root@srx100B# commit check
error: zone quota exceeded (usage 11 > max 10)
error: configuration check-out failed
18. Ошибки на физическом интерфейсе.
http://networking.ringofsaturn.com/Routers/junipershowint.php
Input errors:
Errors: 0, Drops: 0, Framing errors: 0, Runts: 0, Policed discards: 0, L3 incompletes: 0, L2 channel errors: 0, L2 mismatch timeouts: 0, FIFO errors: 0, Resource errors: 0
Output errors:
Carrier transitions: 5, Errors: 0, Drops: 0, Collisions: 0, Aged packets: 0, FIFO errors: 0, HS link CRC errors: 0, MTU errors: 0, Resource errors: 0
Carrier transitions:
"Carrier transitions just mean the link has flapped. See the exact description from Juniper
Carrier transitions—Number of times the interface has gone from down
to up. This number does not normally increment quickly,
increasing only when the cable is unplugged, the far-end system is
powered down and then up, or another problem occurs. If the number
of carrier transitions increments quickly (perhaps once every 10 seconds),
the cable, the far-end system, or the PIC or PIM is malfunctioning.
You would need to do basic troubleshooting to find out why the link is flapping. Those steps would be different if it was a telco circuit or an P2P ethernet cable."
Input errors:
Errors: 468, Drops: 0, Framing errors: 468, Runts: 0, Policed discards: 71, L3 incompletes: 0, L2 channel errors: 0, L2 mismatch timeouts: 0, FIFO errors: 0, Resource errors: 0
Framing errors:
KB27597
Это ошибка в контрольнной сумме пришедшего на интерфейс пакета, пакет "бьется" и контрольные суммы отправленного и полученно пакета не совпадают.
Решение проблемы с Framing errors заключается в:
-- проверить, что с обоих концов правильно настроены скорость и дуплекс порта.
-- поменять патч-корд
-- поменять порт оборудования
Policed discards: 71
Дропаются протоколы которык не в "security interface host-inbound-traffic protocols". При случае проверить с ospf.
"Frames that the incoming packet match code discarded because they were not recognized or of interest. Usually, this field reports protocols that the JUNOS software does not handle, such as CDP."
17. Скорость создания сессий.
KB23428
root@srx2> show security monitoring fpc ?
Possible completions:
<fpc-slot> FPC slot number (0..0)
root@srx2> show security monitoring fpc 0 ?
Possible completions:
<[Enter]> Execute this command
| Pipe through a command
admin@msk-01-srx2> show security monitoring fpc 0
FPC 0
PIC 0
CPU utilization : 3 %
Memory utilization : 57 %
Current flow session : 469
Current flow session IPv4: 469
Current flow session IPv6: 0
Max flow session : 524288
Total Session Creation Per Second (for last 96 seconds on average): 15
IPv4 Session Creation Per Second (for last 96 seconds on average): 15
IPv6 Session Creation Per Second (for last 96 seconds on average): 0
SNMP OID
root@srx2> show snmp mib walk .1.3.6.1.4.1.2636.3.39.1.12.1.4.1.5
jnxJsNodeSessionCreationPerSecond.0 = 15
Когда два srx работают в режиме кластера в выводе появится строка "jnxJsNodeSessionCreationPerSecond.1 = "
root@srx2> show snmp mib walk .1.3.6.1.4.1.2636.3.39.1.12.1.4.1
jnxJsClusterMonitoringNodeIndex.0 = 0
jnxJsClusterMonitoringNodeDescr.0 = single
jnxJsNodeCurrentTotalSession.0 = 485
jnxJsNodeMaxTotalSession.0 = 0
jnxJsNodeSessionCreationPerSecond.0 = 15
jnxJsNodeSessCreationPerSecIPv4.0 = 15
jnxJsNodeSessCreationPerSecIPv6.0 = 0
jnxJsNodeCurrentTotalSessIPv4.0 = 485
jnxJsNodeCurrentTotalSessIPv6.0 = 0
16. MOTD
Message of the dayset system login message "Privet Serega! NE PEREGRUZHAI srx! Lozhis` spat`=) WBR EKS and Levin."
15. Залить текущий junos на бэкапный раздел.
root@srx-master> request system snapshot slice alternate
node0:
--------------------------------------------------------------------------
Formatting alternate root (/dev/ad0s1a)...
Copying '/dev/ad0s2a' to '/dev/ad0s1a' .. (this may take a few minutes)
The following filesystems were archived: /
node1:
--------------------------------------------------------------------------
Formatting alternate root (/dev/ad0s2a)...
Copying '/dev/ad0s1a' to '/dev/ad0s2a' .. (this may take a few minutes)
The following filesystems were
На кластере можно дать команду только на активной ноде.
14. Перенести кусок конфигурации с одного srx на другой.
