1
host1(config-if)#encapsulation hdlc
host1(config-if)#ip address 192.32.10.2 255.255.255.0

host1(config)#interface fastethernet 4/1
host1(config-if)#ip address 192.5.127.8 255.255.255.0

22 ■ Configuring Data Link-Layer Interfaces

Chapter 1: Planning Your Network

Figure 20: Example of IP over Ethernet Stacking Configuration Steps

Configuring IP Tunnels, Shared IP Interfaces, and Subscriber Interfaces

The E Series router supports IP tunnels, shared IP interfaces, and subscriber interfaces.

Configuring IP Tunnels

IP tunnels provide a way of transporting datagrams between routers separated by
networks that do not support all the protocols that those routers support. To configure
an IP tunnel, you must first configure a tunnel-service interface. (See “Configuring
Tunnel Service Interfaces” on page 16.)

When you have configured a tunnel-service interface, treat it in the same way as any
IP interface on the router. For example, you can configure static IP routes or enable
routing protocols on the tunnel interface. The IP configurations that you apply to the
tunnels control how traffic travels through the network.

Configuring Shared Interfaces and Subscriber Interfaces

A shared IP interface is one of a group of IP interfaces that use the same layer 2
interface. Shared IP interfaces are unidirectional—they can transmit but not receive
traffic. A subscriber interface is an extension of a shared IP interface. Subscriber
interfaces are bidirectional—they can both receive and transmit traffic.

You can create multiple shared IP interfaces over the same layer 2 logical
interface—for example, atm 5/3.101—enabling more than one IP interface to share
the same logical resources. This capability is useful, for example, when data received
in one VRF needs to be forwarded out an interface in another VRF, such as for
BGP/MPLS VPNs (see JUNOSe BGP and MPLS Configuration Guide, for more
information). You can configure one or more shared IP interfaces. Data sent over
shared interfaces uses the same layer 2 interface. You can configure shared interfaces
as you would other IP interfaces. Each shared interface has its own statistics.

The E Series router supports subscriber interfaces on a particular type of layer 2
interface, Ethernet. In the absence of VLANS, Ethernet does not have a demultiplexing
layer. A subscriber interface adds a demultiplexing layer for an Ethernet interface
that is configured without VLANs. Using subscriber interfaces, the router can
demultiplex or separate the traffic associated with different subscribers. You can use
subscriber interfaces to separate traffic for cable modem subscribers with different
levels of service and to separate traffic for VPNs.

For information about configuring shared interfaces and subscriber interfaces, see
JUNOSe IP, IPv6, and IGP Configuration Guide.

Configuring IP Tunnels, Shared IP Interfaces, and Subscriber Interfaces ■ 23

JUNOSe 11.1.x System Basics Configuration Guide

Configuring Routing Protocols

After you have set up the interfaces on which IP traffic flows, you can configure the
following routing protocols:

■ IP multicast protocols—IP multicasting allows a device to send packets to a group

of hosts, rather than to a list of individual hosts. Routers use multicast routing
algorithms to determine the best route and transmit datagrams throughout the
network. See JUNOSe Multicast Routing Configuration Guide, for information about
how to configure IP multicast.

■ Open Shortest Path First (OSPF)—This interior gateway protocol (IGP) advertises

the states of network links within an autonomous system. An autonomous system
is a set of routers having a single routing policy running under a single technical
administration. See JUNOSe IP, IPv6, and IGP Configuration Guide , for information
about how to configure OSPF.

■ Integrated Intermediate System–to–Intermediate System (integrated IS-IS)—The

integrated IS-IS protocol provides routing for IP networks and is an extension of
the original IS-IS protocol, which provides routing for pure Open Systems
Interconnection (OSI) environments. This link-state protocol builds a complete
and consistent picture of a network’s topology by sharing link-state information
across network devices in a routing domain. A routing domain is a collection of
contiguous networks that provide full connectivity to all end systems located
within them. See JUNOSe IP, IPv6, and IGP Configuration Guide , for information
about how to configure IS-IS.

■ Border Gateway Protocol (BGP)—BGP, an external gateway protocol (EGP),

provides loop-free interdomain routing between autonomous systems. See JUNOSe
BGP and MPLS Configuration Guide , for information about how to configure BGP.

■ Routing Information Protocol (RIP)—RIP is an IGP created for use in small,

homogeneous networks. RIP uses distance-vector routing to route information
through IP networks. See JUNOSe IP, IPv6, and IGP Configuration Guide , for
information about how to configure RIP.

■ Multiprotocol Label Switching (MPLS)—MPLS is a hybrid protocol that integrates

network layer routing with label switching to provide a layer 3 network with
traffic management capability. Traffic engineering enables more effective use
of network resources while maintaining high bandwidth and stability. MPLS
enables service providers to offer their customers the best service available given
the provider’s resources. There are two fundamental aspects to MPLS:

■ Label distribution—The set of actions MPLS performs to establish and

maintain a label-switched path (LSP), also known as an MPLS tunnel.

■ Data mapping—The process of getting data packets onto an established LSP.

See JUNOSe BGP and MPLS Configuration Guide , for information about
configuring MPLS.

In addition, if you want to make configuration adjustments to IP, see JUNOSe IP, IPv6,
and IGP Configuration Guide, for details.

24 ■ Configuring Routing Protocols

Configuring VRRP

The Virtual Router Redundancy Protocol (VRRP) can prevent loss of network
connectivity to end hosts if the static default IP gateway fails. By implementing VRRP,
you can designate a number of routers as “ backup” routers in case the default “
master” router fails. You can configure VRRP on IP/Ethernet interfaces.

For information about configuring VRRP, see JUNOSe Services Availability Configuration
Guide.

Configuring Routing Policy

The router supports a number of features that allow the service provider to control
the exchange of routing information between virtual routers in the router, between
routers in the network, and between protocols within a router:

Chapter 1: Planning Your Network

Configuring QoS

■ Access lists—Provide filters that can be applied to route maps or distribution

lists. They allow policies to be created, such as a policy to prevent forwarding of
specified routes between the BGP-4 and IS-IS routing tables.

■ Route maps—Modify the characteristics of a route (generally to set its metric or

to specify additional attributes) as it is transmitted or accepted by a router. Route
maps can use access lists to identify the set of routes to modify.

■ Distribution lists—Control the routing information that is accepted or transmitted

to peer routers. Distribution lists always use access lists to identify routes for
distribution. For example, distribution lists could use access lists to specify routes
to advertise.

■ Redistribute routes—Allow routes to be shared between routing protocols and

routing domains. For example, a subset of BGP-4 routes could be leaked into the
IS-IS routing tables.

See JUNOSe IP Services Configuration Guide, for details.

QoS is a suite of features that configure queuing and scheduling on the forwarding
path of your E Series router. QoS provides a level of predictability and control beyond
the best-effort service that is the E Series router’s default data delivery service. Packets
not assigned to a specific traffic class are carried in the best-effort traffic class.
Best-effort service provides packet transmission with no guarantee of results.

The major QoS features that the E Series router provides are:

■ Multiple traffic classes

■ Configurable scheduling

■ Configurable buffer management

Configuring VRRP ■ 25

JUNOSe 11.1.x System Basics Configuration Guide

For information about configuring QoS, see JUNOSe Quality of Service Configuration
Guide.

Configuring Policy Management

Policy management allows network service providers to implement packet forwarding
and routing specifically tailored to their customer’s requirements. Using policy
management, customers can implement policies that selectively cause packets to
take different paths. Policy management provides several types of services:

■ Policy routing—Predefines packet flow to a destination port or IP address

■ QoS classification and marking—Marks packets of a packet flow.

■ Packet forwarding—Allows forwarding of a packet flow.

■ Packet filtering—Drops packets of a packet flow.

■ Packet logging—Logs packets of a packet flow.

■ Rate limiting—Enforces line rates below the physical line rate of the port and

sets limits on packet flows.

■ RADIUS policy support—Allows you to attached a preconfigured policy to an

interface through RADIUS.

See JUNOSe Policy Management Configuration Guide, for details about configuring
policy management.

Configuring Remote Access

The E Series router supports the following remote access functionality:

■ Broadband Remote Access Server (B-RAS)—This application runs on the router

and is responsible for:

■ Aggregating the output from DSLAMs

■ Providing user PPP sessions and PPP session termination

■ Enforcing QoS policies

■ Routing traffic into an ISP’s backbone network

See JUNOSe Broadband Access Configuration Guide.

■ Layer 2 Tunneling Protocol (L2TP)—A method of encapsulating layer 2 packets,

such as PPP, for transmission across a network. In an L2TP relationship, an L2TP
access concentrator (LAC) forms a client-server relationship with a destination,
known as an L2TP network server (LNS), on a remote network.

You can configure the router to act as an LAC in PPP pass-through mode. The
router creates tunnels dynamically by using AAA authentication parameters and
transmits L2TP packets to the LNS through IP/UDP. See JUNOSe Broadband Access
Configuration Guide.

■ Non-PPP equal access—A method of allowing remote access in which the router

provides IP addresses to subscribers’ computers through Dynamic Host

26 ■ Configuring Policy Management

Chapter 1: Planning Your Network

Configuration Protocol (DHCP). This method is particularly convenient for
broadband (cable and DSL) environments or environments that use bridged
Ethernet over ATM, because network operators can support one central system
rather than an individual PPPoE client on each subscriber’s computer. See JUNOSe
Broadband Access Configuration Guide.

