JunOS (juniper) experts chime in!

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
Can anybody give a quick comparison of basic syntax/operational differences betwee JunOS and IOS?

Basic things like configuration, where images are stored/how they are loaded, basic hardware/interfaces on the medium/high-end routers, etc?

thanks in advance. Looks like I may have to learn it very quickly. As in a day or two quickly.
 

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
dammit! Feed me!

I feed you guys for years and I can't even get a bite?

cmetz, c'mon...chime in!
 

jlazzaro

Golden Member
May 6, 2004
1,743
0
0
all in one guide for their M and T routers...this references version 6.2, not sure what the current one is http://cygnus.cc.ncu.edu.tw/netflow/juniper/swconfig-system-basics/

some interesting facts giving it a quick skim:

JunOS Software:

The primary copy of the software is installed on a nonrotating flash drive. Two backup copies are included, one on the router's rotating hard disk and a second on the removable media (either an LS-120 floppy disk [a 120-MB disk] or a PC Card) that is shipped with the router.

When the router boots, it first attempts to start the software image from the removable media if one is installed in the router. If this fails, the router next tries the flash drive, then finally the hard disk. Normally, you want the router to boot from the flash drive.

To upgrade the software, you copy a set of software images over the network to the router's flash drive using SCP or another similar utility. The JUNOS software set consists of three images, one for the software processes, a second for the kernel, and the third for the Packet Forwarding Engine. You normally upgrade all images simultaneously.


JunOS default username is "root" instead of "cisco"

unlike IOS, you have to commit changes in order for them to take effect. once it is commited, the file is checked for syntax, activated, and marked as current. previously committed versions are always maintained...

from what ive read / heard, the CLI is one of the best. definately capable...i guess thats why most ISP's run them instead of Cisco. i just recently migrated most of our network over to Verizons vBNS service (MPLS), it runs 100% juniper.
 

jorken

Golden Member
Oct 9, 1999
1,143
3
81
Configurations are not applied to an interface.

Interfaces are applied to a config.
 

Genx87

Lifer
Apr 8, 2002
41,091
513
126
I have two of their netscreen firewall devices. I dont have any information but will say once you get to know it, they are very nice devices.

 

Cooky

Golden Member
Apr 2, 2002
1,408
0
76
jlazzaro, how did you find that guide? Did you work for that college at some point?

Genx87, I too have used Netscreen firewalls before but I'm not sure they're similar to JunOS.
The Netscreens are too complicated to be managed in CLI...
 

cmetz

Platinum Member
Nov 13, 2001
2,296
0
0
spidey07, have you ever used gated? If so, the config syntax might look a little familiar.

Basically, you start life with a BSD getty prompt, but logging in with the right username and password runs a shell named "cli" and you'll never have to know there's a BSD underneath. show commands look similar enough to Cisco and there's help including the Cisco-like ? which will get you surprisingly far.

configuration - you type "config" to enter config mode. From there, it's all "edit <foo>" where <foo> is the config nesting statement you want to edit, and it drops you into that config nesting level.

Config syntax is nested. This is like some parts of an IOS config but much more so. So you'll have something like this:

protocols {
ospf {
area 0.0.0.0 {
interface fpx0.0 {
blah;
}
}
}
}

and you can "edit protocols", "edit protocols ospf" etc., and move up/down levels.

Here's the cool part. This alone is worth buying Juniper over Cisco for. You go edit stuff and make changes. Then, once you're done, you run "commit". That's the point where your config changes actually effect state changes in the running system, NOT when you edit one particular line. Who here hasn't been burned badly by gear that has complex configurations where multiple lines of the config interrelate, but the box executes every line when you enter it? Juniper gets this right.

But wait, there's more! You have pretty much a full RCS/CVS underneath storing the config. You can do 'rollback' to revert to the previous version, and you can do things like see the diff and log of the config file - who did what when, it's all kept in the history. No more config changes that break things that nobody admits to having done.

JunOS was built to be more multiprotocol from the start, so get used to having to tell it that you intend a certain bit of configuration bet interpreted as IPv4 (or just IP) config. You might not be used to that.

Otherwise, it's really not hard. The way the config files work is definitely different from everything you've used before, but once you pick it up it's not difficult to work with and the way that JunOS does it is really that much better. The config syntax itself is different, but it's not hard to pick up, there are manuals and examples out there and ?-help will get you far. If you know networking already and can configure something like IOS, you can figure out the JunOS way to do it - same concepts, just a bit different syntax. The JunOS syntax has the advantage of starting from scratch cleanly, while with IOS you have to memorize a lot of quirks (so is that a forward or reverse netmask?).

