Node Slicing on the MX960 - Juniper Networks · Node Slicing on the MX960 1. Initial Preparation A. Juniper Software Packages There are three software packages required for implementing

Node Slicing on the MX960 Configuration Guide

March 2018

© 2018 Juniper Networks, Inc. 2

Node Slicing on the MX960

Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, California 94089 USA 408-745-2000 www.juniper.net

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

The information in this document is current as of the date on the title page.

Copyright © 2018, Juniper Networks, Inc. All rights reserved.

http://www.juniper.net/



Contents Overview ................................................................................................................................................................... 4

1. Initial Preparation ............................................................................................................................................... 5

A. Juniper Software Packages ............................................................................................................................ 5

B. Downloading Software ................................................................................................................................... 5

C. Server ......................................................................................................................................................... 5

i. Requirements Verification .......................................................................................................................... 5

ii. BIOS Settings ............................................................................................................................................. 8

iii. Install Pre-Requisite Packages ................................................................................................................... 8

iv. Install JDM ............................................................................................................................................... 10

v. Initial JDM Configuration .......................................................................................................................... 10

vi. Verifying JDM Processes ......................................................................................................................... 11

2. Create GNFs ................................................................................................................................................... 12

A. BSYS ........................................................................................................................................................... 12

B. JDM ............................................................................................................................................................. 13

I. Configure Server to BSYS Interfaces ....................................................................................................... 13

ii. Creating GNF RE VMs ............................................................................................................................. 14

iii. Connecting to GNF RE ............................................................................................................................. 16

iv. Verification on BSYS ................................................................................................................................ 17

3. Configure Topology ......................................................................................................................................... 18

A. AF Interfaces ................................................................................................................................................ 18

B. Verification ................................................................................................................................................... 20

i. AF Interfaces ............................................................................................................................................ 20

ii. Other show Commands ............................................................................................................................ 21

Configuration Files .................................................................................................................................................. 23

gnf1.cfg ............................................................................................................................................................... 23

gnf1-init.cfg.......................................................................................................................................................... 34

gnf2.cfg ............................................................................................................................................................... 37

gnf5.cfg ............................................................................................................................................................... 43

bsys-mx1-node-slicing.cfg ................................................................................................................................... 49



Overview

Junos Node Slicing partitions a single MX chassis into multiple independent routers, each with its own control, data, and management planes. For more background, please refer to https://www.juniper.net/documentation/en_US/junos/topics/concept/node-slicing-understanding.html

The diagram below shows the various components of Node Slicing and represents the logical view of the configuration used in the later sections. Each node slice, called a Guest Network Function (GNF), is comprised of a routing engine (RE) and one or more line cards in the MX chassis. The routing engine is a Junos VM that runs on an external Linux server and is managed by Juniper Device Manager (JDM) software.

The Base System (BSYS) represents the physical MX chassis including line cards, fabrics, and routing engines. The BSYS maps the line cards to each GNF.

Enabling communication between the GNF RE and the FPCs are two 10G Ethernet connections between the Linux server and the MX chassis’ SCBE2 fabric SFP+ ports. In this example, each GNF has a single RE since there is only one server. However, a second server can be used to provide redundancy.

In this scenario, the BSYS is an MX960 chassis containing four FPCs and SCBE2 control boards, which are required for Node Slicing. Note that CB0 port 0 and CB1 port 0 are both populated with a 10G SFP+ optic.

jnpr@MX1> show chassis hardware | match "FPC|Engine|CB|SR" Routing Engine 0 REV 07 740-031116 9009108746 RE-S-1800x4 Routing Engine 1 REV 10 740-031116 9013076454 RE-S-1800x4 CB 0 REV 03 750-055976 CAEK4339 Enhanced MX SCB 2 Xcvr 0 REV 01 740-021308 88D709A00140 SFP+-10G-SR CB 1 REV 03 750-055976 CAEP4876 Enhanced MX SCB 2 Xcvr 0 REV 01 740-031980 AHN06UT SFP+-10G-SR CB 2 REV 01 750-055976 CACS7420 Enhanced MX SCB 2 FPC 1 REV 36 750-056519 CAFE6325 MPC7E 3D MRATE-12xQSFPP-XGE-XLGE-CGE FPC 2 REV 06 750-063181 CAGH0860 MPC3E NG PQ & Flex Q FPC 4 REV 06 750-063181 CAGC6686 MPC3E NG PQ & Flex Q FPC 5 REV 06 750-063181 CAGD3676 MPC3E NG PQ & Flex Q

https://www.juniper.net/documentation/en_US/junos/topics/concept/node-slicing-understanding.html



1. Initial Preparation

A. Juniper Software Packages There are three software packages required for implementing Node Slicing:

1) Base System (BSYS) - this is the software running on the physical MX chassis. It is standard Junos software.

2) Juniper Device Manager (JDM) - this is a Linux software package for either Ubuntu or CentOS. It is a Linux container that is used to configure the environment for connectivity to the MX chassis and to orchestrate (i.e. create, delete, modify) the GNF RE VMs.

3) GNF RE Image - this refers to the Junos RE image used to create the VM on the server.

B. Downloading Software Obtain each of these software packages from the Juniper support site: https://www.juniper.net/support/downloads/solutions/jns/

• On the physical MX router, install the Base System software using the standard Junos software installation procedure. For demonstration purposes there is no need to obtain a license since the Node Slicing license is honor-based. For this example, the chassis is running a pre-release version of 17.4R1 software.

• Download the JDM software to the home directory on the Linux host. The steps below install JDM after some prerequisite applications and steps. For this example, the released version 17.2R1 of JDM is used.

• Download the GNF RE image to the /var/third-party/images directory on the Linux server. JDM references this software when creating the Routing Engine VMs on the Linux host. The name of this file starts with “junos-install-ns-mx-x86-…” and in this example matches the BSYS version. However, note that one of the attributes of Node Slicing is the ability for each GNF to run a different version of Junos, which can be higher than the BSYS version by up to 2 versions.

C. Server i. Requirements Verification Verify that the server meets the requirements for Node Slicing documented here: https://www.juniper.net/documentation/en_US/junos/topics/reference/general/node-slicing-sw-hw-requirements.html Software The software version is Ubuntu 16.04 LTS which meets documented requirements:

root@Ubuntu-test:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.3 LTS Release: 16.04 Codename: xenial

Hardware CPU The CPU is model Intel Xeon E5-2630 v4 which is a Broadwell-EP-based Xeon dual microprocessor according to

https://www.juniper.net/support/downloads/solutions/jns/

https://www.juniper.net/documentation/en_US/junos/topics/reference/general/node-slicing-sw-hw-requirements.html

https://www.juniper.net/documentation/en_US/junos/topics/reference/general/node-slicing-sw-hw-requirements.html



https://en.wikipedia.org/wiki/List_of_Intel_Xeon_microprocessors. This CPU model is newer than the minimum required Intel Haswell CPU. The 2 CPU sockets each provide 10 cores and 20 threads for a total of 40 CPUs.

root@Ubuntu-test:~# lshw -class cpu *-cpu:0 description: CPU product: Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz vendor: Intel Corp. physical id: 3 bus info: cpu@0 version: Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz slot: Socket 1 size: 1201MHz capacity: 4GHz width: 64 bits clock: 100MHz capabilities: x86-64 fpu fpu_exception wp vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdseed adx smap xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts cpufreq configuration: cores=10 enabledcores=10 threads=20 *-cpu:1 description: CPU product: Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz vendor: Intel Corp. physical id: 7 bus info: cpu@1 version: Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz slot: Socket 2 size: 1240MHz capacity: 4GHz width: 64 bits clock: 100MHz capabilities: x86-64 fpu fpu_exception wp vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdseed adx smap xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts cpufreq configuration: cores=10 enabledcores=10 threads=20

Memory The server contains 256G of memory.

root@Ubuntu-test:~# lshw -class memory *-memory description: System memory physical id: 0 size: 250GiB

https://en.wikipedia.org/wiki/List_of_Intel_Xeon_microprocessors



Hard drive The server contains a 1 TB hard drive

root@Ubuntu-test:~# lshw -class disk *-disk description: SCSI Disk product: ServeRAID M1215 vendor: IBM physical id: 2.0.0 bus info: scsi@0:2.0.0 logical name: /dev/sda version: 4.62 serial: 000877790dff06682130cf240cb00506 size: 930GiB (998GB) capabilities: gpt-1.00 partitioned partitioned:gpt configuration: ansiversion=5 guid=5de61f0d-e5ac-443b-9136-0c6f781edeaa logicalsectorsize=512 sectorsize=512

Network Two 10G interfaces are required on the server. These interfaces connect to the MX’s SCBE2 10G ports. In this example interfaces ‘ens4f0’ and ‘ens4f1’ are used:

root@Ubuntu-test:~# lshw -class network | more *-network:0 description: Ethernet interface product: Ethernet Controller X710 for 10GbE SFP+ vendor: Intel Corporation physical id: 0 bus info: pci@0000:06:00.0 logical name: ens4f0 version: 01 serial: 68:05:ca:43:68:64 size: 10Gbit/s width: 64 bits clock: 33MHz capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet physical fibre configuration: autonegotiation=off broadcast=yes driver=i40e driverversion=1.4.25-k duplex=full firmware=5.04 0x80 0024ec 1.1313.0 latency=0 link=yes multicast=yes port=fibre speed=10Gbit/s resources: irq:57 memory:91800000-91ffffff memory:90ff8000-90ffffff memory:90f00000-90f7ffff memory:38000300000-38 0006fffff memory:38000100000-380001fffff *-network:1 description: Ethernet interface product: Ethernet Controller X710 for 10GbE SFP+ vendor: Intel Corporation physical id: 0.1 bus info: pci@0000:06:00.1 logical name: ens4f1 version: 01 serial: 68:05:ca:43:68:65 size: 10Gbit/s <snip>



ii. BIOS Settings There are few BIOS settings on the server that may need modification before proceeding. Under “Processors”, ensure that Hyper-Threading is disabled:

Under “Operating Modes”, ensure that performance mode is enabled:

iii. Install Pre-Requisite Packages Python Utilities Install the python utilities package:

root@Ubuntu-test:~# apt install python-psutil Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: libpython-stdlib libpython2.7-minimal libpython2.7-stdlib python python-minimal python2.7 python2.7-minimal Suggested packages: python-doc python-tk python-psutil-doc python2.7-doc binutils binfmt-support The following NEW packages will be installed: libpython-stdlib libpython2.7-minimal libpython2.7-stdlib python python-minimal python-psutil python2.7 python2.7-minimal



<snip>

Disable AppArmor Disable the Ubuntu AppArmor service and then reboot the server:

root@Ubuntu-test:~# systemctl stop apparmor root@Ubuntu-test:~# systemctl disable apparmor apparmor.service is not a native service, redirecting to systemd-sysv-install Executing /lib/systemd/systemd-sysv-install disable apparmor insserv: warning: current start runlevel(s) (empty) of script `apparmor' overrides LSB defaults (S). insserv: warning: current stop runlevel(s) (S) of script `apparmor' overrides LSB defaults (empty). root@Ubuntu-test:~# reboot

Install KVM and Libvirt Once the server comes back up, install KVM and libvirt.

root@Ubuntu-test:~# apt install qemu-kvm Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: cpu-checker ipxe-qemu libaio1 libasound2 libasound2-data libasyncns0 libbluetooth3 libboost-iostreams1.58.0 libboost-random1.58.0 libboost-system1.58.0 libboost-thread1.58.0 libbrlapi0.6 libcaca0 libcacard0 libfdt1 libflac8 libiscsi2 libjpeg-turbo8 libjpeg8 libnspr4 libnss3 libnss3-nssdb libogg0 libopus0 libpixman-1-0 libpulse0 librados2 librbd1 libsdl1.2debian libsndfile1 libspice-server1 libusbredirparser1 libvorbis0a libvorbisenc2 libxen-4.6 libxenstore3.0 libyajl2 msr-tools qemu-block-extra qemu-system-common qemu-system-x86 qemu-utils seabios sharutils <snip> root@Ubuntu-test:~# apt install libvirt-bin Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: augeas-lenses bridge-utils cgmanager ebtables libaugeas0 libavahi-client3 libavahi-common-data libavahi-common3 libcgmanager0 libnetcf1 libnih-dbus1 libnl-route-3-200 libpciaccess0 libvirt0 libx86-1 libxml2-utils libxslt1.1 pm-utils vbetool <snip>

Install Monit Install ‘monit’ which monitors Linux services:

root@Ubuntu-test:~# apt install monit Reading package lists... Done Building dependency tree Reading state information... Done Suggested packages: exim4 | postfix | mail-transport-agent sysvinit-core The following NEW packages will be installed: monit <snip>



iv. Install JDM Make sure to download JDM to the server. The version of JDM is 17.2R1 which was released along with BSYS versions 17.2 and 17.3. Please check with your Juniper sales engineering representative as newer versions of JDM will contain several enhancements. Note that typically the JDM version will match the Base System software version.

root@Ubuntu-test:~# ls -l total 314692 -rw-r--r-- 1 root root 322240736 Oct 6 05:47 jns-jdm-1.0-0-17.2R1.13.x86_64.deb

Install the JDM package:

root@Ubuntu-test:~# dpkg -i jns-jdm-1.0-0-17.2R1.13.x86_64.deb Selecting previously unselected package jns-jdm. (Reading database ... 62055 files and directories currently installed.) Preparing to unpack jns-jdm-1.0-0-17.2R1.13.x86_64.deb ... Unpacking jns-jdm (1.0-0) ... Setting up jns-jdm (1.0-0) ... Installing /var/.tmp-jdm-install/juniper_ubuntu_04002017.tgz... Configure /junos/lxc/jdm/jdm1/rootfs... Configure /junos/lxc/jdm/jdm1/rootfs DONE Setup Junos cgroups...Done Done Setup jdm

v. Initial JDM Configuration Slot Number Two servers can be used for redundancy so the first thing to configure in JDM is the slot number assigned to the server. This is similar to the number assigned to REs in a physical MX chassis, 0 and 1. In this example there is only one server so the server is assigned slot number “0”.

root@Ubuntu-test:~# jdm start server=0 Starting jdm: Domain jdm defined from /junos/lxc/jdm/current/config/jdm.xml Domain jdm started

Verify that the JDM container is running:

root@Ubuntu-test:~# virsh -c lxc:/// list --all Id Name State ---------------------------------------------------- 20956 jdm running root@Ubuntu-test:~# ps aex | grep "linux container" 20958 ? Ss 0:00 /sbin/init PATH=/bin:/sbin TERM=linux container=lxc-libvirt HOME=/ container_uuid=fe72dfde-32db-41f9-80cd-66116e43252f LIBVIRT_LXC_UUID=fe72dfde-32db-41f9-80cd-66116e43252f LIBVIRT_LXC_NAME=jdm <snip>

Check the status of JDM:

root@Ubuntu-test:~# jdm status jdm (pid 20956) is running..



Root Password Connect to the JDM console using the ‘jdm console’ command. Login as “root” and type “cli” to enter operational mode. Note that the JDM CLI is similar to the Junos CLI.

Ubuntu 14.04.1 LTS jdm tty1 jdm login: root -bash: ulimit: core file size: cannot modify limit: Invalid argument root@jdm:~# cli root@jdm> show version Hostname: jdm Model: junos_node_slicing JDM package version : 1.0-0 JUNOS version : 17.2R1.13-secure Host Software [Ubuntu 16.04.3 LTS] JDM container Software [Ubuntu 14.04.1 LTS]

Enter configuration mode and set the root password and save changes. Note: currently JDM supports the root user administration account only. If redundant servers are used, the JDM root password must be the same on both servers. The JDM root password overrides the Linux host root password.

root@jdm> configure Entering configuration mode [edit] root@jdm# show | display set set version "17.2R1.13-secure [dc-builder]" set system services ssh set system services netconf ssh set system services netconf rfc-compliant [edit] root@jdm# set system root-authentication plain-text-password New password: Retype new password: [edit] root@jdm# commit and-quit commit complete Exiting configuration mode

Exit the console session (press ‘Ctrl-]’). Then connect to JDM via SSH:

root@Ubuntu-test:~# ssh jdm The authenticity of host 'jdm (192.168.2.253)' can't be established. ECDSA key fingerprint is SHA256:Iht13X6e31FO3wc4BYAimG/PdRlyhQX5WABvwG2dl78. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'jdm,192.168.2.253' (ECDSA) to the list of known hosts. Last login: Thu Oct 12 00:38:24 2017 -bash: ulimit: core file size: cannot modify limit: Invalid argument root@jdm:~#

At this point the JDM can be used to create the VMs required for the GNFs.

vi. Verifying JDM Processes The ‘jdmd’ process uses ‘libvirt’ to manage VMs:



root@Ubuntu-test:~# ps -aux | grep jdm root 20956 0.0 0.0 118208 9640 ? S 00:36 0:00 /usr/lib64/libvirt/libvirt_lxc --name jdm --console 26 --security=none --handshake 29 --veth vnet1 --veth vnet3 --veth vnet5 --veth vnet7 --veth vnet9 root 22966 0.0 0.0 883984 26324 ? S 00:37 0:00 /usr/sbin/jdmd -N

The ‘mgd’ daemon provides CLI/NETCONF interfaces for configuration. The ‘jinventoryd’ reports the state of system resources, and ‘jlinkmon’ is used to monitor the connections from the server to the MX chassis:

root@Ubuntu-test:~# ps -aux | grep mgd root 22964 0.0 0.0 729180 5552 ? Ss 00:37 0:00 /usr/sbin/mgd root 23197 0.0 0.0 14224 1012 pts/4 S+ 00:45 0:00 grep --color=auto mgd root@Ubuntu-test:~# ps -aux | grep jinven root 22967 0.0 0.0 876236 19916 ? S 00:37 0:00 /usr/sbin/jinventoryd -N root 23199 0.0 0.0 14224 1020 pts/4 S+ 00:45 0:00 grep --color=auto jinven root@Ubuntu-test:~# ps -aux | grep jlinkmon root 19857 0.0 0.0 184412 5752 ? Ss 00:30 0:00 /usr/sbin/jlinkmon root 23201 0.0 0.0 14224 1088 pts/4 S+ 00:46 0:00 grep --color=auto jlinkmon

2. Create GNFs

A. BSYS Once the base system software is installed on the MX chassis, add the following initial configuration to the MX to enable GNFs:

[edit] jnpr@MX1# set chassis network-slices guest-network-functions [edit] jnpr@MX1# set chassis redundancy graceful-switchover [edit]



jnpr@MX1# commit re0: [edit] 'chassis' warning: Chassis configuration for network services has been changed. A system reboot is mandatory. Please reboot *ALL* routing engines NOW. Continuing without a reboot might result in unexpected system behavior. configuration check succeeds re1: commit complete re0: commit complete

Note that “set system commit synchronization” should also be enabled if necessary. In this case it was previously configured and therefore not set in the step above. Once GNF capability has been enabled, reboot the MX using the operational mode command “request system reboot both-routing-engines”. Next, associate each GNF with one or more FPCs. Please reference the diagram in the “Overview” section above that shows the mapping of FPCs to each GNF.

set chassis network-slices guest-network-functions gnf 1 fpcs 1 set chassis network-slices guest-network-functions gnf 1 fpcs 2 set chassis network-slices guest-network-functions gnf 2 fpcs 4 set chassis network-slices guest-network-functions gnf 5 fpcs 5

This configuration causes the FPC’s to restart. To monitor, use the “show chassis fpc” command which will show that the state transitions to “Present” and then to “Off-line” as the FPCs are now controlled by the GNF RE VM, i.e. the routing engine running on the Linux host. Once the RE is up and running on the Linux host the line cards will come up. Note the “GNF” assignment in the output below:

jnpr@MX1> show chassis fpc Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer GNF 0 Empty 1 Present 46 1 2 Offline ---GNF initiated Restart--- 1 3 Empty 4 Offline ---GNF initiated Restart--- 2 5 Offline ---GNF initiated Restart--- 5

B. JDM I. Configure Server to BSYS Interfaces Control Board Interfaces Configure the mapping of the Linux host 10G interfaces to the Control Board interfaces of the MX. Please reference the network diagram in the “Overview” section above. Using JDM, enter configuration mode to configure the mapping and also set the host name for the server:

set groups server0 server interfaces cb0 ens4f0 set groups server0 server interfaces cb1 ens4f1 set groups server0 system host-name jdm-server0 set apply-groups server0



After this configuration the interfaces should appear as “up” on the JDM CLI:

root@jdm> show server connections | match "Comp|ens4" Component Interface Status IP Addr Comments Physical CB0 port ens4f0 up NA Physical CB1 port ens4f1 up NA CB0 bridge bridge_cb0(ens4f0) up NA CB1 bridge bridge_cb1(ens4f1) up NA