Configuring Remote Access ■ 27

JUNOSe 11.1.x System Basics Configuration Guide

28 ■ Configuring Remote Access

Chapter 2

Command-Line Interface

This chapter provides information about the E Series router command-line interface
(CLI).

This chapter contains the following sections:

■ Overview on page 29

■ Platform Considerations on page 48

■ Accessing the CLI on page 48

■ CLI Command Privileges on page 52

■ Using Help on page 63

■ Using Command-Line Editing on page 67

■ Accessing Command Modes on page 69

Overview

The CLI is the interface to the software that you use whenever you access the
router—whether from the console or through a remote network connection. The CLI,
which automatically starts after the router finishes booting, provides commands that
you use to perform various tasks, including configuring the JUNOSe software and
monitoring and troubleshooting the software, network connectivity, and the router
hardware.

Managing your router using the CLI gives you access to thousands of commands.
The router’s CLI uses an industry de facto standard look and feel, which might be
familiar to you. If you are new to this CLI, it is helpful to read this entire chapter,
where you can learn about CLI shortcuts and other helpful information.

Command Modes

Command modes set a context for the CLI. Each command in the CLI is available
from one or more command modes. From some command modes you can only
view router information; from others you can perform configuration tasks. For
example, you can access User Exec mode to display information and then access
Global Configuration mode to set parameters or enable a particular feature. By
recognizing the command-line prompt, you can identify where you are in the CLI at
any given point. When you can easily identify where you are, it is easy to get to
where you want to be.

Overview ■ 29

JUNOSe 11.1.x System Basics Configuration Guide

Figure 21 on page 30 illustrates the command mode architecture. Only some of the
many configuration modes are shown.

Command modes are discussed in greater detail in the section “Accessing Command
Modes” on page 69 . See the JUNOSe Command Reference Guide to find related
command modes for any command.

Figure 21: Command Mode Architecture

30 ■ Overview

Command-Line Prompts

Within the CLI, the command-line prompt identifies both the hostname and the
command mode. The hostname is the name of your router; the command mode

indicates your location within the CLI system.

For example:

Keywords and Parameters

CLI commands are made up of two primary elements: keywords and parameters.

Keywords

Chapter 2: Command-Line Interface

Every command requires at least one keyword; however, a command can contain
other optional keywords. The keyword(s) must be typed into the CLI accurately for
it to be recognized. These are examples of keywords:

reload

run

router

map-class

map-list

clear ip isis redistribution

show vlan subinterface

qos-port-type-profile

no rtr reset

radius calling-station-delimiter

You can abbreviate keywords; however, you must enter enough initial characters to
unambiguously identify the command. For example, if the keyword you want to
specify is map-class and you enter only map-, an error appears. The error indicates
that one or more possible keywords begin with map-, thus making your entry
ambiguous.

Overview ■ 31

JUNOSe 11.1.x System Basics Configuration Guide

Parameters

Parameters are often required elements of a command; however, for some
commands, parameters are not required. A parameter is most often a value that you
specify after the keyword. There are different types of parameters, such as strings,
integers, or IP addresses.

The CLI indicates the type of parameter that you must enter. When you see a range
of numbers or uppercase letters, it indicates that you must specify a value. For
example:

Sample Parameter User InputCLI Parameter Placeholder or Range

charlie:1234ROUTER[:VRF]

3/2:20/15INTERFACE

windtunnelWORD

5600<0–4294967295>

192.56.32.2A.B.C.D

Keywords and Parameters Together

By combining keywords and parameters in the correct sequence, you can begin
using the CLI to configure and monitor your router. For example, you could specify
the command hostname to change the name of your router by entering a keyword
and a parameter. You need to type only the portion of the keyword that makes it
unambiguous, such as hostn. Here, the value of the parameter, which is the name
you assign to the host, is a string of up to 64 characters.

When you enter this command, the new hostname appears in the prompt.

Another example is a command that requires you to enter a number from within a
given range. The command ip http port requires that a value be entered for the
portNumber parameter. The value of this parameter is a number in the range of
0–65535. For example, you could enter:

juniper(config)#ip http port 56789

32 ■ Overview

Using CLI Commands

Chapter 2: Command-Line Interface

NOTE: You can find detailed information about command syntax, with parameter
values defined, in the JUNOSe Command Reference Guide.

This section introduces some useful shortcuts and command-related highlights. These
include:

■ Abbreviated Commands on page 33

■ The ? Key on page 33

■ Backspace or Delete on page 34

■ Enter on page 34

■ Tab on page 34

■ Arrow Keys on page 34

■ The no Version on page 35

■ run and do Commands on page 35

■ show Commands on page 37

■ Redirection of show Command Output on page 40

■ Regular Expressions on page 41

■ The - -More- - Prompt on page 43

■ Responding to Prompts on page 46

Abbreviated Commands

Remember, you can abbreviate keywords to save time if you enter at least enough
leading characters to uniquely identify the desired keyword. For example:

host1(config-if)#ip re

This abbreviation is for the command ip redirects. The string ip re is enough
information for the CLI to identify the command you are using. See the section “Using
Help” on page 63 for additional information.

The ? Key

Use the ? key at any time to see all the choices you can enter next. For example:

host1(config)#router ?
bgpConfigure the Border-Gateway Protocol (BGP)
isisConfigure ISO IS-IS
ospfConfigure the Open Shortest Path First protocol (OSPF)
ripConfigure the Routing Information Protocol
host1(config)#router

Overview ■ 33

JUNOSe 11.1.x System Basics Configuration Guide

When you enter the ? character, all available choices are displayed. The router again
displays the command you typed. You then have to type in only the choice you want
and press Enter.

A <cr> in the list of choices means that you can press Enter to execute the
command. For example:

host1(config-if)#isis metric 40 level-2 ?
<cr>
host1(config-if)#isis metric 40 level-2

NOTE: If the list of options extends beyond one screen, the last line on your screen
displays the --More-- prompt. If you want to use the ? character as part of a string,
such as a hostname or a regular expression, you must enter the following key
sequence: Ctrl+v+?. Otherwise, the CLI considers the ? to be a request for assistance
in completing the command.

Backspace or Delete

Use either key to delete the character immediately preceding the cursor.

Enter

Always use this key to execute the command you entered.

Tab

Use this key to complete the current keyword. For example, if you entered a portion
of a lengthy command, such as

host1(config)#class

and press Tab, the full name of the command appears:

host1(config)#classifier-list

Arrow Keys

Some terminals have arrow (or cursor) keys on their keyboards. These arrow keys
are very useful; however, to use them you must have an ANSI/VT100 emulating
terminal.

The Up Arrow and Down Arrow keys display command history. The Up Arrow key
displays the previous command; you can also use Ctrl+p. The Down Arrow key
displays the next command; you can also use Ctrl+n.

The Left Arrow and Right Arrow keys allow the user to move the cursor back and
forth in the command line.

34 ■ Overview

Chapter 2: Command-Line Interface

The no Version

With very few exceptions, every system configuration command has a no version,
which you can use to negate a command (or a portion of it as specified by an optional
keyword) or to restore its default setting. When you use a command without the
keyword no, you can reenable a disabled feature or override a default setting.

You have the option of using the default keyword whenever the no keyword is also
a choice; simply enter the keyword default instead of no.

In most cases, when you execute the default version of a command, it produces the
exact results as the no version. There are some commands for which the default
version yields a different result from the no version.

Commands for which the default behavior differs from the no behavior are clearly
identified in the JUNOSe Command Reference Guide. Unless otherwise specified,
therefore, the default command is identical to the no command and is neither
documented nor discussed.

The syntax for each no command is described in the JUNOSe Command Reference
Guide. The few system configuration commands that do not have a no version are
indicated in the individual command description.

Because show commands are for the purpose of monitoring your configurations,
they do not have no versions. Most User Exec and Privileged Exec mode commands
do not have no versions.

The CLI can act on no versions of commands when you have entered sufficient
information to distinguish the command syntactically; the CLI ignores all subsequent
input on that line.

To be compatible with some non-Juniper Networks implementations, the no versions
of commands will accept the same options as the affirmative version of the
commands. The CLI ignores the optional input if it has no effect on the command
behavior. If using the option changes the behavior of the no version, the individual
command entry in this guide describes the difference in behavior.

run and do Commands

You can run Exec mode commands while in any configuration mode by preceding
the command with the keyword run or do. For example:

host1(config)#run show users

NOTE: The run and do commands are interchangeable.

By using the run or do command in this way, you can obtain show command
information without leaving configuration mode.

Overview ■ 35

JUNOSe 11.1.x System Basics Configuration Guide

The only commands that cannot be preceded by run or do are the configure
command and those commands that are already available in all modes, such as sleep
or exit.