Будем переносить записи в address book.
Отображаем конфирацию в set стиле.
[edit security address-book UNTRUST-BOOK]
root@srx-old# show | display set
set security address-book UNTRUST-BOOK address perevod-korona.ru dns-name perevod-korona.ru ipv4-only
set security address-book UNTRUST-BOOK address wupos.westernunion.com dns-name wupos.westernunion.com ipv4-only
...
Подгружаем конфигурацию.
У команды load есть ключ relative который подкружает set не от корня конфигуации, а от текущего места.
{primary:node1}[edit security address-book]
root@srx-new# load set terminal
[Type ^D at a new line to end input]
set security address-book UNTRUST-BOOK address perevod-korona.ru dns-name perevod-korona.ru ipv4-only
set security address-book UNTRUST-BOOK address wupos.westernunion.com dns-name wupos.westernunion.com ipv4-only
set security address-book UNTRUST-BOOK address wupos.westernunion.com dns-name wupos.westernunion.com ipv4-only
...
^D
Нюансы.
Если сразу переносить много конфига, то RE возможно будет не успевать его отрабатывать и будут появляться ошибки вида - "terminal:2:(4) syntax error: address".
Проблема описана в KB15472. Как решить в линуксовом терминале пока не придумал.
Если сидеть на srx через череp minicom, то заливаться будет без ошибок - скорость соединения маленькая.
13. Обновить софт в srx
root> request system software add ?
Possible completions:
<package-name> URL or pathname of package
best-effort-load Load succeeds if at least one statement is valid
delay-restart Don't restart processes
no-copy Don't save copies of package files
no-validate Don't check compatibility with current configuration
partition Format and re-partition the media before installation
reboot Reboot system after adding package
unlink Remove the package after successful installation
validate Check compatibility with current configuration
12. KB25265
http://kb.juniper.net/InfoCenter/index?page=content&id=KB25265
root@srx> ping ocsp.comodoca.com
PING6(56=40+8+8 bytes) :: --> 2a02:1788:2fd::b2ff:5301
ping: sendmsg: No route to host
ping6: wrote ocsp.comodoca.com 16 chars, ret=-1
^C
--- ocsp.comodoca.com ping6 statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
PING ocsp.comodoca.com (178.255.83.1): 56 data bytes
64 bytes from 178.255.83.1: icmp_seq=0 ttl=57 time=79.415 ms
^C
--- ocsp.comodoca.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 79.415/79.415/79.415/0.000 ms
root@srx> show services application-identification application detail | save ai-app-detail
Файл запишется в домашнюю директорию пользователя.
10. Истекли лицензии appid-sig и idp-sig.
root@srx> show system license
License usage:
Licenses Licenses Licenses Expiry
Feature name used installed needed
av_key_kaspersky_engine 1 0 1 28 days
dynamic-vpn 0 2 0 permanent
ax411-wlan-ap 0 2 0 permanent
appid-sig 1 0 1 invalid
- APPID Signature
Все ранее настроенные политики продолждают работать.
Нельзя обновить сигнатуры и верме комита увеличилось секунд на 40.
root@srx# commit
[edit security idp idp-policy Recommended rulebase-ips rule 1 match attacks]
'predefined-attack-groups "[Recommended]IP - Critical"'
Security Package is being used, however license is not valid/has expired. This may be in violation of policy.
commit complete
nested-application my:XAKEP-SSL {
type XAKEP;
protocol SSL;
signature NestedApplication:XAKEP-SSL {
member m01 {
context ssl-server-name;
pattern xakep.ru;
direction client-to-server;
}
maximum-transactions 1;
}
}
maximum-transactions - максимальное количество совпадений с "подписью" при при достижении которого считается, что это именно это приложение.
8. Посмотеть список и детальную информацию по типам приложений с которыми работает AppFW и IDP на srx.
root@srx> show services application-identification application summary
Application(s): 800
Nested Application(s): 981
Applications Disabled ID Order
junos:ZENGUARD-SSL No 1987 33799
junos:FACEBOOK-TIMELINE No 1986 33793
junos:FACEBOOK-STATUS-UPDATE No 1985 33794
junos:GOLFZON-MEMBERS-SSL No 1984 33792
junos:AFREECA-HTTP-STREAM No 1982 33790
....
root@srx> show services application-identification application summary | match HTTP
junos:AFREECA-HTTP-STREAM No 1982 33790
junos:WECHAT-HTTP No 1932 33751
junos:SSH-OVER-HTTP No 1907 33586
junos:YAHOO-FINANCE-HTTP No 1896 33722
junos:AIM-HTTP-API No 1865 33700
junos:ALIWANGWANG-HTTP No 1863 33704
junos:BAIDU-HI-HTTP No 1859 33703
junos:GROOVE-HTTP No 1264 33669
...
root@srx> show services application-identification application detail junos:YAHOO-FINANCE-HTTP
Application Name: junos:YAHOO-FINANCE-HTTP
Application type: YAHOO-FINANCE-HTTP
Description: This signature detects Yahoo! finance, a site from Yahoo! that provides financial news and information.
