Juniper System Management and Monitoring User Manual
System Management and Monitoring
Published
2021-04-18
User Guide
Juniper Networks, Inc.
1133 Innovaon Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. All other trademarks, service marks, registered marks, or registered service
marks are the property of their respecve owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publicaon without noce.
System Management and Monitoring User Guide
Copyright © 2021 Juniper Networks, Inc. All rights reserved.
The informaon in this document is current as of the date on the tle page.
ii
YEAR 2000 NOTICE
Juniper Networks hardware and soware products are Year 2000 compliant. Junos OS has no known me-related
limitaons through the year 2038. However, the NTP applicaon is known to have some diculty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentaon consists of (or is intended for use
with) Juniper Networks soware. Use of such soware is subject to the terms and condions of the End User License
Agreement ("EULA") posted at hps://support.juniper.net/support/eula/. By downloading, installing or using such
soware, you agree to the terms and condions of that EULA.
Table of Contents
1
About This Guide | ix
Manage and Monitor
System Sengs | 2
Specifying the Physical Locaon of the Switch | 2
Modifying the Default Time Zone for a Router or Switch Running Junos OS | 3
Conguring Junos OS to Extend the Default Port Address Range | 4
Conguring Junos OS to Select a Fixed Source Address for Locally Generated TCP/IP Packets | 5
Reboong and Halng a Device | 6
iii
Hostnames | 8
Conguring the Hostname of a Device by Using a Conguraon Group | 8
Mapping the Hostname of the Switch to IP Addresses | 10
Example: Conguring the Name of the Switch, IP Address, and System ID | 10
Understanding and Conguring DNS | 11
DNS Overview | 11
Conguring a DNS Name Server for Resolving Hostnames into Addresses | 12
Congure ICMP Features | 16
Protocol Redirect Messages | 16
Disable the Roung Engine Response to Mulcast Ping Packets | 18
Disable Reporng IP Address and Timestamps in Ping Responses | 18
Congure Junos OS to Ignore ICMP Source Quench Messages | 19
Rate Limit ICMPv4 and ICMPv6 Trac | 20
Rate Limit ICMPv4 and ICMPv6 Error Messages | 20
Alarms | 22
System Alarms | 23
Conguring Junos OS to Determine Condions That Trigger Alarms on Dierent Interface
2
Types | 23
System-Wide Alarms and Alarms for Each Interface Type | 24
System Troubleshoong | 27
Saving Core Files Generated by Junos OS Processes | 27
Viewing Core Files from Junos OS Processes | 28
Device Monitoring | 28
Monitoring System Properes | 29
Monitoring System Process Informaon | 32
Monitoring Interfaces | 33
Other Tools to Congure and Monitor Devices Running Junos OS | 35
iv
Passive Monitoring | 36
Understanding Passive Monitoring | 37
Example: Conguring Passive Monitoring on QFX10000 Switches | 38
Requirements | 38
Overview | 38
Conguraon | 39
Vericaon | 42
How to Locate a Device or Port Using the Chassis Beacon | 45
Turning On the Chassis Beacon For the Default Interval | 46
Turning On the Chassis Beacon For a Specied Interval | 47
Conguraon Statements
checksum | 51
compress-conguraon-les (System) | 53
domain-name | 54
domain-search | 56
enhanced-hash-key | 57
ethernet (Alarm) | 66
hardware-mestamp | 67
host-name | 68
inet (enhanced-hash-key) | 70
inet6-backup-router | 73
inet6 (enhanced-hash-key) | 75
internet-opons | 78
lcd-menu | 83
locaon | 85
locaon (System) | 87
max-conguraons-on-ash | 90
v
menu-item | 91
no-mulcast-echo | 97
no-ping-record-route | 98
no-ping-me-stamp | 99
no-redirects (IPv4 Trac) | 101
oponal | 103
passive-monitor-mode | 104
ports | 106
ports | 108
power | 109
processes | 112