Example 1 host1(config)#run show config | begin interface

interface null 0
!
interface fastEthernet 0/0
ip address 10.6.129.41 255.255.128.0
!
interface gigabitEthernet 5/0
!
interface atm 6/0
interface atm 6/0.1 point-to-point
encapsulation pppoe
!
interface atm 6/0.1.7
!
interface atm 6/0.1.5
!
interface atm 6/0.1.2
!
interface atm 6/0.1.9
!
interface atm 6/0.1.11
!
interface atm 6/0.1.15
!
interface atm 6/0.1.18
!
ip route 0.0.0.0 0.0.0.0 10.6.128.1
ip route 10.10.121.72 255.255.255.255 10.6.128.1
!
!
route-map adsf permit 10
router dvmrp
!
router igmp
!
snmp-server community private view everything rw
snmp-server contact Mary
snmp-server
!
! End of generated configuration script.
host 1(config)#int fa 0/0

Example 2 host1(config-if)#do dir

Please wait...
unshared in
file size size date (UTC) use

------------------ -------- -------- ------------------- --­reboot.hty 31040 31040 10/30/2001 15:31:10
system.log 20481 20481 10/26/2001 17:24:16
soft_clear_in.mac 8578 8578 10/24/2001 14:39:02
erx_3-3-1.rel 71082105 71082105 10/25/2001 13:02:50 !
erx_3-3-1.rel 70502991 70502991 10/24/2001 19:58:08
autocfg.scr 355 355 09/28/2001 13:33:04
Capacity = 224133120, Bytes Free = 44986177, Reserved = 36700160
host1(config-if)#

36 ■ Overview

Chapter 2: Command-Line Interface

show Commands

You have access to a variety of show commands that display router and protocol
information. You can filter the output of a show command by specifying | (the UNIX
pipe symbol), one of the following keywords, and either a case-sensitive text string
or a regular expression.

■ begin—Displays output beginning with the first line that contains the text string

or regular expression

■ include—Displays output lines that contain the text string or regular expression

and excludes lines that do not contain the text string or regular expression

■ exclude—Displays output lines that do not contain the text string or regular

expression and excludes lines that do contain the text string or regular expression

For a list of regular expressions, see “Regular Expressions” on page 41. You can
press Ctrl+c to interrupt the show command output.

NOTE: The system does not recognize beginning spaces of the text string. For
example, if you enter include IP as the text string on which to filter, the system
ignores the space and displays lines that include words such as RIP.

Example 1 In the following example, the output display starts with the first line that contains

the string inter. The system omits all the preceding lines of the output from the
display because none of them contains the string inter.

host1#show config include-defaults | begin inter
Please wait...log verbosity low internalNetwork
log verbosity low ipEngine
log verbosity low ipProfileMgr
log verbosity low ipProfileMgrEngineering
no log engineering
log fields timestamp instance no-calling-task
!
timing select primary
timing source primary internal
timing source secondary internal
timing source tertiary internal
!
no disable-autosync
no disable-switch-on-error
no redundancy lockout 0
!
virtual-router default
ip domain-lookup
ip name-server 10.2.0.3
ip domain-name 789df
!
host f 10.10.133.11 ftp anonymous null
interface null 0
interface ip 0/0
arp timeout 21600
!
interface ip 2/0

Overview ■ 37

JUNOSe 11.1.x System Basics Configuration Guide

arp timeout 21600
!
interface ip s10
arp timeout 21600
!
interface atm 2/0
no shutdown
atm sonet stm-1
loopback line
atm uni-version 3.0
atm oam loopback-location 0xFFFFFFFF
atm vc-per-vp 32768
atm vp-tunnel 1 10
load-interval 300
no atm snmp trap link-status
no atm shutdown
!
no atm aal5 snmp trap link-status
no atm aal5 shutdown
!
interface atm 2/0.1 point-to-point
no shutdown
no atm atm1483 shutdown
no atm atm1483 snmp trap link-status
!
ip route 0.0.0.0 0.0.0.0 10.13.5.1
ip debounce-time 0
ip source-route
!
router ospf 5
no ospf shutdown
ip route-type both
timers spf 3
maximum-paths 4
ospf auto-cost reference-bandwidth 100
distance ospf intra-area 110
distance ospf inter-area 112
distance ospf external 114
! Area 0.0.0.0
!
! Trap Source: <not configured>
! Note: SNMP server not running.
!
host1#

Example 2 In the following example, the output display consists only of lines that contain the

string ip. The system omits all other lines of the output from the display because
none of them contains the string ip.

host1#show config include-defaults | include ip
! Configuration script generated on WED JUN 06 2001 02:17:00 UTC
strip-domain disable
Please wait...log verbosity low ipEngine
log verbosity low ipEngineering
log verbosity low ipGeneral
log verbosity low ipInterface
log verbosity low ipNhopTrackerEngineering
log verbosity low ipNhopTrackerGeneral
log verbosity low ipProfileMgr
log verbosity low ipProfileMgrEngineering
!

38 ■ Overview

Chapter 2: Command-Line Interface

bandwidth oversubscription
ip domain-lookup
ip name-server 10.2.0.3
ip domain-name 789df
interface ip 0/0
interface ip 2/0
interface ip s10
ip address 10.13.5.61 255.255.255.0
no ip proxy-arp
no ip directed-broadcast
ip redirects
ip route 0.0.0.0 0.0.0.0 10.13.5.1
ip debounce-time 0
ip source-route
no ip ftp source-address
type echo protocol ipIcmpEcho 10.5.0.200 source fastEthernet0/0
type pathEcho protocol ipIcmpEcho 10.2.0.3
type echo protocol ipIcmpEcho 10.5.0.11 source-ipaddr 10.13.5.61
!
controller t1 6/0
framing esf
lineCoding b8zs
clock source line
cablelength short 0
no remote-loopback
!
log engineering
log verbosity low
no log severity
log verbosity low NameResolverLog
log verbosity low atm
log verbosity low atm1483
log verbosity low atmAal5
log verbosity low bgpConnections
log verbosity low bgpDampening
!
host1#

Example 3 In the following example, the output display consists only of lines that do not contain

the string !. The system omits all other lines of the output from the display because
each line contains the string !.

host1#show config include-defaults | exclude !
boot config running-configuration
boot system 3-3-1.rel
no boot backup
no boot subsystem
no boot backup subsystem
boot revert-tolerance 3 1800
no boot force-backup
aaa domain-map jacksonville
virtual-router miami
strip-domain disable
aaa domain-map jak
virtual-router default
strip-domain disable
aaa domain-map northeast
virtual-router default
strip-domain disable
aaa delimiter realmName "/"
hostname host1

Overview ■ 39

JUNOSe 11.1.x System Basics Configuration Guide

no aaa new-model
no service ctrl-x-reboot
no service password-encryption
no baseline show-delta-counts
clock timezone UTC 0 0
no exception dump
exception protocol ftp anonymous null
controller sonet 2/0
sdh
loopback network
clock source line
no shutdown
path 0 overhead j1 msg hello
path 0 overhead j1 exp-msg
ftp-server enable
no login
log engineering
log verbosity low
no log severity
log verbosity low NameResolverLog
log verbosity low aaaAtm1483Cfg
log verbosity low atm1483
log verbosity low atmAal5
log verbosity low bgpConnections
log verbosity low bgpDampening
log verbosity low bgpEng1
log verbosity low bgpEngineering
log verbosity low bgpEvents
log verbosity low bgpKeepAlives
no log engineering
log fields timestamp instance no-calling-task
timing select primary
timing source primary internal
timing source secondary internal
timing source tertiary internal
no atm aal5 snmp trap link-status
no atm aal5 shutdown
interface atm 2/0.1 point-to-point
no shutdown
no atm atm1483 shutdown
no atm atm1483 snmp trap link-status
ip route 0.0.0.0 0.0.0.0 10.13.5.1
ip debounce-time 0
ip source-route

Redirection of show Command Output

You can redirect the output of show commands to network files or local files (in NVS
memory) using the redirection operators described in Table 4 on page 40 .

Table 4: Redirect Operators

>

>>

40 ■ Overview

UseRedirect Operator

Redirects output to the specified file, overwriting the file if
it already exists, creating the file if it does not.

Appends output to the end of the specified file, creating the
file if it does not exist.

Table 4: Redirect Operators (continued)

UseRedirect Operator

Chapter 2: Command-Line Interface

&>

&>>

Redirects output to the specified file, overwriting the file if
it already exists, and displays the output on the screen. The
redirection is synchronized with the screen display; for
example, if a --More-- prompt appears, the redirection halts
until you take further action.

Appends output to the end of the specified file and displays
the output to the screen. The redirection is synchronized
with the screen display; for example, if a --More-- prompt
appears, the redirection halts until you take further action.

For example, you can redirect the output of the show config command to a script
file and later run that script:

host1#show config > showconfig.scr

The following command writes the output to a text file, version.txt, on a remote
router:

host1#show hardware > pc:/erxfiles/version.txt

The following command appends the output to version.txt:

host1#show hardware >> version.txt

Only one instance of a file can be open for file redirection. An error message is
generated if you attempt to redirect output to a file that is already open. You cannot
redirect output to a file that includes a local path in the filename.

You can use redirection with output filtering. The general syntax is:

show options [ { > | >> | &> | &>> } filename ]

[ | { begin | include | exclude } filterstring ]

The filtering is performed before redirection. In the following example, the cnfgfltr.txt
file will contain the output of show config include-defaults beginning with the first
occurrence of the string inter.

host1#show config include-defaults &> cnfgfltr.txt | begin inter

Regular Expressions

A regular expression uses special characters—often referred to as metacharacters—to
define a pattern that is compared with an input string. You can use regular expressions
to filter the output of show commands and to define AS-path access lists and
community lists to more easily filter routes.

For examples of using regular expressions with AS-path access lists and community
lists, see JUNOSe IP Services Configuration Guide.

Overview ■ 41

JUNOSe 11.1.x System Basics Configuration Guide

Metacharacters

Table 5 on page 42 describes the metacharacters supported for regular expression
pattern-matching.

Table 5: Supported Regular Expression Metacharacters

DescriptionMetacharacter

^

*

+

()

_ (underscore)

Matches the beginning of the input string.

Alternatively, when used as the first character within brackets—[^ ]—matches
any number except the ones specified within the brackets.

Matches the end of the input string.$

Matches any single character, including white space..

Matches 0 or more sequences of the immediately previous character or
pattern.

Matches 1 or more sequences of the immediately previous character or
pattern.

Matches 0 or 1 sequence of the immediately previous character or pattern.?

Specifies patterns for multiple use when followed by one of the multiplier
metacharacters: asterisk *, plus sign +, or question mark ?

Matches any enclosed character; specifies a range of single characters.[ ]

Used within brackets to specify a range of AS or community numbers.– (hyphen)

Matches a ^, a $, a comma, a space, a {, or a }. Placed on either side of a
string to specify a literal and disallow substring matching. Numerals enclosed
by underscores can be preceded or followed by any of the characters listed
above.

Using Metacharacters as Literal Tokens

You can remove the special meaning of a metacharacter by preceding it with a
backslash (\). Such a construction denotes that the metacharacter is not treated as a
metacharacter for that regular expression. It is simply a character or token with no
special meaning, just as a numeral has no special meaning. The backslash applies
only to the character immediately following it in the regular expression.

On the E Series router, you are likely to do this only for the parentheses characters,
( or ). BGP indicates a segment of an AS path that is of type AS-confed-set or
AS-confed-seq by enclosing that segment within parentheses.

42 ■ Overview

Matches characters on either side of the metacharacter; logical OR.|

Chapter 2: Command-Line Interface

The - -More- - Prompt

When command output continues beyond the available space on your monitor screen,
the system displays the --More-- prompt. If you press Enter, the system displays the
next line of output. If you press the Spacebar, the system displays the next screen
of output.

You can begin filtering the output from the --More-- prompt, or change a filter that
is already in effect, by entering one of the following characters and a text string:

Displays all output lines that contain the text string+ (plus)

– (minus)

Displays all output lines that do not contain the text
string

/ (forward slash)

Displays all output lines starting at the first line that
contains the text string

Initial spaces are not ignored when you filter at the --More-- prompt.

Example 1 In the following example, the output is displayed until the screen is filled and the

--More-- prompt appears. By entering the filter /interf, the user forces the system to
filter out all output lines until the first occurrence of the string interf. The system
displays that line and all following lines of the output.

host1#show config include-defaults
! Configuration script being generated on FRI AUG 04 2006 12:48:48 UTC
! Juniper Edge Routing Switch ERX-700
! Version: 7.3.0 beta-1.6 [BuildId 5672] (July 11, 2006 11:58)
! Copyright (c) 1999-2006 Juniper Networks, Inc. All rights reserved.
!
boot config running-configuration
boot system erx_7-3-0.rel
no boot backup
no boot subsystem
no boot backup subsystem
boot revert-tolerance 3 1800
no boot force-backup
!
aaa domain-map jacksonville
virtual-router miami
strip-domain disable
!
aaa domain-map jak
virtual-router default
strip-domain disable
!
aaa domain-map northeast
virtual-router default

/interf

(Suppressing output until 'interf' is found, press ^C to end...)
interface null 0
interface ip 0/0

Overview ■ 43

JUNOSe 11.1.x System Basics Configuration Guide

arp timeout 21600
!
interface ip 2/0
arp timeout 21600
!
interface ip s10
arp timeout 21600
!
interface atm 2/0
no shutdown
atm sonet stm-1
loopback line
atm uni-version 3.0
atm oam loopback-location 0xFFFFFFFF

--More--

Example 2 In the following example, the output is displayed until the screen is filled and the

--More-- prompt appears. By entering the filter +ip, the user forces the system to
filter out all lines from the remainder of the output that do not contain the string ip.
The system displays only lines that contain the string ip.

host1#show config include-defaults
! Configuration script being generated on FRI AUG 04 2006 12:48:48 UTC
! Juniper Edge Routing Switch ERX-700
! Version: 7.3.0 beta-1.6 [BuildId 5672] (July 11, 2006 11:58)
! Copyright (c) 1999-2006 Juniper Networks, Inc. All rights reserved.
!
boot config running-configuration
boot system erx_7-3-0.rel
boot config running-configuration
boot system 3-3.1.rel
no boot backup
no boot subsystem
no boot backup subsystem
boot revert-tolerance 3 1800
no boot force-backup
!
aaa domain-map jacksonville
virtual-router miami
strip-domain disable
!
aaa domain-map jak
virtual-router default
strip-domain disable
!
aaa domain-map northeast
virtual-router default

--More-­+ip
(Displaying only lines that include 'ip', press ^C to end...)
strip-domain disable
log verbosity low ipEngine
log verbosity low ipEngineering
log verbosity low ipGeneral
log verbosity low ipInterface
log verbosity low ipNhopTrackerEngineering
log verbosity low ipNhopTrackerGeneral
log verbosity low ipProfileMgr
log verbosity low ipProfileMgrEngineering
log verbosity low ipRoutePolicy
log verbosity low ipRoute

44 ■ Overview

Chapter 2: Command-Line Interface

log verbosity low ipTraffic
log verbosity low ipTunnel
log verbosity low ripEngineering
log verbosity low ripGeneral
log verbosity low ripRoute
log verbosity low ripRtTable
bandwidth oversubscription
ip domain-lookup
ip name-server 10.2.0.3
ip domain-name 789df
ip explicit-path name xyz disable
interface ip 0/0
interface ip 2/0

--More--

Example 3 In the following example, the output is displayed until the screen is filled and the

--More-- prompt appears. By entering the filter -!, the user forces the system to filter
out all comments from the remainder of the output; that is, output lines that contain
the string !. The system displays only lines that do not contain the string !.

host1#show config include-defaults
! Configuration script being generated on FRI AUG 04 2006 12:48:48 UTC
! Juniper Edge Routing Switch ERX-700
! Version: 7.3.0 beta-1.6 [BuildId 5672] (July 11, 2006 11:58)
! Copyright (c) 1999-2006 Juniper Networks, Inc. All rights reserved.
!
boot config running-configuration
boot system erx_7-3-0.rel
boot config running-configuration
boot system 3-3.1.rel
no boot backup
no boot subsystem
no boot backup subsystem
boot revert-tolerance 3 1800
no boot force-backup
!
aaa domain-map jacksonville
virtual-router miami
strip-domain disable
!
aaa domain-map jak
virtual-router default
strip-domain disable
!
aaa domain-map northeast
virtual-router default

--More--

-!

(Displaying only lines that exclude '!'. press ^C to end...)
strip-domain disable
aaa delimiter realmName "/"
hostname host1
no aaa new-model
no service ctrl-x-reboot
no service password-encryption
no baseline show-delta-counts
clock timezone UTC 0 0
no exception dump
exception protocol ftp anonymous null
line vty 4
exec-timeout 0 0

Overview ■ 45

JUNOSe 11.1.x System Basics Configuration Guide

exec-banner
motd-banner
timeout login response 30
data-character-bits 8
no login
log engineering
log verbosity low
no log severity
log verbosity low NameResolverLog
log verbosity low aaaAtm1483Cfg
log verbosity low aaaEngineGeneral
log verbosity low aaaServerGeneral
log verbosity low aaaUserAccess
log verbosity low addressServerGeneral
log verbosity low atm
log verbosity low atm1483
log verbosity low atmAal5
log verbosity low bgpConnections
log verbosity low bgpDampening
log verbosity low bgpEng1

--More--

confirmations explicit

Responding to Prompts

For some actions, the system prompts you for a response. The acceptable default
responses are the following:

■ You can press y or Enter to agree with the prompt and continue.

■ You can press any other key to disagree with the prompt and cancel the action.

You can use the confirmations explicit command to require a more explicit response
to CLI prompts.

Use to require an explicit response to a CLI prompt, as follows:■

■ To agree with the prompt and continue, you must type y and press Enter,

type ye and press Enter, or type yes and press Enter.

■ To disagree with the prompt and cancel the action, you must type n and

press Enter or type no and press Enter.

■ Pressing Enter alone, or entering any other characters, is not an acceptable

response, and the CLI will repeat the prompt.

■ Acceptable responses to a prompt are not case sensitive.

■ Use the no version to restore the default state, where pressing y or Enter

alone responds in the affirmative, and any other entry is accepted as a
negative response.

46 ■ Overview

CLI Status Indicators

Chapter 2: Command-Line Interface

NOTE: The system’s CLI supports a powerful command-line editor, enabling you to
easily correct, edit, and recall previously entered commands. For more information,
see “Using Command-Line Editing” on page 67.

For a description of the commands that you use to get around the CLI, see “Managing
the System” on page 251.

■ See confirmations explicit.

The E Series software includes two types of indicators to inform you of the status of
your CLI operation.

■ The dot service indicator is used when your operation does not finish within 2

seconds. The service displays the Please wait message and a dot every 5 seconds
until the operation is completed. The dot service is used for all CLI operations,
except those that use the more descriptive progress indicator.

■ The progress indicator is an animated representation of how much progress

has been made on a CLI operation that does not finish within the expected
completion time. This type of status indicator is supported for the file system
synchronization application and the file copy application.

The progress indicator displays a series of dots that represents the time required
to complete the operation. The dots are followed by the actual percentage of the
total that has been completed and by an oscillating asterisk that indicates ongoing
activity.