Application ID: 1896
Disabled: No
Number of Parent Group(s): 1
Application Groups:
junos:web:finance
Application Tags:
characteristic : Bandwidth Consumer
characteristic : Loss of Productivity
risk : 2
subcategory : Finance
category : Web
Signature NestedApplication:YAHOO-FINANCE-HTTP
Layer-7 Protocol: HTTP
Chain Order: no
Maximum Transactions: 1
Order: 33722
Member(s): 1
Member 0
Context: http-header-host
Pattern: (.*\.)?finance\.yahoo\.com
Direction: CTS
7. Посмотреть настройки стантардных junos application
root> show configuration groups junos-defaults applications
6. Посмотреть кто залогинился.
root> show system users no-resolve
5:38PM up 28 days, 2:04, 4 users, load averages: 0.10, 0.06, 0.04
USER TTY FROM LOGIN@ IDLE WHAT
root p0 3:17PM 2:04 cli
root p1 3:03PM 55 cli
root p2 4:21PM 56 cli
root p3 5:31PM - cli
5. Поставить таймаут на ssh/telnet сессию.
root> set cli idle-timeout 60
Idle timeout set to 60 minutes
root> show cli
CLI complete-on-space set to on
CLI idle-timeout set to 60 minutes
CLI restart-on-upgrade set to on
CLI screen-length set to 55
CLI screen-width set to 207
CLI terminal is 'xterm'
CLI is operating in enhanced mode
CLI timestamp disabled
CLI working directory is '/cf/root'
4. Передернуть руками ноду в кластере.
root> request chassis cluster failover redundancy-group [0|1] node [0|1]
Увести RG0 на node1
root> request chassis cluster failover redundancy-group 0 node 1
После этого приоритет node1 для RG0 станет равным 255.
Что бы привести приоритет в соответствие с настройками надо дать комануду:
root> request chassis cluster failover reset redundancy-group 0
После этого, в зависимости от настройки "Preempt", RG0 останется или на node1 или вернется на node0.
3. Сброс конфигурации junos.
[edit]
root# load factory-default
warning: activating factory configuration
[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root# commit
commit complete
2. Сброс пароля для root.
-- Подключиться консолью к маршрутизатору и включить его.
Дождаться "Hit [Enter] to boot immediately, or space bar for command prompt."
и нажать пробел. Появится приглашение "loader>".
-- Загрузиться в single mode.
loader> boot -s
Kernel entry at 0x801000d8 ...
Дождаться "Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh:" и ввести команду "recovery". Ждем приглашения "root>".
NOTE: Once in the CLI, you will need to enter configuration mode using
NOTE: the 'configure' command to make any required changes. For example,
NOTE: to reset the root password, type:
NOTE: configure
NOTE: set system root-authentication plain-text-password
NOTE: (enter the new password when asked)
NOTE: commit
NOTE: exit
NOTE: exit
NOTE: When you exit the CLI, you will be asked if you want to reboot
NOTE: the system
Starting CLI ...
root>
-- Задаем новый пароль root, применяем конфигурацию и перезагружаемся.
root> configure
Entering configuration mode
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root# commit
commit complete
[edit]
root# exit
Exiting configuration mode
root> request system reboot
Reboot the system ? [yes,no] (no) yes
Shutdown NOW!
--
Подробное описание процедуры:
http://www.juniper.net/documentation/en_US/junos13.3/topics/task/configuration/authentication-root-password-recovering.html1. Посмотреть загрузку cpu.
user@srx> show chassis routing-engine
Routing Engine status:
Temperature 57 degrees C / 134 degrees F
Total memory 1024 MB Max 655 MB used ( 64 percent)
Control plane memory 544 MB Max 457 MB used ( 84 percent)
Data plane memory 480 MB Max 202 MB used ( 42 percent)
CPU utilization:
User 4 percent
Background 0 percent
Kernel 10 percent
Interrupt 0 percent
Idle 85 percent
Model
Serial ID
Start time 2015-02-04 19:03:18 GMT-3
Uptime 26 minutes, 6 seconds
Last reboot reason 0x200:normal shutdown
Load averages: 1 minute 5 minute 15 minute
0.07 0.17 0.61
user@srx> show chassis forwarding
FWDD status:
State Online
Microkernel CPU utilization 14 percent
Real-time threads CPU utilization 0 percent
Heap utilization 42 percent
Buffer utilization 1 percent
Uptime: 22 minutes, 39 seconds
Комментариев нет:
Отправить комментарий