Note: if further troubleshooting is required, then use the following health check command from the Linux host:

root@Ubuntu-test:~# jdm-nvchk Linux Distribution is Ubuntu 16.04 Checking server slot:server0 [ PASS ] Checking if libvirtd is running in listening mode [ PASS ] Checking if jlinkmon is running [ PASS ] Checking if only one instance of jlinkmon is running [ PASS ] Checking if jdm is pingable [ PASS ] Checking if bridge_cb1 is created [ PASS ] Checking if CB1 interface is configured in JDM:ens4f1 [ PASS ] Checking if ens4f1 is attached to bridge_cb1 [ PASS ] Checking if ens4f1 is UP [ PASS ] Checking if bridge_cb0 is created [ PASS ] Checking if CB0 interface is configured in JDM:ens4f0 [ PASS ] Checking if ens4f0 is attached to bridge_cb0 [ PASS ] Checking if ens4f0 is UP [ PASS ] Checking if bridge_mgmt is created [ PASS ] Checking if jdm mgmt interface is configured in JDM [ FAIL ] Checking if bridge_vnf_mgmt is created [ PASS ] Checking if VNF Mgmt interface is configured in JDM [ FAIL ]

VNF Management Interface Server interface ‘eno2’ provides access to the Linux host for management purposes. From here, the host can be used as a jump station to JDM and to the GNFs. In addition, interface ‘eno3’ on the Linux host is connected to a different management network that allows direct connectivity to the GNF RE VMs. This interface is configured in JDM as the VNF management interface:

set groups server0 server interfaces vnf-management eno3

Once this parameter is set, the host interface is added to a Linux bridge named “bridge_vnf_mgmt”.

root@Ubuntu-test:~# brctl show | grep eno3 bridge_vnf_mgmt 8000.0894ef325ec6 no eno3

When a GNF is created, its fxp0 interface is added to the same bridge. This provides in-band access to the GNF RE VM from the external network via this physical interface on the Linux host. ii. Creating GNF RE VMs Make sure to download the GNF VM image to the /var/third-party/images directory. In this example, three GNF VMs will be created. The same image can be used when creating the VMs as JDM will make a unique copy for each instance:

root@Ubuntu-test:/var/third-party/images# ls -l



total 1744640 -rw-r--r-- 1 root root 1786503926 Oct 12 00:50 junos-install-ns-mx-x86-64-17.4X48-D10.3.tgz

The first step is to create the GNF RE VMs. These VMs are referred to as Virtual Network Functions,or VNFs, in JDM. From the JDM operational mode CLI, use the following command to create the VNF:

root@jdm> request virtual-network-functions gnf1 add-image /var/third-party/images/junos-install-ns-mx-x86-64-17.4X48-D10.3.tgz Added image: /vm-primary/gnf1/gnf1.img

As indicated by the output above, the result is that a unique disk image named “gnf1” is created in two different formats, raw and qcow2:

root@Ubuntu-test:/var/third-party# ls -l /vm-primary/gnf1 total 3657148 -rw-r--r-- 1 root root 16106192896 Oct 12 00:58 gnf1.img -rw-r--r-- 1 930 930 1880948736 Sep 26 07:14 gnf1.qcow2

Repeat the previous step in order to create the GNF RE VMs for the other two GNFs name ‘gnf2’ and ‘gnf5’. Next, in JDM configuration mode, configure the attributes associated with each VM. The parameters include: - VNF name - this must match the GNF image name that was specified when creating the VM - GNF ID - this must match the ID configured on the BSYS, or physical MX - Chassis type - specify the type of MX chassis that the Linux host is connected to - Resource template - this determines the number of CPUs and RAM consumed by the GNF RE VM

Template Name

CPU Cores

Memory (GB)

MX-RE Equivalent (approximate)

2core-16g 2 16 RE-S-1800x2 with 16GB RAM 4core-32g 4 32 RE-S-1800X4-32G-S 6core-48g 6 48 RE-S-X6-64G with less RAM 8core-64g 8 64 REMX2K-X8-64G

- Base configuration – an initial configuration file that is loaded by the RE upon initialization. In this example, GNF1 is configured with a base file containing IP address, login credentials for user ‘jnpr’, host name, SSH service, etc… The file has previously been copied to the /var/third-party directory on the Linux host.

set virtual-network-functions gnf1 id 1 set virtual-network-functions gnf1 chassis-type mx960 set virtual-network-functions gnf1 resource-template 2core-16g set virtual-network-functions gnf1 base-config /var/third-party/gnf1-init.cfg set virtual-network-functions gnf2 id 2 set virtual-network-functions gnf2 chassis-type mx960 set virtual-network-functions gnf2 resource-template 2core-16g set virtual-network-functions gnf5 id 5 set virtual-network-functions gnf5 chassis-type mx960 set virtual-network-functions gnf5 resource-template 2core-16g commit and

Note: If the reader is familiar with Linux virsh/libvirt, this configuration creates an XML file containing the VM configuration and the boot parameters. JDM validates the values and resources available and then passes the information to libvirt to create and start the VM.



Once the configuration is committed, each VM will start, analogous to a Junos RE initializing. Note that it takes several minutes for the GNF RE to initialize so the “Liveness” state will be “down” until initialization is complete.

root@jdm-server0> show virtual-network-functions ID Name State Liveness -------------------------------------------------------------------------------- 1 gnf1 running down 2 gnf2 running down 5 gnf5 running down

To view the RE initialization process from the console, use the following command:

root@jdm-server0> request virtual-network-functions console gnf1 Connected to domain gnf1 Escape character is ^] <Console Output>

Once the RE has completed initialization the “Liveness” state transitions to “up”.

root@jdm-server0> show virtual-network-functions ID Name State Liveness -------------------------------------------------------------------------------- 1 gnf1 running up 2 gnf2 running up 5 gnf5 running up root@jdm-server0> show virtual-network-functions gnf1 Virtual Machine Information --------------------------- Name: gnf1 IP Address: 192.168.2.1 Status: Running Liveness: up Cores: 2 Memory: 16GB Resource Template: 2core-16

iii. Connecting to GNF RE One can now use JDM as a jump host to SSH to each of the GNF REs. For example, SSH to ‘gnf1’ and view the state of the GNF RE. Note that “system services root-login allow” must be set in the GNF’s configuration file in order to SSH as user ‘root’.

root@jdm> ssh jnpr@gnf1 The authenticity of host 'gnf1 (192.168.2.1)' can't be established. ECDSA key fingerprint is 58:85:56:aa:e0:89:5e:18:f3:c7:97:c0:09:dc:fb:59. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'gnf1,192.168.2.1' (ECDSA) to the list of known hosts. Password: --- JUNOS 17.4X48-D10.3 Kernel 64-bit JNPR-11.0-20170913.201739_fbsd- At least one package installed on this device has limited support. Run 'file show /etc/notices/unsupported.txt' for details. jnpr@GNF1> jnpr@GNF1> show chassis routing-engine Routing Engine status: Slot 0: Current state Master Election priority Master (default) DRAM 16341 MB (16384 MB installed)