saved-core-context | 115
saved-core-les | 116
stac-host-mapping | 118
me-format | 120
me-zone | 122
3
traceopons (Layer 2 Learning) | 125
traceopons (SBC Conguraon Process) | 129
use-imported-me-zones | 131
Operaonal Commands
clear log | 137
clear chassis display message | 139
clear system commit | 143
clear system reboot | 146
request chassis beacon | 151
vi
request chassis cb | 155
request chassis fabric plane | 160
request chassis fpc | 164
request chassis pic | 172
request chassis roung-engine master | 179
request system halt | 187
request system logout | 196
request system power-o | 198
request system reboot | 205
set chassis display message | 216
set date | 221
show chassis alarms | 223
show chassis beacon | 251
show chassis environment | 254
show chassis environment fpc | 373
show chassis environment pem | 456
show chassis environment power-supply-unit | 478
show chassis environment psu | 480
show chassis environment roung-engine | 482
show chassis ethernet-switch | 494
show chassis fan | 547
show chassis rmware | 566
show chassis fpc | 587
show chassis fabric fpcs | 647
show chassis fabric map | 688
vii
show chassis fabric plane | 699
show chassis fabric plane-locaon | 741
show chassis fabric sibs | 753
show chassis fabric summary | 773
show chassis hardware | 785
show chassis lcd | 807
show chassis led | 828
show chassis locaon | 844
show chassis mac-addresses | 850
show chassis pic | 859
show chassis roung-engine | 897
show chassis temperature-thresholds | 928
show chassis zones | 968
show forwarding-opons enhanced-hash-key | 980
show host | 988
show interfaces diagnoscs opcs | 991
show subscribers | 1001
show system alarms | 1053
show system audit | 1058
show system buers | 1070
show system cercate | 1080
show system commit | 1084
show system connecons | 1089
show system core-dumps | 1099
show system directory-usage | 1119
viii
show system rmware | 1126
show system reboot | 1130
show system soware | 1136
show system stascs | 1141
show system storage | 1159
show system upme | 1169
show system virtual-memory | 1177
show version | 1190
start shell | 1198
test conguraon | 1200
About This Guide
Use this guide to manage and monitor Juniper switches with the Junos OS command line-interface.
ix
1
CHAPTER
Manage and Monitor
System Sengs | 2
Hostnames | 8
Understanding and Conguring DNS | 11
Congure ICMP Features | 16
Alarms | 22
System Troubleshoong | 27
Device Monitoring | 28
Passive Monitoring | 36
How to Locate a Device or Port Using the Chassis Beacon | 45
System Sengs
IN THIS SECTION
Specifying the Physical Locaon of the Switch | 2
Modifying the Default Time Zone for a Router or Switch Running Junos OS | 3
Conguring Junos OS to Extend the Default Port Address Range | 4
Conguring Junos OS to Select a Fixed Source Address for Locally Generated TCP/IP Packets | 5
Reboong and Halng a Device | 6
2
Specifying the Physical Locaon of the Switch
To specify the physical locaon of the switch, specify the following opons for the locaon statement at
the [edit system] hierarchy level:
• altude
• building
enclose it in quotaon marks (" ").
• country-code
• oor
• hcoord
• lata
• latude
• longitude
• npa-nxx
feet
—Number of feet above sea level.
name
—Name of the building, 1 to 28 characters in length. If the string contains spaces,
code
—Two-leer country code.
number
—Floor in the building.
horizontal-coordinate
service-area
degrees
number
—Long-distance service area.
—Latude in degree format.
degrees
—Longitude in degree format.
—First six digits of the phone number (area code and exchange).
—Bellcore Horizontal Coordinate.
• postal-code
• rack
• vcoord
number
vercal-coordinate
postal-code
—Rack number.
—Postal code.
—Bellcore Vercal Coordinate.
The following example shows how to specify the physical locaon of the switch:
[edit system]
location {
altitude feet;
building name;
country-code code;
floor number;
hcoord horizontal-coordinate;
lata service-area;
latitude degrees;
longitude degrees;
npa-nxx number;
postal-code postal-code;
rack number;
vcoord vertical-coordinate;
}
3
SEE ALSO
Example: Conguring the Name of the Switch, IP Address, and System ID
Modifying the Default Time Zone for a Router or Switch Running Junos OS
The default local me zone on the router or switch is UTC (Coordinated Universal Time, formerly known
as Greenwich Mean Time, or GMT).
• To modify the local me zone, include the me-zone statement at the [edit system] hierarchy level:
[edit system]
time-zone (GMT hour-offset | time-zone);
You can use the GMT
hour-oset
is 0. You can congure this to be a value from –14 to +12.
hour-oset
opon to set the me zone relave to UTC (GMT) me. By default,
You can also specify the
me-zone
value as a string such as PDT (Pacic Daylight Time) or WET
(Western European Time), or specify the connent and major city.
NOTE: Junos OS complies with the POSIX me-zone standard, which is counter-intuive to the
way me zones are generally indicated relave to UTC. A me zone ahead of UTC (east of the
Greenwich meridian) is commonly indicated as GMT +n; for example, the Central European Time
(CET) zone is indicated as GMT +1. However, this is not true for POSIX me zone designaons.
POSIX indicates CET as GMT-1. If you include the set system me-zone GMT+1 statement for a
router in the CET zone, your router me will be set to one hour behind GMT, or two hours
behind the actual CET me. For this reason, you might nd it easier to use the POSIX me-zone
strings, which you can list by entering set system me-zone ?.
For the me zone change to take eect for all processes running on the router or switch, you must
reboot the router or switch.
The following example shows how to change the current me zone to America/New_York:
4
[edit]
user@host# set system me-zone America/New_York
[edit]
user@host# show
system {
time-zone America/New_York;
}
SEE ALSO
Understanding NTP Time Servers
Updang the IANA Time Zone Database on Junos OS Devices
Conguring Junos OS to Extend the Default Port Address Range
By default, the upper range of a port address is 5000. You can increase the range from which the port
number can be selected to decrease the probability that someone can determine your port number.
• To congure Junos OS to extend the default port address range, include the source-port statement
at the [edit system internet-opons] hierarchy level:
[edit system internet-options]
source-port upper-limit upper-limit;
5
upper-limit
65,355.
SEE ALSO
upper-limit
is the upper limit of a source port address and can be a value from 5000 through
Congure TCP Opons
Congure ARP Learning and Aging Opons
Conguring Junos OS to Select a Fixed Source Address for Locally
Generated TCP/IP Packets
By default, the source address included in locally generated Transmission Control Protocol/IP (TCP/IP)
packets, such as FTP trac, and in User Datagram Protocol (UDP) and IP packets, such as Network Time
Protocol (NTP) requests, is chosen as the local address for the interface on which the trac is
transmied. This means that the local address chosen for packets to a parcular desnaon might
change from connecon to connecon based on the interface that the roung protocol has chosen to
reach the desnaon when the connecon is established. If mulple equal-cost next hops are present
for a desnaon, locally generated packets use the lo0 address as a source.
• To congure the soware to select a xed address to use as the source for locally generated IP
packets, include the default-address-selecon statement at the [edit system] hierarchy level:
[edit system]
default-address-selection;
If you include the default-address-selecon statement in the conguraon, the Junos OS chooses the
system default address as the source for most locally generated IP packets. The default address is
usually an address congured on the lo0 loopback interface. For example, if you specied that SSH and
telnet use a parcular address, but you also have default-address selecon congured, the system
default address is used.
Reboong and Halng a Device
To reboot the switch, issue the request system reboot command.
user@switch> request system reboot ?
Possible completions:
<[Enter]> Execute this command
all-members Reboot all virtual chassis members
at Time at which to perform the operation
both-routing-engines Reboot both the Routing Engines
fast-boot Enable fast reboot
hypervisor Reboot Junos OS, host OS, and Hypervisor
in Number of minutes to delay before operation
local Reboot local virtual chassis member
member Reboot specific virtual chassis member (0..9)
message Message to display to all users
other-routing-engine Reboot the other Routing Engine
| Pipe through a command
{master:0}
user@switch> request system reboot
Reboot the system ? [yes,no] (no) yes
Rebooting switch
6
NOTE: Not all opons shown in the preceding command output are available on all QFX Series,
OCX Series, and EX4600 switches. See the documentaon for the request system reboot
command for details about opons.
NOTE: When you issue the request system reboot hypervisor command on QFX10000
switches, the reboot takes longer than a standard Junos OS reboot.
Similarly, to halt the switch, issue the request system halt command.
CAUTION: Before entering this command, you must have access to the switch’s console
port in order to bring up the Roung Engine.
user@switch> request system halt ?
Possible completions:
<[Enter]> Execute this command
all-members Halt all virtual chassis members
at Time at which to perform the operation
backup-routing-engine Halt backup Routing Engine
both-routing-engines Halt both Routing Engines
in Number of minutes to delay before operation
local Halt local virtual chassis member
member Halt specific virtual chassis member (0..9)
message Message to display to all users
other-routing-engine Halt other Routing Engine
| Pipe through a command
7
NOTE: When you issue this command on an individual component in a QFabric system, you will
receive a warning that says “Hardware-based members will halt, Virtual Junos Roung Engines
will reboot.” If you want to halt only one member, use the member opon. You cannot issue this
command from the QFabric CLI.
Issuing the request system halt command on the switch halts the Roung Engine. To reboot a Roung
Engine that has been halted, you must connect through the console.
SEE ALSO
clear system reboot
request system halt
request system power-o
Connecng a QFX Series Device to a Management Console
RELATED DOCUMENTATION
Disable Reporng IP Address and Timestamps in Ping Responses
Hostnames
IN THIS SECTION
Conguring the Hostname of a Device by Using a Conguraon Group | 8
Mapping the Hostname of the Switch to IP Addresses | 10
Example: Conguring the Name of the Switch, IP Address, and System ID | 10
8
Conguring
The hostname of a Junos OS or Junos OS Evolved device is its idencaon. A network device must
have its identy established to be accessible on the network. That is perhaps the most important reason
to have a hostname, but a hostname has other purposes.
The soware uses the congured hostname as part of the command prompt and to prepend log les and
other accounng informaon. The hostname is also used anywhere else when knowing the device
identy is important. For these reasons, we recommend hostnames be descripve and memorable.
You can congure the hostname at the [edit system] hierarchy level, a procedure shown in
Device’s Unique Identy for the Network
system] hierarchy level, you can use a conguraon group, as shown in this procedure. This is a
recommended best pracce for conguring the hostname, especially if the device has dual Roung
Engines. This procedure uses groups called re0 and re1 as an example.
NOTE: Starng with Junos OS Release 13.2R3, if you congure hostnames that are longer than
the CLI screen width, regardless of the terminal screen width seng, the commit operaon
occurs successfully. Even if the terminal screen width is less than the hostname length, commit is
successful.
In Junos OS releases earlier than Release 13.2R3, if you congured such hostnames by using the
host-name
width was less than the length of the hostname by using the set cli screen-width statement, a
foreign le propagaon (p) failure error message is displayed when you aempt to commit the
conguraon. In such a case, because of the p failure, the commit operaon does not complete
the Hostname of a Device by Using a Conguraon Group
Conguring a
. Oponally, instead of conguring the hostname at the [edit
hostname
statement at the [edit system] hierarchy level and the the terminal screen
and you cannot recover the router unless you make the modicaon in the backend in the
juniper.conf.gz le and commit the change from the shell prompt.