I have been told by folks at several large ISPs who use a lot of JunOS boxes that the introduction of those boxes and training the staff, while it had to be an organized program and all that, went very smoothly. People who already know IOS can pick it up quickly as long as they're willing to learn, and many folks end up liking JunOS better.

Incidentally, if you've been around in the networking business, you've learned how Cisco are bold liars about performance specifications on your boxes, and how you have to over-engineer your networks to compensate. From what I've seen, Juniper is honest about their specs and you can actually design your network based on them. It makes network design much easier. They have the usual kinds of interfaces you're used to, various speeds of POS and Ethernet and such. The only thing you can't get from Juniper last I checked is any Ethernet L2-switching capability, like the Cisco EtherSwitch modules. They're L3+ boxes only.

If you have specific questions, feel free to ask. It's kinda hard to explain how to use a box in a post.

FYI all, Netscreen products are completely different from JunOS products and as far as I know share no code. Netscreen products have a horrid CLI.

Hardware wise, you get a chassis, power supplies, routing engine (CPU), and usually you use Flexible PIC Concentrator (FPC) line cards into which you stick Physical Interface Card (PIC) modules. I guess theoretically there are line cards that go directly into the slots but in practice it's all PICs. If you're buying today's gear in the M series it's pretty straightforward; there's legacy modules that have wacky limitations. I think the T series and J series are also straightforward but have no experience with them.

The M7i and M10i are a bit wacky in that there's a NP daughtercard (advanced services or something) that is either built-in or it's not and it can't be added later, and it's an expensive added-cost option. So check what features you need and see if you need that. I think it does things like some kinds of firewall/NAT stuff and some kinds of billing stuff, and maybe some IDS kinds of stuff. When I looked into it last it was all stuff I didn't want a core router to do. I believe there's an equivalent card for the bigger boxes that can be added later.

There was a huge gap in performance between the top of the J-series and the M7i. They appear to have newer/faster '50' J-series boxes that might close this gap. This was a big problem for me, because a lot of the needs I have that a Juniper box could fill nicely fall in the range between 100Mb/s and 1000Mb/s of real capacity.

jlazzaro, different models have different storage. I think they stopped putting in hard drives and LS120 drives, could be wrong about that. I think they used something like the M-Systems Disk-On-Chip devices as the boot flash originally, and now they probably use CF. I don't get to touch JunOS boxes currently, too many of my customers are total Cisco zealots (one vendor's sales people wine and dine the executives, and one hardly calls you back. Guess which one gets pushed hard by the executive staff?).

Juniper getting into Verizon was a big deal. I think the MCI/Worldcom/UUNet acquisition smoothed that a bit. With some of VZ's newer offerings like their MPLS services and FIOS, VZ has needs that Cisco doesn't have boxes at all well suited for, and so I think they pretty much had to do it. In general, though, Verizon is a heavily Cisco shop and I believe that is a management/cultural thing.

As far as ISPs in general having Juniper boxes, there was a period where Cisco fumbled badly at the high-end, and while Cisco kept trying to sell expensive routers and line cards that couldn't go much faster, Juniper delivered the performance levels that the carriers wanted. That was a big driver for Juniper. The ISPs who stayed Cisco-only in that time period couldn't scale their backbones, or at least had to do complex engineering and use more boxes of less density. Cisco has improved, but they retain a well deserved reputation for underengineering their products.
 

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
Thanks a bunch for a great post cmetz. Makes things more clear.

As an aside I have "heard" from a MPLS god-like friend of mine that junipers MPLS is much better than cisco. Less buggy.

And what in the world does "foo" have to do with unix? Why is it thrown about so often by unix guys?

Also, I've never touched cisco's CRS. Possibly it uses the superior "make changes, then commit them approach". There some other really good stuff coming out for the 6500 switch line and it's software, but I'm under NDA so I can't talk.
 

cmetz

Platinum Member
Nov 13, 2001
2,296
0
0
spidey07, it's telling that Cisco's MPLS implementation isn't as good as Juniper's, because MPLS is basically just Cisco's tag-switching... it's Cisco's invention.

"foo" and "bar" are metavariables from "fubar." It's actually a TMRC thing I think, but it's common in the *IX hacker culture. (hacker in the good sense, not the black hat sense) Sort of like you can spot the old FORTRAN hacks from using i and j as iterators.