As the application progresses, the dots are replaced with asterisks, starting at
the left, to represent how much of the operation is finished. The actual percentage
is also adjusted accordingly. When the operation is complete, all dots are replaced
by asterisks, and the message DONE replaces the numerical percentage.

The number of dots that appears and the percentage of completion represented
by each dot or asterisk are based on the terminal width. For example, if the
terminal is set to 80 characters, each of the 50 dots indicates 2 percent of the
total time (2 percent x 50 characters = 100 percent). See “Managing the System”
on page 251 for information about setting the terminal width.

The following examples show progress indicator output for a 50-character-wide
display.

*****............................................. (10%) *

*********************************************..... (90%) *

************************************************** (DONE)

Overview ■ 47

JUNOSe 11.1.x System Basics Configuration Guide

Levels of Access

The CLI has two levels of access: user and privileged.

User Level

User level allows you only to view a router’s status. This level restricts you to User
Exec mode.

Privileged Level

Privileged level allows you to view a router configuration, change a configuration,
and run debugging commands. You need a password to access this level. This level
gives you full CLI privileges. Passwords are covered in more detail in “Managing the
System” on page 251.

Initialization Sequence

Each line module in a router is initialized independently. As a result, the CLI on the
SRP module can become available before the line modules have completed
initialization. Commands relating to a line module can fail if the module has not
completed initialization. The show version command can be used to display line
module status. Do not enter commands for a line module until its state is online.

Platform Considerations

The CLI is supported on all E Series routers.

For information about the modules supported on E Series routers:

■ See the ERX Module Guide for modules supported on ERX7xx models, ERX14xx

models, and the ERX310 Broadband Services Router.

■ See the E120 and E320 Module Guide for modules supported on the E120 and

E320 Broadband Services Routers.

Accessing the CLI

This section describes logging in to and exiting from the router.

Logging In

The system supports a local console session and up to 30 virtual terminal (vty) sessions
simultaneously. A virtual terminal session can be a Telnet session, Secure Shell Server
(SSH) protocol session, or File Transfer Protocol (FTP) server session.

48 ■ Platform Considerations

Chapter 2: Command-Line Interface

NOTE: The vty session factory default is 5. Use the line command to configure up
to a maximum of 30 vtys. The configured vtys are shared among all types of
connections; for example, if you configure 7 vtys, then no more than a total of 7 SSH
plus FTP plus Telnet sessions can simultaneously exist on the router.

To access the system through a local console, attach a terminal to the system console
port. To access the system through Telnet, Telnet client software must be installed
on your host system. To access the system through SSH, SSH version 2.0 client
software must be installed on your host system. To access the system through FTP,
FTP client software must be installed on your host system.

You can configure Telnet to validate login requests. See “Vty Line Authentication and
Authorization” on page 427 in “Managing the System” on page 251 , for more
information. Once Telnet is running on your host system, type in the E Series router
name or its IP address and press Enter. To use a name, your network must have a
name server.

For example, for Microsoft Windows NT enter:

or

You are connected to your E Series router when the following prompt appears:

NOTE: At this point, you have access only to User Exec commands.

To connect through SSH, refer to your SSH client documentation.

Privileged-Level Access

You access the CLI Privileged Exec commands using the enable command.

Defining CLI Levels of Privilege

telnet 192.168.1.13

telnet westford2

Logging in.
host1>

The CLI has the ability to map any command to one of 16 levels of command privilege
(0 to 15). When you access the Privileged Exec mode, you have access to those
commands that map to your access level or below. In other words, if you access the
Privileged Exec mode at access level 10 (the default), you have access to all commands
with an access level setting of 10 or lower.

In general, command privileges fall within one of the following levels:

Accessing the CLI ■ 49

JUNOSe 11.1.x System Basics Configuration Guide

■ 0—Allows you to execute the help, enable, disable, and exit commands

■ 1—Allows you to execute commands in User Exec mode plus commands at level

0

■ 5—Allows you to execute Privileged Exec show commands plus the commands

at levels 1 and 0

■ 10—Allows you to execute all commands except support commands, which may

be provided by Juniper Networks Customer Service, or the privilege command
to assign privileges to commands

■ 15—Allows you to execute support commands and assign privileges to commands

For information about how to set individual command levels, see “CLI Command
Privileges” on page 52.

Accessing the Privileged Exec Level

You can access the Privileged Exec commands using one of 16 levels of command
privilege. If you do not enter a privilege level and you are not accessing the router
through a RADIUS authentication account, the default CLI access level is 10.

enable

To access the default Privileged Exec mode:

1. At the prompt, type enable and press Enter.

host1>enable
Password:

NOTE: You will be prompted for a password only if your system has been configured
with one. Refer to the enable secret and enable password Global Configuration
commands described in “Managing the System” on page 251.

2. Type your password and press Enter.

Password:******<Enter>
host1#

You can tell that you have access to Privileged Exec mode when the command
prompt changes from a > character to a # character.

■ Use to move from User Exec to Privileged Exec mode.

■ Privileged Exec mode allows you to access all other user interface modes. From

here you can configure, monitor, and manage all aspects of the router.

■ You can access the Privileged Exec commands using one of 16 levels of command

privilege. If you do not enter a privilege level and you are not accessing the router
through a RADIUS authentication account, the default CLI access level is 10.

50 ■ Accessing the CLI

Chapter 2: Command-Line Interface

■ Set a password for this mode by using either the enable password or the enable

secret command in Global Configuration mode. This protects the system from
any unauthorized use.

■ Once a password is set, anyone trying to use Privileged Exec mode will be asked

to provide the password.

■ Example 1 (accessing Privileged Exec mode at the default level [10])

host1>enable
password:*******
host1#

■ Example 2 (accessing Privileged Exec mode at the highest level [15]; a password

is not set for this example)

host1>enable 15
host1#

■ There is no no version.

■ See enable.

Moving from Privileged Exec to User Exec Mode

To move from the Privileged Exec mode to the User Exec mode, enter the disable
command. For example:

host1#disable
host1>

NOTE: Using the exit command from either the Privileged Exec or User Exec mode
logs out of the CLI.

To move to a lower Privileged Exec mode, follow the disable command with an
access level value. For example:

host1#show privilege
Privilege level is 10
host1# disable 5
host1#show privilege
Privilege level is 5

disable

Use to exit Privileged Exec mode and return to User Exec mode.■

■ Use to shift to a lower Privilege Exec mode level without returning to User

■ Example 1

Exec mode. Specifying a privilege level after the disable command changes
the Privileged Exec mode to the lower level that you specify; you do not
return to User Exec mode.

Accessing the CLI ■ 51

JUNOSe 11.1.x System Basics Configuration Guide

host1#disable
host1>

■ Example 2

host1#show privilege
Privilege level is 10
host1#disable 5
host1#show privilege
Privilege level is 5

■ There is no no version.

■ See disable.

Logging Out

You can log out of the CLI from either the User Exec and Privileged Exec modes by
entering the exit command. For example:

host1>exit
logging out.

or

host1#exit
logging out.

CLI Command Privileges

You can change the privilege level of most commands by using the privilege
command that is available in Global Configuration mode. To use this command, you
must enable your CLI session to privilege level 15.

CLI Privilege Groups

You can change privilege group accessibility. Privilege groups are no longer required
to be hierarchical. You can modify the privilege group membership and define which
privilege group is a member of another privilege group.

A privilege group can contain commands and other privilege groups as members. A
group always has access to commands in its own privilege group and in privilege
group 0. By default, all groups have one member and a specific privilege group has
access to all commands in all privilege groups with a lower number than the specific
group.

A privilege group is reachable from another privilege group when it is a member of
that privilege group, or a member of a group that is a member of that privilege group
until a search of all member groups is exhausted. This can go through several
recursions as long as there are no circular dependencies.

52 ■ CLI Command Privileges

Chapter 2: Command-Line Interface

Privilege group 0 is not a member of any group and you cannot assign member
groups to it, but it is reachable from every privilege group.

Numbers in the range 0—15 identify the 16 privilege groups. Each of the 16 groups
can have a name or an alias. The default internal name is the privilege group number.
By default, the groups are hierarchical and each group, with the exception of groups
1 and 0, contains one group. When a group contains a group, the contained group
is a member of the original group: privilege group p has one member, privilege group
p-1. For example, privilege group 15 has member 14, privilege group 14 has member
13, and privilege group 2 has member 1.

For hierarchical groups, groups 0 through 14 are reachable from privilege group 15,
groups 0 through 13 are reachable from privilege group 14, groups 0 to 4 are
reachable from 5, and so forth. Hierarchical groups can also contain other privilege
groups. For example, group A is reachable from group B if group A is a member of
group B or is a member of a group that is a member of group B. If group X has
member Y and Y has member Z then Z is reachable from X.

You cannot configure circular dependencies. For example, you cannot configure a
circular dependency where group X has member Y, Y has member Z, Z has member
P, and X can reach Z and P. Group X cannot have member Z or P because Z and P
are reachable through Y.

Examples Using Privilege Group Membership

In each of the following examples, privilege groups are at the default setting, where
privilege group 0 is reachable from every privilege group, 15 contains 14, 14 contains
13, 13 contains 12, and so forth. The commands in each example change the privilege
group settings from the default.

Example 1 host1(config)#privilege-group membership clear 11

host1(config)#privilege-group membership 15 add 10

In Example 1:

■ Privilege group 11 does not contain any privilege groups

■ Privilege group 15 contains group 10. Therefore, privilege group 10 and all groups

contained or reachable from privilege group 10 are now reachable from privilege
group 15.

■ Because privilege group 15 already contains privilege group 14, all groups with

the exception of privilege group 11 are reachable from privilege group 15.

■ A command that is in privilege group 11 can only be executed by a user at

privilege 11. A user at any other privilege does not have access to privilege group
11 commands.

Example 2 host1(config)#privilege-group membership 14 remove 13

In Example 2:

■ Privilege group 14 does not contain any privilege groups.

CLI Command Privileges ■ 53

JUNOSe 11.1.x System Basics Configuration Guide

■ Privilege group 15 contains two groups: 14 and 10. The privilege groups 0, 1, 2,

4, 5, 6, 7, 8, 9, 10, and 14 are reachable from privilege group 15.

■ A user at privilege 15 does not have access to commands in privilege groups 11,

12, or 13.

Example 3 host1(config)#privilege-group membership clear 13

host1(config)#privilege-group membership 13 add 10

In Example 3:

■ Commands are executed in the following sequence: 15 contains 14, 14 contains

13, 13 contains 12, and so forth,

■ Privilege group 13 contains one privilege group: privilege group 10.

■ The privilege groups 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, and 10 are reachable from privilege

group 13.

Example 4 host1(config)#privilege-group membership 12 remove 11

host1(config)#privilege-group membership 12 add 5
host1(config)#privilege-group membership 11 add 5

In Example 4:

■ Commands are executed in the following sequence: 15 contains 14, 14 contains

13, 13 contains 12, and so forth.

■ Privilege group 12 contains one privilege group: the privilege group 5.

■ Privilege group 11 contains one privilege group: the privilege group 5.

■ Privilege groups 0, 1, 2, 3, 4, 5 are reachable from privilege groups 12 and 11.

Example 5 host1(config)#privilege-group membership clear 9 8 7

host1(config)#privilege-group membership 7 add 1
host1(config)#privilege-group membership 8 add 14

In Example 5:

■ Privilege group 9 contains no privilege groups.

■ Privilege group 8 contains group 14.

■ Privilege group 7 contains group 1.

Example 6 host1(config)#privilege-group alias 13 LI

host1(config)#privilege-group alias 10 dailyAdmin
host1(config)#privilege-group alias 7 weekendAdmin
host1(config)#privilege-group alias 6 dailyTroll
host1(config)#privilege-group alias 5 basicUser
host1(config)#privilege-group alias 0 minUser
host1(config)#privilege-group alias 15 superUser

In Example 6, a number or name can specify the seven privilege groups 0, 5, 6, 7,
10, 13, and 15.

54 ■ CLI Command Privileges

Chapter 2: Command-Line Interface

Example 7 host1(config)#privilege-group membership clear dailyAdmin

host1(config)#privilege-group membership dailyAdmin add dailyTroll

In Example 7, privilege group 10 alias dailyAdmin has one member: privilege group
6 alias dailyTroll.

Example 8 host1(config)#no privilege-group membership 9

Example 8 reverts one privilege group membership to its default setting. Prior to the
execution of this command, the following group memberships were in place:

reachablemembergroup

12,0128

0--9

9,0910

10,9,01011

11,10,9,01112

Reverting privilege group 9 to its default gives it one member: privilege group 8. This
creates the circular dependency: 8 contains 12, 12 contains 11, 11 contains 10, 10
contains 9, and 9 contains 8.

Example 9 host1(config)#no privilege-group membership

In Example 9, privilege group membership reverts to the default setting. All privilege
groups revert to hierarchical settings: 15 contains 14, 14 contains 13, 13 contains
12, and so forth. Privilege group 0 is reachable from every privilege group.

Example 10 host1(config)#no privilege-group membership 7

In this example, one privilege group membership reverts to its default setting. Privilege
group 7 contains group 6.

Example 11 host1(config)#no privilege-group alias

In Example 11, all alias settings are removed.

Example 12 host1#show privilege group

privilege privilege directly all
group group reachable reachable
alias groups groups *

---------- ---------- -------- ----------------­0 minUser -- -­1 -- -- 0
2 -- 1 0 1
3 -- 2 0 1 2

CLI Command Privileges ■ 55

JUNOSe 11.1.x System Basics Configuration Guide

4 -- 3 0 1 2 3
5 basicUser 4 0 1 2 3 4
6 dailyTroll 5 0 1 2 3 4 5
7 weekendAdmin 1 0 1
8 -- 14 0 14
9 -- -- 0
10 dailyAdmin 6 0 1 2 3 4 5 6
11 -- 5 0 1 2 3 4 5
12 -- 5 0 1 2 3 4 5
13 LI 10 0 1 2 3 4 5 6 10
14 -- -- 0
15 superUser 10 14 0 1 2 3 4 5 6 10 14 15
*Privilege Group can reach itself

Example 12 shows privilege group overrides in effect.

Example 13 host1#show privilege group 15 superUser

The following groups are directly reachable:
14
dailyAdmin
The following groups are reachable:
1
14
2
3
4
basicUser
dailyAdmin
dailyTroll
minUser

privilege

In Example 13, groups 14 and dailyAdmin are directly reachable and groups 1, 14,
2, 3, 4, basicUser, dailyAdmin, dailyTroll, and minUser are reachable.

■ Use to change the privilege level of any command within a specified mode.

■ Example 1

host1(config)#privilege exec level 12 terminal width

■ Example 2

host1(config)#privilege exec all level 5 terminal

■ Use the all keyword to change the privilege level of groups of commands. For

more information, see “Setting Privilege Levels for Multiple Commands” on
page 59.

■ Use the reset version to restore the default privilege level for the command;

issuing this command results in the show configuration command not showing
the default privilege setting for the command.

■ Use the no version to restore the default privilege level for the command; issuing

this command results in the show configuration command showing the default
privilege level of the command in its output.

56 ■ CLI Command Privileges

NOTE: You must access the CLI at privilege level 15 to view or use this command.

■ privilege

privilege-group alias

■ Use to give the privilege group name alias to the privilege group.

■ Example

■ Use the no version to remove the privilege group alias.

■ See privilege-group alias.

privilege-group membership

Chapter 2: Command-Line Interface

host1(config-if)#privilege-group alias

■ Use to add the member group to or remove the member group from the privilege

group.

■ Example

host1(config-if)#privilege-group membership

■ Use the no version to restore one or all privilege groups to the default settings.

When all privilege groups are reset to the default settings, the privilege group
membership is hierarchical.

■ See privilege-group membership.

privilege-group membership clear

■ Use to clear a privilege group or all members from a privilege group.

■ Example

host1(config-if)#privilege-group membership clear

■ There is no no version.

■ See privilege-group membership clear.

CLI Command Exceptions

Changing command privilege levels can be a powerful security tool. However,
changing the command privilege for some commands could render the CLI unusable
and require you to reboot the router. To eliminate this possibility, the CLI does not
allow you to remap the following commands:

■ disable

■ enable

■ exit

CLI Command Privileges ■ 57

JUNOSe 11.1.x System Basics Configuration Guide

■ help

■ privilege

■ support

CLI Keyword Mapping

You cannot change the privilege level of keywords that are separated from the
command string by a parameter in the command sequence. In other words, once
the privilege algorithm reaches a parameter, the privilege algorithm that maps the
commands to the desired privilege level stops and allows any keyword options that
may follow in the command sequence. The algorithm then waits for a carriage return
before looking at the next command sequence.

For example, you can change the command privilege level for the telnet command.
However, because the telnet command is immediately followed by a variable (that
is, a hostname or IP address) and not a keyword, you cannot change the privilege
level for any keywords that follow the command.

host1#telnet ?
HOSTNAME or A.B.C.D The ip address of the remote system
host1#telnet router2 ?
<0 - 65535> The port on which to send the request
bgp Border Gateway Protocol (179)
chargen Character generator (19)
cmd Remote commands (rcmd, 514)

Setting Privileges for Ambiguous Commands

The privilege command allows you to set command privilege levels for parts of
commands that the CLI would normally consider ambiguous. In other words, you
can set privilege levels by specifying letters that represent only the beginning part
of a command or group of commands (even the first letter of a command or group
of commands).

The following example sets the privilege level to 12 for any Exec mode (user or
privileged) command that start with the letter “ t” :

host1(config)#privilege exec level 12 t

The list of affected commands includes telnet, terminal, test, and traceroute.

The following example changes all the above commands, with the exception of the
traceroute command, to level 15:

host1(config)#privilege exec level 15 te

The following example changes all commands that start with the letters “ te” (for
example, telnet, terminal, and test) and any second keyword that starts with the
letter “ i” and follows a command that starts with the letters “ te” (for example, the
keyword “ ip” in the command test ip) to level 1:

host1(config)#privilege exec level 1 te i

58 ■ CLI Command Privileges

When you enter an ambiguous command and an exact match of the command is
found, partial matches are ignored and are not modified.

For example, the traffic-class and traffic-class-group commands are available in
Global Configuration mode. If you issue the privilege configure level 5 traffic-class
command, an exact match is made to traffic-class, and traffic-class-group is not
modified.

If you want to set the privilege level for both traffic-class and traffic-class-group
and you do not want the exact match to be made to traffic-class, issue a partial
command such as traffic-c. The privilege level of all commands that begin with
traffic-c is modified.