To set the hostname using a conguraon group:
9
1. Include the host-name statement in the conguraon at the [edit groups
group-name
system
hierarchy level.
The name value must be less than 256 characters.
[edit groups group-name system]
host-name hostname;
For example:
[edit groups re0 system]
root@# set host-name san-jose-router0
[edit groups re1 system]
root@# set host-name san-jose-router1
2. If you used one or more conguraon groups, apply the conguraon groups, substung the
appropriate group names.
For example:
[edit]
user@host# set apply-groups [re0 re1]
3. Commit the changes.
[edit]
root@# commit
The hostname subsequently appears in the device CLI prompt.
san-jose-router0#
Mapping the Hostname of the Switch to IP Addresses
To map a hostname of a switch to one or more IP addresses, include the inet statement at the [edit
system stac-host-mapping
[edit system]
static-host-mapping {
hostname {
inet [ addresses ];
alias [ aliases ];
}
}
hostname
] hierarchy level:
10
hostname
is the name specied by the host-name statement at the [edit system] hierarchy level.
For each host, you can specify one or more aliases.
SEE ALSO
Conguring a DNS Name Server for Resolving Hostnames into Addresses
Conguring a Device’s Unique Identy for the Network
stac-host-mapping
Example: Conguring the Name of the Switch, IP Address, and System ID
The following example shows how to congure the switch name, map the name to an IP address and
alias, and congure a system idener:
[edit]
user@switch# set system host-name switch1
[edit]
user@switch# set system stac-host-mapping switch1 inet 192.168.1.77
[edit]
user@switch# set system stac-host-mapping switch1 alias sj1
[edit]
user@switch# set system stac-host-mapping switch1 sysid 1921.6800.1077
[edit]
user@switch# show
system {
host-name switch-sj1;
static-host-mapping {
switch-sj1 {
inet 192.168.1.77;
alias sj1;
sysid 1921.6800.1077;
}
}
}
Understanding and Conguring DNS
11
IN THIS SECTION
DNS Overview | 11
Conguring a DNS Name Server for Resolving Hostnames into Addresses | 12
DNS Overview
IN THIS SECTION
DNS Components | 12
DNS Server Caching | 12
A Domain Name System (DNS) is a distributed hierarchical system that converts hostnames to IP
addresses. The DNS is divided into secons called zones. Each zone has name servers that respond to
the queries belonging to their zones.
This topic includes the following secons:
DNS Components
DNS includes three main components:
• DNS resolver: Resides on the client side of the DNS. When a user sends a hostname request, the
resolver sends a DNS query request to the name servers to request the hostname's IP address.
• Name servers: Processes the DNS query requests received from the DNS resolver and returns the IP
address to the resolver.
• Resource records: Data elements that dene the basic structure and content of the DNS.
DNS Server Caching
DNS name servers are responsible for providing the hostname IP address to users. The TTL eld in the
resource record denes the period for which DNS query results are cached. When the TTL value expires,
the name server sends a fresh DNS query and updates the cache.
12
SEE ALSO
Conguring the TTL Value for DNS Server Caching
Conguring a DNS Name Server for Resolving Hostnames into Addresses
Domain Name System (DNS) name servers are used for resolving hostnames to IP addresses.
Before you begin, congure your name servers with the hostname and an IP address for your Juniper
Networks device. It does not maer which IP address you assign as the address of your device in the
name server, as long it is an address that reaches your device. Normally, you would use the management
interface IP address, but you can choose the loopback interface IP address, or a network interface IP
address, or even congure mulple addresses on the name server.