I've never touched CRS either, but I believe that IOSng suffers from a bad case of second system effect. It's perpetually coming out for a lot of boxes, but I'll believe it when I see it and I'm frankly a bit skeptical that it's that much better. CRS the hardware platform I think was a poor product marketing job. There aren't many folks who want multi-cabinet anything, most folks want higher density in the same form factor they have (for big boxes, about a half rack). Maybe they were trying to copy Avici's huge success or something.

Cisco talks about the 6500 line like it can do no wrong, and a lot of Cisco shops love 'em, but I think they're total garbage. I've been burned by hardware and software problems on basically every 6500 I've touched or has been adjacent to my gear. If I hear 6500, I know what the problem is (or is going to be). Cisco really, really, REALLY needs to dump the 6500 platform and ground-up replace it with something that works. But I doubt they are on that page, because they're always coming out with upgrades for the platform instead.
 

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
cmetz, from cisco's perspective the 6500 isn't going anywhere. It their bread and butter in the enterprise arena.
 

cmetz

Platinum Member
Nov 13, 2001
2,296
0
0
Yes, I know. Like I said, cisco talks about the 6500 like it can do no wrong. As far as I can tell, they make a lot of profit of those boxes.
 

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
Originally posted by: cmetz
Yes, I know. Like I said, cisco talks about the 6500 like it can do no wrong. As far as I can tell, they make a lot of profit of those boxes.

Highest profit margin of their entire products. Fact.

I won't argue, it has some serious architectural problems. But it isn't going anywhere. You don't take your money maker and change it. You just tell the customer to constantly upgrade their chassis so they don't have to go through the nightmare or replacing the switch.
 

Goosemaster

Lifer
Apr 10, 2001
48,775
3
81
Originally posted by: jlazzaro
Originally posted by: jorken
Configurations are not applied to an interface.

Interfaces are applied to a config.

insanity i tell you!

seriously:Q




Anyone know of any training software like Boson [sic]?

Also, anyone know the value of entry juniper vs entry level to mid-cisco certs?
I've always been interested in them as well...
 

InlineFive

Diamond Member
Sep 20, 2003
9,599
2
0
Originally posted by: Goosemaster
Also, anyone know the value of entry juniper vs entry level to mid-cisco certs?
I've always been interested in them as well...

I'm no expert by any means but I think the Cisco certs are still good to have because of the market prevalence.
 

jlazzaro

Golden Member
May 6, 2004
1,743
0
0
couldnt compare the entry level certs, but the CCIE ISP and JNCIE are comparable. Same concepts and material, just on different routers with different syntax.

the problem with the JNCIE is that the equipment is so expensive hardly anyone could afford to build a home lab. unless your company has Juniper equipment, I would imagine self-studying being very difficult.
 

BunLengthHotDog

Senior member
Feb 21, 2003
728
0
76
I work in a production environtment that contains all 3 of the big guys...Cisco, Juniper and Redback (which is less of a big boy).

Redback is by far my favorite production router, its concept of virtual routers within the one router (see "contexts") makes VPN's and MPLS configurations much easier to maintain (we have thousands to look after, fun fun). We use Redback SE800's for PPP termination points on all of our DSL VPN clients, and they have pretty much been bulletproof since turn-up. They are also going to make up the vast majority of our DSL2 platform, when that gets rolled out

Anyhow back to the OP...like cmetz mentioned, JUNOS is based on Free-BSD, so if your familiar...its a cakewalk. Being that I WASN'T used to BSD and was proficient with Cisco devices, it took me quite a while to get used to working in the JUNOS (we have M-160's as our peering points, and T-640's as our aggregation boxes) environment. To give you an idea, our traditional setup is a Cisco 12K as an area Interexchange box (aggregation for a pariticular city) handing all the traffic off to the t-640 to aggregate, and the Juniper boxes can handle the load just fine. Right now we have 6 points of exit from our network if I remember correctly, so each T-640 is aggregating traffic from 12 (2 Cisco 12K's in each regional area for failover) Cisco 12k's without so much as a hiccup. They obviously are subject to their fair share of bugs (FPC's and PIC issues) but less often than the Cisco equivalent.

I can also attest to the fact that its much easier to navigate and configure boxes with Junos once you get used to poking around. I was the case study for the scenario cmetz mentioned, Cisco and Redback experience...what are these Juniper things. Now, I loathe seeing an issue on a Cisco box because the whole Junos model is just so well thought out. I don't know if cmetz mentioned "commit confirm" specifically, but that command by itself has saved many a job around here. It basically requires you to commit your changes twice....say you make a config change that completely knocks you out of the box, if you use commit confirm....you have to commit again for the change to be permenant, once a certain time period rolls around (I think default is 5 minutes) the router automagically rolls back to the previous config since it never received a 2nd "commit", granting you access once again to get in and fix whatever issue you were working on.