Setting Privilege Levels for no or default Versions

The privilege command allows you to set command privilege levels for no and
default versions of commands. However, setting the privilege level for either the no

or default versions of a command does not set the privilege level of the affirmative
version of the command. This means that you can have the no or default version
of a command at a different privilege level than its affirmative version

Chapter 2: Command-Line Interface

NOTE: You can set the no or default command to a separate privilege level without
specifying any other command to follow. This would force all commands that have
a no or default version to function only for that privilege level and higher.

For example, if you issue the privilege exec level 10 no command, all no versions
in the Privileged Exec mode are available to users at level 10 and higher.

.

Setting Privilege Levels for Multiple Commands

The all keyword is a wildcard parameter that enables you to set privilege levels for
multiple commands rather than setting them individually.

Setting Privilege Levels for All Commands in a Mode

You can set the privilege level for all commands within a specified mode. This setting
includes all commands in modes that you can access from a specified mode.

If the command specified in the privilege command changes the configuration mode,
all commands in the configuration will also be set to the specified privilege level. For
more information about accessing modes, see “Accessing Command Modes” on
page 69.

For example, issuing the configure command in Privileged Exec mode changes the
configuration mode to Global Configuration. If you issue the privilege exec all level
5 configure command, all commands in Global Configuration mode become
accessible to users who have CLI privileges at level 5 and higher. For more information
about user privilege levels, see “Privileged-Level Access” on page 49.

CLI Command Privileges ■ 59

JUNOSe 11.1.x System Basics Configuration Guide

Setting Privilege Levels for a Group of Commands

You can set the privilege level for a group of commands by using the beginning
keyword in a command.

For example, if you issue the privilege configure all level 5 snmp command, all
commands in Global Configuration mode that begin with snmp become accessible
to users who have CLI privileges at level 5 and higher.

Using the Order of Precedence

The effectiveness of a privilege level that is set with the all keyword depends on its
precedence level in the CLI. A privilege level is considered to be in effect only if a
privilege level that is configured at a higher precedence level does not override it.

The CLI uses the following order of precedence:

1. Privilege level set for all commands within a mode, including modes that are

accessed from another mode; for example, Global Configuration mode

2. Privilege level set for all commands that begin with the same keyword; for

example, snmp commands

3. Privilege level set for individual commands; for example, snmp-server

community

NOTE: This order of precedence does not apply to privilege levels that are set without
the all keyword.

In the following example, the privilege level of the snmp-server community command
is set to level 11, the privilege level for all commands that begin with snmp is set to
level 10, and the privilege level for all commands in Global Configuration mode is
set to level 5.

host1(config)#privilege configure level 11 snmp-server community
host1(config)#privilege configure all level 10 snmp
host1(config)#privilege exec all level 5 configure

The following show configuration output displays the privilege levels set above. The
privilege levels for the snmp-server community command and the snmp-server
group of commands are still present in the output. However, the privilege level of
Global Configuration mode takes precedence, and the privilege levels of the other
commands are rendered ineffective. Users can access all snmp commands at level
5 or higher.

host1#show config category management cli command-privileges
privilege configure level 11 snmp-server community
privilege configure all level 10 snmp-server
privilege exec all level 5 configure

60 ■ CLI Command Privileges

Chapter 2: Command-Line Interface

Superseding Privilege Levels with the all Keyword

Issuing the all keyword supersedes privilege levels that were previously set without
the all keyword.

In the following example, the snmp-server-community command is set to level 7,
and the snmp keyword is set to level 6. The privilege level of the snmp keyword
does not override the snmp-server community setting, because both of these
commands are set without the all keyword.

host1(config)#privilege configure level 7 snmp-server community
host1(config)#privilege configure level 6 snmp

All snmp commands are then changed to level 5 with the all keyword.

host1(config)#privilege configure all level 5 snmp

The show configuration output displays all snmp commands at level 5, superseding
the existing level 6 setting. The snmp-server community command is still present
in the show configuration output, but it is ineffective.

host1#show config category management cli command-privileges
privilege configure level 7 snmp-server community
privilege configure all level 5 snmp-server

Removing the all Keyword

Using the no version or reset version removes the all keyword and restores default
privilege levels.

If the privilege setting of the mode or command for which you are restoring default
privilege levels takes precedence over any ineffective privilege settings, those settings
will automatically take effect according to the order of precedence (see “Using the
Order of Precedence” on page 60 ).

The difference between the no version and the reset version is that the reset version
removes the configuration from the show configuration output. This is useful when
you want to remove a configuration that has been overridden and rendered ineffective
by a privilege level that takes precedence.

Setting Default Line Privilege

The factory default privilege level for the console line and all vty lines is 1. However,
you can use the privilege level command in Line Configuration mode to set the
default login privilege for the console line or any number of vty lines.

To change the default privilege level:

1. Access line configuration mode on the router for the console.

host1(config)#line console 0
host1(config-line)#

CLI Command Privileges ■ 61

JUNOSe 11.1.x System Basics Configuration Guide

or on one or more vty lines

host1(config)#line vty 0 12
host1(config-line)#

NOTE: The latter command configures vty lines 0 to 12.

2. Specify a starting privilege level for the line or lines.

host1(config-line)#privilege level 5

The default privilege level for the specified line (or lines) changes. The new values
take effect immediately for any new users. If using the console line, you must
exit out of the CLI and reestablish a connection before the default takes effect.

If you are validating through RADIUS or TACACS+ and the server specifies an
enable level, that enable level takes precedence over the line privilege level.

privilege level

■ Use to change the default privilege level of the console line or one or more vty

lines.

■ Example

host1(config-line)#privilege level 5

■ Use the no or default version to restore the default privilege level for the

command.

NOTE: You must access the CLI at privilege level 15 to view or use this command.

■ See privilege level.

Viewing CLI Privilege Information

You can view CLI privilege information for yourself (the current user), all connected
users on the router, or for any modified CLI commands.

Viewing the Current User Privilege Level

Use the show privilege command to view your current privilege level.

show privilege

■ Use to view your current privilege level.

■ Example

62 ■ CLI Command Privileges

host1#show privilege
Privilege level is 10

Chapter 2: Command-Line Interface

■ There is no no version.

■ See show privilege.

Viewing Privilege Levels for All Connected Users

Use the show users detail command to view the privilege levels for all users currently
connected to the router. See “Monitoring the FTP Server” on page 312 for information
about the show users detail command.

Viewing Privilege Levels for Changed CLI Commands

Use the show configuration command to view the changed privilege levels for any
modified CLI commands. See “Saving the Current Configuration” on page 277 for
information about the show configuration command.

show privilege group

NOTE: The show configuration command output displays output specific to the
session access level. For example, if the session is enabled at level 5, issuing the
show configuration command displays only output for commands at level 5 and
below.

■ Use to view the privilege groups.

■ Example

host1(config-if)#show privilege group superUser
The following groups are directly reachable:
14
dailyAdmin

The following groups are reachable:
1
14
2
3
4
basicUser
dailyAdmin
dailyTroll
minUser

■ There is no no version.

■ See show privilege group.

Using Help

The system CLI provides a variety of useful context-sensitive help features. An
important thing to remember about using the help features is that the use of a space

Using Help ■ 63

JUNOSe 11.1.x System Basics Configuration Guide

or the lack of a space before the ? gives different results. Table 6 on page 64 describes
the help system.

Table 6: Help Commands

DescriptionCommand

Lists all keywords applicable to the current command mode?

Commands listed in the left column of Table 6 on page 64 are further described with
examples in the following sections.

? (Question Mark Key)

You can use the question mark (?) key whenever you need additional information.
When you enter ?, all available choices are displayed. The CLI then redisplays the
command you typed. The following examples show different ways you can use the
? key.

When you use ? on a line by itself or when it is preceded by one or more spaces, a
list of all next available choices is displayed.

Example 1 host1(config)#?

aaa Configure authentication, authorization, and
accounting characteristics
access-list Configure an access list entry
arp Configure a static ARP entry
bandwidth Configure slot-group bandwidth control
banner Define a banner line
baseline Configure baseline operations
boot Configure boot time behavior
bulkstats Configure bulkstats parameters
classifier-list Configure a classifier list entry
clns Configure CLNS characteristics
clock Set the system's clock
confirmations Configure confirmation mode
controller Configure controller parameters
crypto Configure cryptographic parameters
default Set a command to its default(s)
disable-autosync Disable automatic synchronization of redundant
system controller file system
disable-switch-on-error Disable automatic switch to redundant system
controller upon software/hardware error
do Run an exec mode command (alias command run)
enable Configure security related options
end Exit Global Configuration mode

help

partial-keyword<Tab>

Displays a brief description of the help system
(available in all command modes)

Lists the keywords that begin with a certain character stringpartial-keyword?

Completes the partial keyword you entered, if you have provided an
unambiguous abbreviation

Lists the set of all valid next available choicescommand<Space>?