For redundancy, it is a best pracce to congure access to mulple name servers. You can congure a
maximum of three name servers. The approach is similar to the way Web browsers resolve the names of
a Web site to its network address. Addionally, the soware enables you to congure one or more
domain names, which it uses to resolve hostnames that are not fully qualied (in other words, the
domain name is missing). This is convenient because you can use a hostname in conguring and
operang the soware without the need to reference the full domain name. Aer adding name server
addresses and domain names to your conguraon, you can use DNS resolvable hostnames in your
conguraons and commands instead of IP addresses.
Oponally, instead of conguring the name server at the [edit system] hierarchy level, you can use a
conguraon group, as shown in this procedure. This is a recommended best pracce for conguring the
name server.
Starng in Junos OS Release 19.2R1, you can route trac between a management roung instance and
DNS name server. Congure a roung instance at the [edit system name-server
server-ip-address
]
hierarchy level and the name server becomes reachable through this roung instance.
NOTE: This management roung instance opon is not supported for SRX Series devices.
To enable a management roung instance for DNS, congure the following:
user@host# set system management-instance
user@host# set routing-instances mgmt_junos description description
user@host# set system name-server server-ip-address routing-instance mgmt_junos
13
If you have congured the name server using a conguraon group, use the [edit groups
group-name
system name-server] hierarchy level, which is a recommended best pracce for conguring the name
server.
To congure the device to resolve hostnames into addresses:
1. Reference the IP addresses of your name servers.
[edit groups group-name system]
name-server {
address;
}
The following example shows how to reference two name servers:
[edit groups global system]
user@host# set name-server 192.168.1.253
user@host# set name-server 192.168.1.254
user@host# show
name server {
192.168.1.253/32;
192.168.1.254/32;
}
2. (Oponal) Congure the roung instance for DNS.
The following example shows how to congure the roung-instance for one of the name servers:
[edit groups global system]
user@host# set name-server 192.168.1.253 roung-instance mgmt_junos
Remember to also congure the following:
• management-instance statement at the [edit system] hierarchy level
• roung-instance statement at the [edit roung-instances] hierarchy level.
3. (Oponal) Congure the name of the domain in which the device itself is located.
This is a good pracce. The soware then uses this congured domain name as the default domain
name to append to hostnames that are not fully qualied.
14
[edit system]
domain-name domain-name;
The following example shows how to congure the domain name:
[edit groups global system]
user@host# set domain-name company.net
user@host# show
domain-name company.net;
4. (Oponal) Congure a list of domains to be searched.
If your device can reach several dierent domains, you can congure these as a list of domains to be
searched. The soware then uses this list to set an order in which it appends domain names when
searching for the IP address of a host.
[edit groups global system]
domain-search [ domain-list ];
The domain list can contain up to six domain names, with a total of up to 256 characters.
The following example shows how to congure two domains to be searched. This example congures
the soware to search the company.net domain and then the domainone.net domain and then the
domainonealternate.com domain when aempng to resolve unqualied hosts.
[edit groups global system]
domain-search [ company.net domainone.net domainonealternate.com ]
5. If you used a conguraon group, apply the conguraon group, substung global with the
appropriate group name.
[edit]
user@host# set apply-groups global
6. Commit the conguraon.
15
user@host# commit
7. Verify the conguraon.
If you have congured your name server with the hostname and an IP address for your device, you
can issue the following commands to conrm that DNS is working and reachable. You can either use
the congured hostname to conrm resoluon to the IP address or use the IP address of your device
to conrm resoluon to the congured hostname.
user@host> show host
user@host> show host
host-name
host-ip-address
For example:
user@host> show host device.example.net
device.example.net
device.example.net has address 192.168.187.1
user@host> show host 192.168.187.1
10.187.168.192.in-addr.arpa domain name pointer device.example.net.
SEE ALSO
name-server (System Services)
domain-search
RELATED DOCUMENTATION
Understanding Hostnames
DNSSEC Overview
Congure ICMP Features
16
IN THIS SECTION
Protocol Redirect Messages | 16
Disable the Roung Engine Response to Mulcast Ping Packets | 18
Disable Reporng IP Address and Timestamps in Ping Responses | 18
Congure Junos OS to Ignore ICMP Source Quench Messages | 19
Rate Limit ICMPv4 and ICMPv6 Trac | 20
Rate Limit ICMPv4 and ICMPv6 Error Messages | 20
Learn more about how to congure Internet Control Message Protocol (ICMP) features.
Protocol Redirect Messages
IN THIS SECTION
Understanding Protocol Redirect Messages | 17
Disable Protocol Redirect Messages | 17
ICMP redirect, also known as protocol redirect, is a mechanism used by switches and routers to convey
roung informaon to hosts. Devices use protocol redirect messages to nofy the hosts on the same
data link of the best route available for a given desnaon. All EX series switches support sending
protocol redirect messages for both IPv4 and IPv6 trac.
NOTE: Switches do not send protocol redirect messages if the data packet contains roung
informaon.
Understanding Protocol Redirect Messages
Protocol redirect messages inform a host to update its roung informaon and to send packets on an
alternate route. Suppose a host tries to send a data packet through a switch S1 and S1 sends the data
packet to another switch, S2. Also, suppose that a direct path from the host to S2 is available (that is, the
host and S2 are on the same Ethernet segment). S1 then sends a protocol redirect message to inform the
host that the best route for the desnaon is the direct route to S2. The host should then send packets
directly to S2 instead of sending them through S1. S2 sll sends the original packet that it received from
S1 to the intended desnaon.
17
Refer to RFC-1122 and RFC-4861 for more details on protocol redirecng.
Disable Protocol Redirect Messages
By default, devices send protocol redirect messages for both IPv4 and IPv6 trac. For security reasons,
you may want to disable the device from sending protocol redirect messages.
To disable protocol redirect messages for the enre device, include the no-redirects or no-redirects-
ipv6 statement at the [edit system] hierarchy level.
• For IPv4 trac:
[edit system]
user@host# set no-redirects
• For IPv6 trac:
[edit system]
user@host# set no-redirects-ipv6
To re-enable the sending of redirect messages on the device, delete the no-redirects statement (for IPv4
trac) or the no-redirects-ipv6 statement (for IPv6 trac) from the conguraon.
To disable protocol redirect messages on a per-interface basis, include the no-redirects statement at
the [edit interfaces
• For IPv4 trac:
[edit interfaces interface-name unit logical-unit-number]
user@host# set family inet no-redirects
• For IPv6 trac:
[edit interfaces interface-name unit logical-unit-number]
user@host# set family inet6 no-redirects
interface-name
unit
logical-unit-number
family
family
] hierarchy level.
18
Disable the Roung Engine Response to Mulcast Ping Packets
By default, the Roung Engine responds to ICMP echo requests sent to mulcast group addresses. By
conguring the Roung Engine to ignore mulcast ping packets, you can prevent unauthorized persons
from discovering the list of provider edge (PE) devices in the network.
To disable the Roung Engine from responding to these ICMP echo requests, include the no-
multicast-echo statement at the [edit system] hierarchy level:
[edit system]
no-multicast-echo;
Disable Reporng IP Address and Timestamps in Ping Responses
When you issue the ping command with the record-route opon, the Roung Engine displays the path
of the ICMP echo request packets and the mestamps in the ICMP echo responses by default. By
conguring the no-ping-record-route and no-ping-mestamp opons, you can prevent unauthorized
persons from discovering informaon about the provider edge (PE) device and its loopback address.
You can congure the Roung Engine to disable the seng of the record-route opon in the IP header
of the ping request packets. Disabling the record-route opon prevents the Roung Engine from
recording and displaying the path of the ICMP echo request packets in the response.