Regarding certs, Cisco is still the defacto as many enterprise solutions still heavily rely on Cisco devices (I HATE 6500's, damn MSFC2 and Sup Modules) as Juniper is just starting to break into the non-ISP market. One thing that is annoying however, having a Juniper in your Core (we also use them as provider edge boxes for dedicated circuit customers) pretty much renders ICMP useless at that particular hop. Most Juniper boxes have a protect_re filter built into them that places processing ICMP packets on the backplane until the router damn well pleases to process the packet...frequently just dropping it. Pings and traces look horrible when traversing a "busy" Juniper router.

It's fun convincing customers that pings and traces just arent what they used to be.

Ninja Edit : I forgot to mention logging

We don't typically use a syslog server on our Cisco devices, so the buffers on our logs are typically only a few days old at best, which makes researching possible issues that much more fun. Junipers have taking logging and made it a science...here are the possibilities for logs you can look over to see what was done, or happened in a standard Juniper router:

UDP_BLOCK
aprobed
apsd
bfdd
bgp-log
bgp-log.0.gz
bgp-log.1.gz
bgp-log.2.gz
bgp-log.3.gz
bgp-log.4.gz
bgp-log.5.gz
bgp-log.6.gz
bgp-log.7.gz
bgp-log.8.gz
chassisd
chassisd.0.gz
cleanup-pkgs
commits
cosd
dcd
dfwc
dfwd
eccd
flowc/
fsad.trace
fud
ggsn/
httpd
ilmid
install
install.0.gz
install.1.gz
irsd.server.trace.0.gz
irsd.server.trace.1.gz
irsd.trace
kmd
ksyncd
l2tpd_cfg
ldp-log
ldp-log.0.gz
lmpd
mastership
messages
messages.0.gz
messages.1.gz
messages.10.gz
messages.2.gz
messages.3.gz
messages.4.gz
messages.5.gz
messages.6.gz
messages.7.gz
messages.8.gz
messages.9.gz
mib2d
nasd
ospf-log.0.gz
ospf-log.1.gz
ospf-log.2.gz
ospf-log.3.gz
pccardd.debug
pf
pgmd
ppmd
rdd
rmopd
rtspd
rtspd.0.gz
sdxd
security <------ Very nice to have..all commands run on the box in log format
security.0.gz
security.1.gz
security.10.gz
security.2.gz
security.3.gz
security.4.gz
security.5.gz
security.6.gz
security.7.gz
security.8.gz
security.9.gz
snapshot
snmpd
spd
user
utmp
vrrpd
wtmp
wtmp.0.gz
wtmp.1.gz
wtmp.2.gz
wtmp.3.gz
wtmp.4.gz
wtmp.5.gz

Think of show log messages as your Cisco "show log"...you have 10 of those logs available here. They are definitely nice routers.
 

cmetz

Platinum Member
Nov 13, 2001
2,296
0
0
BunLengthHotDog, it's modern carrier best practice to send ICMP error packets such as TTL exceeded at priority last, and on top of that to additionally rate shape. You need the former in order to prevent those errors from becoming a significant load on the routing engine (as routers get faster, the delta between the fast path and slow path gets bigger) and you need the latter in order to prevent your box from becoming an attack reflector or at least generating a lot of unnecessary traffic (imagine the dumb VoIP-ish sender who just keeps on spraying UDP packets even if every one causes an ICMP error. If that sender ignored the first ten ICMP errors, chances are the next hundred don't need to be reliably delivered!).

This is not Juniper specific. You're supposed to do it on Cisco boxes, too. It's just that on most Cisco boxes, enabling the QoS features needed to implement this processing causes more of a slowdown in practice than just not doing it and taking the possible ICMP-related performance hit if somebody does something naughty. Juniper has good QoS in the hardware to begin with, so pretty much all Juniper sites will do this QoS handling from the start. With all Cisco boxes I've worked with, you can have good QoS xor good performance, so if you can avoid turning QoS on you do.

IP is not reliable. Folks often forget that.
 

BunLengthHotDog

Senior member
Feb 21, 2003
728
0
76
I agree its best to process ICMP last, its just a minor annoyance having to convince customers that literally CLING to pings and traces as the be-all, end-all of troubleshooting. It's hilarious to see customers beg and plead to be moved over to a Cisco PE so they can have their precious pings back. We do not have the same feature activated on our Cisco routers, at least not yet.
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |