JNCIA-Junos cheat sheet

OSI layers bottom to top: 1 Physical, 2 Data Link, 3 Network, 4 Transport, 5 Session, 6 Presentation, 7 Application.

IPv4 addresses are 32 bits written as four dotted-decimal octets; IPv6 addresses are 128 bits written in hexadecimal.

Private IPv4 space: 10.0.0.0/8, 172.16.0.0/12 (172.16-172.31), 192.168.0.0/16; these ranges are not routable on the public internet.

Usable hosts = 2^host bits minus 2. A /24 yields 254 hosts; a /30 yields 2, the usual choice for point-to-point links.

Subnet masks: /24 = 255.255.255.0, /25 = 255.255.255.128, /26 = 255.255.255.192, /27 = 255.255.255.224.

A MAC address is 48 bits written as 12 hexadecimal digits; the first 24 bits are the OUI identifying the vendor.

ARP resolves a known IPv4 address to a MAC address inside a broadcast domain; IPv6 uses Neighbor Discovery (NDP) for the same job.

TCP is connection-oriented (SYN, SYN-ACK, ACK) with sequencing and retransmission; UDP is connectionless with no delivery guarantee.

Well-known ports 0-1023 include TCP 22 SSH, 23 Telnet, 25 SMTP, 80 HTTP, 443 HTTPS and UDP 53 DNS, 161 SNMP.

Junos separates the control plane (Routing Engine builds the routing table) from the forwarding plane (Packet Forwarding Engine forwards transit traffic).

Transit traffic is forwarded in hardware by the PFE and never traverses the Routing Engine, so RE CPU load does not limit forwarding throughput.

Junos OS is FreeBSD-based and modular: mgd (management), rpd (routing protocols), chassisd (chassis), dcd (interfaces) and alarmd run as separate daemons.

Top-level configuration hierarchy: system, chassis, interfaces, protocols, policy-options, firewall, routing-options, security.

Configuration edits go to the candidate configuration; the commit command validates it and copies it into the active configuration.

If a commit fails, the previously active configuration stays in effect and traffic is unaffected.

Configuration files on the device: /config/juniper.conf.gz (active) and juniper.conf.1.gz through juniper.conf.3.gz (rollback versions), plus rescue.conf.gz.

Junos supports commit scripts, op scripts and event scripts for automation, and commit confirmed for safe remote changes.

Two Routing Engines operate as master and backup; Graceful Routing Engine Switchover (GRES) preserves forwarding state across failover.

The operational mode prompt ends with '>'; the configuration mode prompt ends with '#'.

configure enters configuration mode; exit configuration-mode or commit and-quit returns to operational mode.

Hierarchy navigation uses edit , top, up and exit; '?' lists every valid completion at the current level.

Output filters: | match pattern, | except pattern, | find pattern, | count, | last , | no-more.

help topic and help reference display CLI usage and syntax information.

Screen controls: set cli screen-length 0 disables paging, set cli timestamp prefixes output with date and time, set cli screen-width adjusts width.

start shell enters the underlying FreeBSD shell; exit returns to the Junos CLI. file list, file show and file copy manage files on the device.

configure exclusive locks the candidate for one user only; configure private gives each user an independent candidate configuration.

set adds or modifies a configuration statement; delete removes it; show displays the candidate configuration.

commit check validates the candidate for syntax and semantic errors without activating it; commit applies it.

commit and-quit applies the candidate and returns to operational mode in a single step.

commit confirmed activates the configuration and automatically rolls back unless a confirming commit is issued within the timeout.

rollback 1 loads the previous committed configuration into the candidate; rollback 0 discards uncommitted edits; rollback ? lists saved versions.

'show | compare' displays candidate-versus-active differences; 'show configuration | display set' renders the configuration as set commands.

Configuration groups: define statements under set groups ..., then inherit them with set apply-groups .

load merge adds to the candidate, load replace replaces matching hierarchy only, and load override replaces the entire configuration.

annotate "text" attaches a comment to a configuration statement and is preserved in the saved configuration.

show interfaces terse gives one line per interface with admin/link state and addresses; show interfaces extensive gives full detail.

monitor interface displays live traffic and error counters refreshed continuously until Ctrl-C is pressed.

show route, show route summary, show route detail and show route forwarding-table inspect RIB and FIB contents.

show log messages reads /var/log/messages; show log reads other files; append | last to see the newest entries.

show version, show system uptime, show chassis routing-engine, show chassis alarms and show system alarms report device health.

request system reboot restarts the device and request system power-off halts it; both accept 'in ' for scheduling.

request system snapshot copies the running root and /config partitions to the alternate partitions as a backup.

monitor traffic interface captures packets tcpdump-style; ping and traceroute test reachability sourced from the Routing Engine.

request support information collects a diagnostic bundle of logs, configuration and state for technical support.

Junos routing table names: inet.0 (IPv4 unicast), inet.3 (MPLS/IPv4 next hops), inet6.0 (IPv6 unicast), iso.0 (IS-IS).

Route selection order: longest prefix match, then lowest preference, then lowest metric, then configured tie-breakers.

Junos preference values (lower wins): connected 0, static 5, OSPF internal 10, RIP 100, OSPF external 150, BGP 170.

Only active routes are installed into the forwarding table (FIB) that the Packet Forwarding Engine uses to forward packets.

Static route example: set routing-options static route 10.1.0.0/16 next-hop 192.168.1.1; the next hop must be reachable or qualify-next-hop is required.

IGPs (OSPF, IS-IS, RIP) exchange routes within one administrative domain; EGPs (BGP) exchange routes between autonomous systems.

OSPF is link-state with areas and a backbone area 0; RIP is distance-vector with a 15-hop limit.

eBGP peers use different AS numbers and normally need a directly connected or multihop session; iBGP peers share the same AS.

show route protocol ospf, show ospf neighbor and show bgp summary verify protocol operation and adjacency state.

A policy-statement is an ordered list of terms; each term has from (match) conditions and then (action) clauses.

Policy actions: accept, reject, next term, next policy, plus attribute modifications such as metric, local-preference and community.

If no term matches, a routing policy accepts the route by default; an explicit reject term is required to block unmatched routes.

Policies are attached as import or export, e.g. set protocols bgp group G export POLICY or set routing-options forwarding-table export POLICY.

A firewall filter is an ordered list of terms; a packet takes the action of the first term whose from conditions it matches.

Filter actions: accept, discard (silent drop), reject (drop plus ICMP unreachable or TCP reset), count, log, policer, next term.

A firewall filter ends with an implicit discard, so an explicit final accept term is required to pass remaining traffic.

Firewall filters are stateless and applied per interface and per direction under family inet filter input|output.

Protect the Routing Engine by applying a filter to the loopback: set interfaces lo0 unit 0 family inet filter input F.