To congure the Roung Engine to disable the seng of the record route opon, include the no-ping-
record-route statement at the [edit system] hierarchy level:
[edit system]
no-ping-record-route;
To disable the reporng of mestamps in the ICMP echo responses, include the no-ping-time-stamp
opon at the [edit system] hierarchy level:
[edit system]
no-ping-time-stamp;
19
Congure Junos OS to Ignore ICMP Source Quench Messages
By default, the device reacts to Internet Control Message Protocol (ICMP) source quench messages. To
ignore ICMP source quench messages, include the no-source-quench statement at the [edit system
internet-options] hierarchy level:
[edit system internet-options]
no-source-quench;
To stop ignoring ICMP source quench messages, use the source-quench statement:
[edit system internet-options]
source-quench;
Rate Limit ICMPv4 and ICMPv6 Trac
To limit the rate at which ICMPv4 or ICMPv6 messages can be generated by the Roung Engine and
sent to the Roung Engine, include the appropriate rate liming statement at the [edit system
internet-options] hierarchy level.
• For IPv4:
[edit system internet-options]
icmpv4-rate-limit bucket-size bucket-size packet-rate packet-rate
• For IPv6:
[edit system internet-options]
icmpv6-rate-limit bucket-size bucket-size packet-rate packet-rate
20
Rate Limit ICMPv4 and ICMPv6 Error Messages
IN THIS SECTION
Why to Rate Limit ICMPv4 and ICMPv6 Error Messages | 21
How to Rate Limit ICMPv4 and ICMPv6 Error Messages | 21
By default, ICMP error messages for non-l-expired IPv4 and IPv6 packets are generated at the rate of
1 packet per second (pps). You can adjust this rate to a value that you decide provides sucient
informaon for your network without causing network congeson.
NOTE: For l-expired IPv4 or IPv6 packets, the rate for ICMP error messages is not congurable.
It is xed at 500 pps.
Why to Rate Limit ICMPv4 and ICMPv6 Error Messages
An example use case for adjusng the rate limit is a data center providing web services. Suppose this
data center has many servers on the network that use jumbo frames with an MTU of 9100 bytes when
they communicate to hosts over the Internet. These other hosts require an MTU of 1500 bytes. Unless
maximum segment size (MSS) is enforced on both sides of the connecon, a server might reply with a
packet that is too large to be transmied across the Internet without being fragmented when it reaches
the edge router in the data center.
Because TCP/IP implementaons oen have Path MTU Discovery enabled by default with the dontfragment bit set to 1, a transit device will drop a packet that is too big rather than fragmenng it. The
device will return an ICMP error message indicang the desnaon was unreachable because the packet
was too big. The message will also provide the MTU that is required where the error occurred. The
sending host should adjust the sending MSS for that connecon and resend the data in smaller packet
sizes to avoid the fragmentaon issue.
At high core interface speeds, the default rate limit of 1 pps for the error messages may not be enough
to nofy all the hosts when there are many hosts in the network that require this service. The
consequence is that outbound packets are silently dropped. This acon can trigger addional
retransmissions or back-o behaviors, depending on the volume of requests that the data center edge
router is handling on each core-facing interface.
21
In this situaon, you can increase the rate limit to enable a higher volume of oversized packets to reach
the sending hosts. (Adding more core-facing interfaces can also help resolve the problem.)
How to Rate Limit ICMPv4 and ICMPv6 Error Messages
Although you congure the rate limit at the [edit chassis] hierarchy level, it is not a chassis-wide limit.
Instead, the rate limit applies per interface family. This means, for example, that mulple physical
interfaces congured with family inet can simultaneously generate the ICMP error messages at the
congured rate.
NOTE: This rate limit takes eect only for trac that lasts 10 seconds or longer. The rate limit is
not applied to trac with a shorter duraon, such as 5 seconds or 9 seconds.
• To congure the rate limit for ICMPv4, use the icmp statement:
[edit chassis]
user@host# set icmp rate-limit
rate-limit
Starng in Junos OS Release 19.1R1, the maximum rate increased from 50 pps to 1000 pps.
Loading...