64 ■ Using Help

Chapter 2: Command-Line Interface

exception Configure core dump
exclude-subsystem Exclude copying a subsystem from the release
exit Exit from the current command mode
ftp-server Configure FTP Server characteristics
help Describe the interactive help system
host Add/modify an entry to the host table
hostname Set the host (system) name
interface Enter Interface Configuration mode
ip Configure IP characteristics
l2tp Configure L2TP parameters
license Configure licenses
line Enter Line Configuration mode
log Configure logging settings
macro Run a CLI macro
map-list Create an NBMA static map
memory Configure and administer memory operations
mpls Configure MPLS global parameters
no Negate a command or set its default(s)
ntp Configure the Network Time Protocol
policy-list Enter Policy Configuration mode
pppoe Configure PPPoE
profile Specify a profile
radius Configure RADIUS server
rate-limit-profile Enter rate limit profile configuration mode
redundancy Perform a redundancy configuration
route-map Configure a route map
router Configure a routing protocol
rtr Configure rtr parameters
run Run an exec mode command (alias command do)
service Configure system-level services
set Configure
sleep Make the Command Interface pause for a specified
duration
slot Configure and administer slot operation
snmp-server Configure SNMP parameters
sscc The SSC Client telnet
telnet telnet daemon configuration
timing Configure network timing
traffic-shape-profile Enter traffic shape profile configuration mode
virtual-router Specify a virtual router

Example 2 host1(config)#ip ?

address-pool Configure address pool for PPP Broadband RAS
clients
as-path Configure a path filter for AS-Paths in BGP
bgp-community Format for BGP community
community-list Configure an entry in a community list
debounce-time Specify the minimum amount of time that an event
needs to be in same state before being reported
dhcp-local The DHCP Local Server protocol
dhcp-server DHCP Server for Proxy Client
domain-lookup Enable DNS lookup
domain-name Specify local Domain name
dvmrp configure dvmrp paramaters
dynamic-interface-prefix Specify name prefix for dynamic Ip shared
interfaces
explicit-path Configure an explicit path
extcommunity-list The extended community list
ftp Configure FTP characteristics
http Configure http server
local Local IP address assignment

Using Help ■ 65

JUNOSe 11.1.x System Basics Configuration Guide

multicast-routing Enable IP multicast forwarding
name-server Configure DNS server
pim Configure PIM Protocol
prefix-list Configure a prefix list entry
prefix-tree Configure a prefix tree entry
route Define a static IP route
router-id Configure the router-id to be used
rpf-route Define a static IP route for mcast RPF check
source-route Configure source-routing capabilities
ssh Configure SSH characteristics
ttl Configure the default value to be used by IP for
Time-To-Live
tunnel Configure tunnel parameter
vpn-id Configure the VPN ID associated with this router
vrf Specify a VRF
host1(config)#ip

Example 3 host1(config)#ip community-list ?

<1 - 99> The community list

host1(config)#ip community-list

help Command

When you want to see a list of commands that begin with a particular set of
characters, type a question mark ( ? ) immediately after the last letter. Do not use a
space between the partial keyword and the ? key. For example:

host1#sh?
show shutdown
host1#sh

NOTE: If you want to use the ? character as part of a string, such as a hostname or
a regular expression, you must enter the following key sequence: Ctrl+v+?.
Otherwise, the CLI considers the ? to be a request for assistance in completing the
command.

Use the help command when you want to see a brief description of the
context-sensitive help system.

host1>help
Use the help options as follows:
?, or command<Space>? - Lists the set of all valid next keywords or arguments
partial-keyword? - Lists the keywords that begin with a certain character
string
partial-keyword<Tab> - Completes the partial keyword
host1>

Partial-keyword <Tab>

When you cannot recall a complete command name or keyword, type in the first
few letters, press Tab, and the system completes your partial entry. You must type
enough characters to provide a unique abbreviation. If you type a few letters, press

66 ■ Using Help

Tab, and your terminal beeps, then you have not typed enough characters to be
unambiguous.

host1(config)#int<Tab>
host1(config)#interface

Using Command-Line Editing

This section provides information about the command-line editor.

Basic Editing

Here are a few basic command-line editing notes:

■ Case—Keywords are not case sensitive; that is, they can be entered in uppercase,

lowercase, or a mix of both. Filenames may be case sensitive. Local filenames
are case sensitive; remote filenames are case sensitive if the host system treats
filenames as case sensitive. Passwords are case sensitive.

Chapter 2: Command-Line Interface

■ Abbreviating keywords—You may abbreviate keywords using as few characters

as you want, as long as the characters provide a unique abbreviation.

■ Executing a command—Always use the Enter key.

Command-Line Editing Keys

You can use several keys to edit the command line. Table 7 on page 67 defines the
keys for editing the command line. Arrow keys functions only on ANSI-compatible
terminals, such as VT100s.

Table 7: Command-Line Editing Keys

FunctionKey(s)

Removes characters to left of cursorDelete or Backspace

Moves cursor one character to leftLeft Arrow

Moves cursor one character to rightRight Arrow

Moves cursor to beginning of command lineCtrl+a

Moves cursor back one characterCtrl+b

Deletes character at cursorCtrl+d

Moves cursor to end of command lineCtrl+e

Moves cursor forward one characterCtrl+f

Deletes character to left of cursorCtrl+h

Deletes all characters from cursor to end of command lineCtrl+k

Redisplays system prompt and command lineCtrl+l

Using Command-Line Editing ■ 67

JUNOSe 11.1.x System Basics Configuration Guide

Table 7: Command-Line Editing Keys (continued)

FunctionKey(s)

Toggles overwrite/insert modeCtrl+o

Ctrl+q

Ctrl+v

Ctrl+x

Ctrl+y

Ctrl+z

Resumes a Telnet or console session; use if the Telnet or console session
appears frozen or unresponsive

Suspends a Telnet or console sessionCtrl+s

Transposes character to left of cursor with character located at cursorCtrl+t

Deletes entire command lineCtrl+u

Allows the “ ?” character to be used as a character instead of as a request
for help

Deletes the previous wordCtrl+w

In all modes, reboots the system. This feature is useful if a command is
taking a prolonged time to complete and hangs the console. The command
has no effect if you access the system through Telnet.

Set the boot option flag by using the service ctrl-x-reboot command from
Global Configuration mode.

Recalls most recent entry from delete buffer; recalled characters overwrite
or are inserted in current line depending on overwrite/insert toggle

In all modes except User Exec mode, executes any command typed
immediately before the command sequence and then changes the mode
to Privileged Exec mode. In User Exec mode, only executes any command
typed immediately before the command sequence.

Command History Keys

The CLI maintains two separate command histories. The first command history
maintains only Exec mode commands. The second history maintains all commands
entered in any of the configuration modes. The appropriate history will automatically
be restored as you transition between Global Configuration mode and Exec mode.

Table 8 on page 69 defines the keys related to command history. Arrow keys functions
only on ANSI-compatible terminals, such as VT100s.

68 ■ Using Command-Line Editing

Moves cursor back one wordEsc+b

Deletes previous wordEsc+Backspace

Deletes current or next wordEsc+d

Moves cursor forward one wordEsc+f

Table 8: Command History Keys

FunctionKey

Chapter 2: Command-Line Interface

Pagination Keys

Up Arrow or Ctrl+p

Down Arrow or
Ctrl+n

Ctrl+r

Recalls commands in history buffer, starting with most recent command.
Repeat key sequence to recall successively older commands.

Returns to more recent commands in history buffer after recalling
commands with Up Arrow or Ctrl+p. Repeat key sequence to recall
successively more recent commands.

Begin a reverse search for a previously entered string in the history buffer
by providing a character string when prompted. Enter Ctrl+r to continue
searching. Ctrl+h or Del deletes the last character in the string and starts
a search on the new string.

If the system needs to display more text than you can fit on the screen, the output
pauses and the --More-- prompt appears. Table 9 on page 69 defines the pagination
keys that you can use when the --More-- prompt appears. For more information, see
“The - -More- - Prompt” on page 43.

Table 9: Pagination Keys

FunctionKey

Scrolls down one more lineEnter

Accessing Command Modes

Table 10 on page 70 describes the command modes available in the CLI.

Displays one more screenSpacebar

Displays all output lines that contain the text string+

Displays all output lines that do not contain the text string–

Displays all output lines starting at the first line that contains the text string/

Aborts output and returns you to command promptAny other key

Accessing Command Modes ■ 69

JUNOSe 11.1.x System Basics Configuration Guide

Table 10: Command Mode Overview

Exit from ModeAccess to ModeUse of ModeMode Name

AAA Profile
Configuration

Address Family
Configuration

ATM VC Class
Configuration

Configure new AAA

■

profiles.

Configure BGP or RIP

■

address family
parameters.

Configure a class of

■

attributes for an ATM
data PVC.

From Global

■

Configuration mode,
use aaa-profile
command.

Prompt:

■

host1(config-aaa-profile)#

From Global

■

Configuration mode,
use router bgp or
router rip to enter
Router Configuration
mode. From Router
Configuration, use the
address-family
command.

Prompt:

■

host1(config-router-af)#

From Global

■

Configuration mode,
use the vc-class atm
command, and specify
the name of the VC
class.

Prompt:

■

Use the exit command to

■

return to Global Configuration
mode.

Press Ctrl+z to return to Exec

■

mode.

Use the exit command twice to

■

return to Global Configuration
mode.

Press Ctrl+z to return to Exec

■

mode.

Use the exit command to

■

return to Global Configuration
mode.

Press Ctrl+z to return to Exec

■

mode.

ATM VC Configuration

Configure individual

■

attributes for an ATM
data PVC.

70 ■ Accessing Command Modes

host1(config-vc-class)#

From Global

■

Configuration mode,
use the interface
command to enter
Subinterface
Configuration mode.
From Subinterface
Configuration mode,
use the pvc command.

Prompt:

■

host1(config-subif-atm-vc)#

Use the exit command twice to

■

return to Global Configuration
mode.

Press Ctrl+z to return to Exec

■

mode.