<snip> Model RE-GNF-2200x2 <snip> Routing Engine status: Slot 1: Current state Present

View the chassis FPCs and hardware. Note that only the FPCs specific to this GNF are displayed, and that they are “Online”.

jnpr@GNF1> show chassis fpc bsys-re0: -------------------------------------------------------------------------- Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer GNF 1 Online 46 8 0 9 9 10 3136 8 19 1 2 Online 35 8 0 8 8 8 3584 6 25 1 jnpr@GNF1> show chassis hardware models | match "Engine|CB|FPC" Routing Engine 0 REV 07 740-031116 9009108746 RE-S-1800X4-16G-S Routing Engine 1 REV 10 740-031116 9013076454 RE-S-1800X4-16G-S CB 0 REV 03 750-055976 CAEK4339 SCBE2-MX-S CB 1 REV 03 750-055976 CAEP4876 SCBE2-MX-S CB 2 REV 01 750-055976 CACS7420 SCBE2-MX-S FPC 1 REV 36 750-056519 CAFE6325 MPC7E-MRATE FPC 2 REV 06 750-063181 CAGH0860 MPC3E-3D-NG

An initial configuration file was not specified for the other 2 GNF REs. Therefore, SSH is not currently enabled in their configuration files. Connect to the console using the request virtual-network-functions console <GNF name> operational mode command, login, and configure the initial settings. iv. Verification on BSYS On the BSYS, verify that the state of the GNFs is “Online”:

jnpr@MX1> show chassis network-slices guest-network-functions: GNF Description State Uptime 1 Online 1 hour, 6 minutes, 3 seconds 2 Online 1 hour, 5 minutes, 23 seconds 5 Online 1 hour, 5 minutes, 29 seconds jnpr@MX1> show chassis network-slices fpcs guest-network-functions: GNF FPCs 1 1 2 2 4 5 5

From the BSYS, the state of FPCs and PICs for all GNFs can be viewed:

jnpr@MX1> show chassis fpc Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer GNF 0 Empty 1 Online 47 10 0 9 9 9 3136 8 19 1 2 Online 35 8 0 8 8 7 3584 6 25 1 3 Empty 4 Online 33 14 0 12 12 12 2048 11 20 2 5 Online 33 12 0 11 12 12 2048 11 20 5



<snip> jnpr@MX1> show chassis fpc pic-status Slot 1 Online MPC7E 3D MRATE-12xQSFPP-XGE-XLGE-CGE GNF 1 PIC 0 Online MRATE-6xQSFPP-XGE-XLGE-CGE PIC 1 Online MRATE-6xQSFPP-XGE-XLGE-CGE Slot 2 Online MPC3E NG PQ & Flex Q GNF 1 PIC 0 Online 10x 1GE(LAN) SFP PIC 1 Online 10x 1GE(LAN) SFP Slot 4 Online MPCE Type 3 3D GNF 2 PIC 0 Online 10X10GE SFPP Slot 5 Online MPCE Type 3 3D GNF 5 PIC 0 Online 10X10GE SFPP

Note that it is possible to access the GNF RE via BSYS. Enter the shell and use the rlogin -T command shown below:

jnpr@MX1> start shell % rlogin -T gnf1-re0 Last login: Thu Oct 12 01:39:31 from 192.168.2.14 --- JUNOS 17.4X48-D10.3 Kernel 64-bit JNPR-11.0-20170913.201739_fbsd- At least one package installed on this device has limited support. Run 'file show /etc/notices/unsupported.txt' for details. jnpr@GNF1> show chassis fpc bsys-re0: -------------------------------------------------------------------------- Temp CPU Utilization (%) CPU Utilization (%) Memory Utilization (%) Slot State (C) Total Interrupt 1min 5min 15min DRAM (MB) Heap Buffer GNF 1 Online 47 8 0 9 9 10 3136 8 19 1 2 Online 35 8 0 8 8 8 3584 6 25 1

3. Configure Topology

A. AF Interfaces After performing GNF creation and initial configuration, the last step is to configure the logical links between them in order to build the desired topology. In release 17.4R1, the Abstracted Fabric (AF) interface feature was introduced. These interfaces enable GNFs to communicate with one another over the BSYS’ fabric.

The Abstracted Fabric interfaces are created from the CLI of the BSYS which has visibility to all GNFs. The interfaces are then present within each GNF and can be configured with protocols and addresses just like any other Junos interface. Initially the AF interfaces support protocol families ‘inet’, ‘inet6’, ‘mpls’, ‘ccc’, and ‘iso’.



In this example, GNF1 is configured with 2 Abstracted Fabric (AF) interfaces, 1 to each of the other GNFs. The configuration for all AF interfaces defined on the BSYS is:

set chassis network-slices guest-network-functions gnf 1 af0 peer-gnf id 2 set chassis network-slices guest-network-functions gnf 1 af0 peer-gnf af0 set chassis network-slices guest-network-functions gnf 1 af1 peer-gnf id 5 set chassis network-slices guest-network-functions gnf 1 af1 peer-gnf af0 set chassis network-slices guest-network-functions gnf 2 af0 peer-gnf id 1 set chassis network-slices guest-network-functions gnf 2 af0 peer-gnf af0 set chassis network-slices guest-network-functions gnf 5 af0 peer-gnf id 1 set chassis network-slices guest-network-functions gnf 5 af0 peer-gnf af1

In the GNF1 configuration, the “af” interfaces are configured similar to any other standard Junos interface. In this sample topology the GNFs were configured for IS-IS and SPRING (not officially supported in 17.4R1). In addition, GNF1 is a PE router configured with several routing instances including L3 VPN, EVPN, and VPLS. Please see [3] in the “Reference” section below for complete configuration files.

set interfaces af0 unit 0 family inet address 192.168.0.5/30 set interfaces af0 unit 0 family iso set interfaces af0 unit 0 family mpls set protocols isis interface af0.0 point-to-point set interfaces af1 unit 0 family inet address 192.168.0.13/30 set interfaces af1 unit 0 family iso set interfaces af1 unit 0 family mpls set protocols isis interface af1.0 point-to-point



B. Verification i. AF Interfaces From the GNF1 CLI, let’s take a closer look at the ‘af’ interface state.

jnpr@GNF1> show interfaces terse | match af af0 up up af0.0 up up inet 192.168.0.5/30 af1 up up af1.0 up up inet 192.168.0.13/30

The interface details show that the peer for interface ‘af0’ is on FPC slot 4 which has been mapped to GNF2. The bandwidth from the perspective of GNF1 to the remote GNF2 is 130 Gbps based on the PFE throughput of the MPC3 line card that has been mapped to GNF2.

jnpr@GNF1> show interfaces af0 Physical interface: af0, Enabled, Physical link is Up Interface index: 169, SNMP ifIndex: 562 Type: Ethernet, Link-level type: Ethernet, MTU: 9192, Speed: 130000mbps Device flags : Present Running Interface flags: Internal: 0x4000 Link type : Full-Duplex Link flags : None Current address: 2c:6b:f5:cc:a6:28, Hardware address: 2c:6b:f5:cc:a6:28 Last flapped : 2017-10-12 01:44:25 PDT (00:36:14 ago) Input rate : 2360546024 bps (833977 pps) Output rate : 2242635736 bps (802852 pps) Bandwidth : 130 Gbps Peer GNF id : 2 Peer GNF Forwarding element(FE) view : FPC slot:FE Num FE Bandwidth(Gbps) Status 4:0 130 Up Logical interface af0.0 (Index 346) (SNMP ifIndex 568) Flags: Up SNMP-Traps 0x4004000 Encapsulation: ENET2 Input packets : 892486763 Output packets: 546487729 Protocol inet, MTU: 9178 Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 1, Curr new hold cnt: 0, NH drop cnt: 0 Flags: Sendbcast-pkt-to-re Addresses, Flags: Is-Preferred Is-Primary Destination: 192.168.0.4/30, Local: 192.168.0.5, Broadcast: 192.168.0.7 Protocol iso, MTU: 9175 Flags: Is-Primary Protocol mpls, MTU: 9166, Maximum labels: 3 Flags: Is-Primary Protocol multiservice, MTU: Unlimited Flags: Is-Primary

Viewing the AF interface on GNF2 shows that it has 610 Gbps available to GNF1. Recall that GNF1 contains 2 FPCs, an MPC7 in slot 1 that has 2 PFEs which support 240 Gbps each, and an MPC3E in slot 2 that supports 130 Gbps capacity.

jnpr@GNF2> show interfaces af0 Physical interface: af0, Enabled, Physical link is Up Interface index: 137, SNMP ifIndex: 537 Type: Ethernet, Link-level type: Ethernet, MTU: 9192, Speed: 610000mbps Device flags : Present Running Interface flags: Internal: 0x4000 Link type : Full-Duplex



Link flags : None Current address: 2c:6b:f5:97:53:28, Hardware address: 2c:6b:f5:97:53:28 Last flapped : 2017-10-19 11:48:21 PDT (21:52:03 ago) Input rate : 2295154488 bps (802839 pps) Output rate : 2359927376 bps (833960 pps) Bandwidth : 610 Gbps Peer GNF id : 1 Peer GNF Forwarding element(FE) view : FPC slot:FE Num FE Bandwidth(Gbps) Status 1:0 240 Up 1:1 240 Up 2:0 130 Up <snip>

When GNF2 FPC4 sends traffic to GNF1, it uses all available fabric connections to remote PFEs on FPCs 1 and 2:

jnpr@GNF2> show class-of-service fabric statistics source 4 destination 1 Destination FPC Index: 1, Source FPC Index: 4 Total statistics: High priority Low priority Packets: 162897375 53717864834 Bytes : 2608726204 19745136761296 Pps : 2016 678879 bps : 258304 1996231552 <snip> jnpr@GNF2> show class-of-service fabric statistics source 4 destination 2 Destination FPC Index: 2, Source FPC Index: 4 Total statistics: High priority Low priority Packets: 81452075 12299414588 Bytes : 1303233200 4511247967105 Pps : 1010 155257 bps : 129280 455660288 <snip>

However, in this topology, none of the interfaces on GNF1 FPC1 are used. All of the egress interfaces are on the MPC3E in slot 2, FPC2. Thus, the traffic received by the FPC1 PFEs must subsequently be forwarded to FPC2 via the fabric. The output below shows FPC1 sending traffic it has received from GNF2 and GNF5 to GNF1 FPC2:

jnpr@GNF1> show class-of-service fabric statistics source 1 destination 2 Destination FPC Index: 2, Source FPC Index: 1 Total statistics: High priority Low priority Packets: 165403264 136510675132 Bytes : 2646542743 49960326121825 Pps : 2023 1700138 bps : 258944 4979701760 <snip>

The extra hop increases latency and can impact throughput by causing packet loss if it is not taken into account during the planning process. A feature called “Fabric Path Optimization” will address this inefficiency in a future release by sending traffic directly to the appropriate remote PFE. ii. Other show Commands When viewing the output of various ‘show’ commands, the ‘af’ interfaces appear just as any other interface in Junos:

jnpr@GNF1> show isis adjacency Interface System L State Hold (secs) SNPA af0.0 GNF2 1 Up 19 af1.0 GNF5 1 Up 26



jnpr@GNF1> show route 172.16.1.4 inet.0: 21 destinations, 21 routes (21 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 172.16.1.4/32 *[IS-IS/18] 00:01:55, metric 40 to 192.168.0.6 via af0.0 > to 192.168.0.14 via af1.0 inet.3: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 172.16.1.4/32 *[L-ISIS/14] 00:01:45, metric 40 to 192.168.0.6 via af0.0, Push 2004 > to 192.168.0.14 via af1.0, Push 5004 jnpr@GNF2> show isis adjacency Interface System L State Hold (secs) SNPA af0.0 GNF1 1 Up 22 xe-4/0/9.0 ALU8 2 Up 25

Although not shown here, traffic was successfully forwarded between PE GNF1 and a remote physical PE that was four router hops away, for all configured services.



Configuration Files This section lists the configuration files for the setup used in this document.

gnf1.cfg version 17.4X48-D10.3; groups { re0 { system { host-name GNF1; domain-name example.net; backup-router 10.161.11.254 destination 0.0.0.0/0; time-zone America/Los_Angeles; root-authentication { encrypted-password "$ABC123"; ## SECRET-DATA } name-server { 10.161.30.30; 10.161.30.18; } login { user jnpr { uid 2001; class superuser; authentication { encrypted-password "$AB123"; ## SECRET-DATA } } } services { ftp; ssh { root-login allow; } telnet; xnm-clear-text; netconf { ssh; } } syslog { file messages { any any; interactive-commands none; archive size 10m files 10; } } ntp { server 172.21.200.60; } }



interfaces { fxp0 { unit 0 { family inet { address 10.161.10.18/23; } } } } routing-options { static { route 10.255.255.0/24 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.161.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 192.168.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.4.105/32 { next-hop 10.161.11.254; retain; no-readvertise; } route 172.16.0.0/12 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } } } } jvision { services { analytics { streaming-server ns-ifd { remote-address 192.168.1.254; remote-port 2000; } streaming-server ns-ifl {



remote-address 192.168.1.254; remote-port 2001; } streaming-server ns-lsp { remote-address 192.168.1.254; remote-port 2002; } export-profile ns { local-address 172.16.1.1; reporting-rate 10; format gpb; transport udp; } sensor ifd { server-name ns-ifd; export-name ns; resource /junos/system/linecard/interface/; } sensor ifl { server-name ns-ifl; export-name ns; resource /junos/system/linecard/interface/logical/usage/; } sensor lsp { server-name ns-lsp; export-name ns; resource /junos/services/label-switched-path/usage/; } } } protocols { mpls { sensor-based-stats; } } } mtu { interfaces { <af*> { mtu 9192; } } } } apply-groups [ re0 mtu jvision ]; chassis { fpc 1 { pic 0 { pic-mode 100G; } pic 1 { pic-mode 100G;



} } network-services enhanced-ip; } interfaces { ge-2/0/0 { description "Access Interface VPN-A"; flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 100 { vlan-id 100; family inet { address 10.10.1.1/24; } } } ge-2/0/1 { description "Access Interface VPN-B"; flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 200 { encapsulation vlan-bridge; vlan-id 200; family bridge; } } ge-2/0/2 { description "Access Interface VPN-C"; flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 300 { encapsulation vlan-bridge; vlan-id 300; family bridge; } } ge-2/0/3 { description "Access Interface VPN-D"; flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 400 { encapsulation vlan-bridge; vlan-id 400; family bridge; } } ge-2/0/4 { description "Access Interface VPN-E"; flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 500 { encapsulation vlan-bridge;



vlan-id 500; family bridge; } } ge-2/0/5 { description "Access Interface VPN-F"; flexible-vlan-tagging; encapsulation flexible-ethernet-services; unit 600 { encapsulation vlan-vpls; vlan-id 600; } } ge-2/0/6 { unit 0 { family inet { address 192.168.1.1/24; } } } af0 { unit 0 { family inet { address 192.168.0.5/30; } family iso; family mpls; } } af1 { unit 0 { family inet { address 192.168.0.13/30; } family iso; family mpls; } } irb { unit 300 { family inet { address 10.10.3.1/24; } } unit 400 { family inet { address 10.10.4.254/24; } } unit 500 { family inet { address 10.10.5.254/24;



} } } lo0 { unit 0 { family inet { address 172.16.1.1/32; } family iso { address 49.0002.1720.1600.1001.00; } } } } routing-options { router-id 172.16.1.1; autonomous-system 100; forwarding-table { export lb; } } protocols { rsvp { interface all; } mpls { lsp-external-controller pccd; traffic-engineering { database { import { igp-topology; policy ISIS-TE; } } } interface all; interface fxp0.0 { disable; } } bgp { group NS { type internal; local-address 192.168.1.1; family traffic-engineering { unicast; } export ISIS-TE; neighbor 192.168.1.253; } group Internal { type internal;



local-address 172.16.1.1; family inet-vpn { unicast; } family evpn { signaling; } neighbor 172.16.1.3; } } isis { no-ipv6-routing; ignore-attached-bit; traffic-engineering { family inet-mpls { shortcuts; } } source-packet-routing { srgb start-label 1000 index-range 1024; node-segment ipv4-index 1; } level 2 disable; interface ge-2/0/6.0 { passive; } interface af0.0 { point-to-point; } interface af1.0 { point-to-point; } interface lo0.0; } ldp { interface lo0.0; } spring-traffic-engineering { lsp-external-controller pccd; } lldp { interface all; } pcep { pce ns { destination-ipv4-address 192.168.1.254; destination-port 4189; pce-type active stateful; lsp-provisioning; spring-capability; } }



} policy-options { policy-statement Export-C-EVPN-Type-5 { term local { from { protocol direct; route-filter 10.10.3.0/24 exact; } then accept; } term default { then reject; } } policy-statement Export-C-L3VPN { term reject-host { from { route-filter 10.10.0.0/16 prefix-length-range /32-/32; } then reject; } term default { from { route-filter 10.10.0.0/16 prefix-length-range /24-/24; } then { community add COMM-C-L3VPN; accept; } } } policy-statement ISIS-TE { term 1 { from protocol isis; to family traffic-engineering; then accept; } } policy-statement Import-C-EVPN { term reject-t2-t3 { from { family evpn; community COMM-C-EVPN; nlri-route-type [ 2 3 ]; } then reject; } term default { from community COMM-C-EVPN; then accept; } }



policy-statement Import-C-L3VPN { term default { from community COMM-C-L3VPN; then accept; } } policy-statement lb { then { load-balance per-packet; } } policy-statement ns-service-lsp-mapping { term 1 { then next term; } } community COMM-C-EVPN members target:100:300; community COMM-C-L3VPN members target:100:301; community COMM-E-EVPN members target:100:500; community VPN_A members target:100:100; community VPN_B members target:100:200; community VPN_C members target:100:300; community VPN_C_L3VPN members target:100:301; community VPN_D members target:100:400; community VPN_E members target:100:500; community VPN_E_L3VPN members target:100:501; } routing-instances { VPN-A { instance-type vrf; interface ge-2/0/0.100; route-distinguisher 172.16.1.1:100; vrf-target target:100:100; vrf-table-label; protocols { bgp { group CE { type external; peer-as 200; neighbor 10.10.1.2; } } } } VPN-B { instance-type evpn; vlan-id 200; interface ge-2/0/1.200; route-distinguisher 172.16.1.1:200; vrf-target target:100:200; protocols { evpn;



} } VPN-C { instance-type evpn; vlan-id 300; interface ge-2/0/2.300; routing-interface irb.300; route-distinguisher 172.16.1.1:300; vrf-import Import-C-EVPN; vrf-target target:100:300; protocols { evpn { default-gateway do-not-advertise; } } } VPN-C-L3VPN { instance-type vrf; interface irb.300; route-distinguisher 172.16.1.1:301; vrf-import Import-C-L3VPN; vrf-export Export-C-L3VPN; vrf-table-label; protocols { evpn { ip-prefix-routes { advertise direct-nexthop; encapsulation mpls; export Export-C-EVPN-Type-5; } } } } VPN-D { instance-type evpn; vlan-id 400; interface ge-2/0/3.400; routing-interface irb.400; route-distinguisher 172.16.1.1:400; vrf-target target:100:400; protocols { evpn; } } VPN-D-L3VPN { instance-type vrf; interface irb.400; route-distinguisher 172.16.1.1:401; vrf-target target:100:401; vrf-table-label; } VPN-E {



instance-type evpn; vlan-id 500; interface ge-2/0/4.500; routing-interface irb.500; route-distinguisher 172.16.1.1:500; vrf-target target:100:500; protocols { evpn; } } VPN-E-L3VPN { instance-type vrf; interface irb.500; route-distinguisher 172.16.1.1:501; vrf-target target:100:501; vrf-table-label; } VPN-F { instance-type vpls; vlan-id 600; interface ge-2/0/5.600; protocols { vpls { encapsulation-type ethernet-vlan; no-tunnel-services; vpls-id 600; neighbor 172.16.1.4; } } } }



gnf1-init.cfg version 17.4X48-D10.3; groups { re0 { system { host-name GNF1; domain-name example.net; backup-router 10.161.11.254 destination 0.0.0.0/0; time-zone America/Los_Angeles; root-authentication { encrypted-password "$ABC123"; ## SECRET-DATA } name-server { 10.161.30.30; 10.161.30.18; } login { user jnpr { uid 2001; class superuser; authentication { encrypted-password "$ABC123; ## SECRET-DATA } } } services { ftp; ssh { root-login allow; } telnet; xnm-clear-text; netconf { ssh; } } syslog { file messages { any any; interactive-commands none; archive size 10m files 10; } } ntp { server 172.21.200.60; } } interfaces { fxp0 { unit 0 { family inet {



address 10.161.10.18/23; } } } } routing-options { static { route 10.255.255.0/24 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.161.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 192.168.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.4.105/32 { next-hop 10.161.11.254; retain; no-readvertise; } route 172.16.0.0/12 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } } } } } apply-groups [ re0 ]; chassis { fpc 1 { pic 0 { pic-mode 100G; } pic 1 { pic-mode 100G; } } network-services enhanced-ip;



}



gnf2.cfg version 17.4X48-D10.3; groups { re0 { system { host-name GNF2; domain-name example.net; backup-router 10.161.11.254 destination 0.0.0.0/0; time-zone America/Los_Angeles; root-authentication { encrypted-password "$ABC123"; ## SECRET-DATA } name-server { 10.161.30.30; 10.161.30.18; } login { user jnpr { uid 2001; class superuser; authentication { encrypted-password "$ABC123"; ## SECRET-DATA } } } services { ftp; ssh { root-login allow; } telnet; xnm-clear-text; netconf { ssh; } } ntp { server 172.21.200.60; } } interfaces { fxp0 { unit 0 { family inet { address 10.161.10.17/23; } } } } routing-options { static {



route 10.255.255.0/24 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.161.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 172.16.0.0/12 { next-hop 10.161.11.254; retain; no-readvertise; } route 192.168.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.4.105/32 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } } } } mtu { interfaces { <af*> { mtu 9192; } <xe*> { mtu 9192; } } } jvision { services { analytics { streaming-server ns-ifd { remote-address 192.168.1.254; remote-port 2000; } streaming-server ns-ifl { remote-address 192.168.1.254;



remote-port 2001; } streaming-server ns-lsp { remote-address 192.168.1.254; remote-port 2002; } export-profile ns { local-address 172.16.1.2; reporting-rate 10; format gpb; transport udp; } sensor ifd { server-name ns-ifd; export-name ns; resource /junos/system/linecard/interface/; } sensor ifl { server-name ns-ifl; export-name ns; resource /junos/system/linecard/interface/logical/usage/; } sensor lsp { server-name ns-lsp; export-name ns; resource /junos/services/label-switched-path/usage/; } } } protocols { mpls { sensor-based-stats; } } } } apply-groups [ re0 mtu jvision ]; system { syslog { user * { any emergency; } file messages { any notice; authorization info; } file interactive-commands { interactive-commands any; } } } chassis {



network-services enhanced-ip; } interfaces { xe-4/0/9 { unit 0 { family inet { address 192.168.0.49/30; } family iso; family mpls; } } af0 { unit 0 { family inet { address 192.168.0.6/30; } family iso; family mpls; } } lo0 { unit 0 { family inet { address 172.16.1.2/32; } family iso { address 49.0002.1720.1600.1002.00; } } } } routing-options { router-id 172.16.1.2; autonomous-system 100; forwarding-table { export lb; } } protocols { rsvp { interface xe-4/0/9.0; interface af0.0; } mpls { lsp-external-controller pccd; traffic-engineering { database { import { igp-topology; policy ISIS-TE; }



} } label-switched-path from-2-to-3-path-1 { from 172.16.1.2; to 172.16.1.3; no-cspf; } interface all; interface fxp0.0 { disable; } } bgp { group NS { type internal; local-address 172.16.1.2; family traffic-engineering { unicast; } export ISIS-TE; neighbor 192.168.1.253; } } isis { export [ Redistribute-L2-to-L1 Export-L2 ]; no-ipv6-routing; traffic-engineering { igp-topology; family inet-mpls { shortcuts; } } source-packet-routing { srgb start-label 2000 index-range 1024; node-segment ipv4-index 2; } interface xe-4/0/9.0 { point-to-point; } interface af0.0 { point-to-point; } interface lo0.0; } spring-traffic-engineering { lsp-external-controller pccd; } lldp { interface all; } pcep { pce ns {



destination-ipv4-address 192.168.1.254; destination-port 4189; pce-type active stateful; lsp-provisioning; spring-capability; } } } policy-options { policy-statement Export-L2 { term L1-to-L2 { from { protocol isis; level 1; route-filter 172.16.1.0/24 prefix-length-range /32-/32; } to level 2; then accept; } } policy-statement ISIS-TE { term 1 { from { traffic-engineering { protocol [ isis-level-1 isis-level-2 ]; } } then accept; } } policy-statement Redistribute-L2-to-L1 { term L2-to-L1 { from { protocol isis; level 2; route-filter 172.16.1.0/24 prefix-length-range /32-/32; } to level 1; then accept; } } policy-statement lb { then { load-balance per-packet; } } }



gnf5.cfg version 17.4X48-D10.3; groups { re0 { system { host-name GNF5; domain-name example.net; backup-router 10.161.11.254 destination 0.0.0.0/0; time-zone America/Los_Angeles; root-authentication { encrypted-password "$ABC123"; ## SECRET-DATA } name-server { 10.161.30.30; 10.161.30.18; } login { user jnpr { uid 2001; class superuser; authentication { encrypted-password "$ABC123"; ## SECRET-DATA } } } services { ftp; ssh { root-login allow; } telnet; xnm-clear-text; netconf { ssh; } } syslog { file messages { any any; interactive-commands none; archive size 10m files 10; } } ntp { server 172.21.200.60; } } interfaces { fxp0 { unit 0 { family inet {



address 10.161.10.19/23; } } } } routing-options { static { route 10.255.255.0/24 next-hop 10.161.11.254; route 10.161.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 172.16.0.0/12 { next-hop 10.161.11.254; retain; no-readvertise; } route 192.168.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.4.105/32 { next-hop 10.161.11.254; retain; no-readvertise; } route 10.8.0.0/16 { next-hop 10.161.11.254; retain; no-readvertise; } } } } mtu { interfaces { <af*> { mtu 9192; } <xe-*> { mtu 9192; } } } } apply-groups [ re0 mtu ]; system { syslog { user * { any emergency;



} file messages { any notice; authorization info; } file interactive-commands { interactive-commands any; } } } chassis { network-services enhanced-ip; } interfaces { xe-5/0/9 { unit 0 { family inet { address 192.168.0.53/30; } family iso; family mpls; } } af0 { unit 0 { family inet { address 192.168.0.14/30; } family iso; family mpls; } } lo0 { unit 0 { family inet { address 172.16.1.5/32; } family iso { address 49.0002.1720.1600.1005.00; } } } } routing-options { router-id 172.16.1.5; autonomous-system 100; forwarding-table { export lb; } } protocols { rsvp {



interface xe-5/0/9.0; interface af0.0; } mpls { lsp-external-controller pccd; traffic-engineering { database { import { igp-topology; policy ISIS-TE; } } } label-switched-path from-5-to-3-path-1 { from 172.16.1.5; to 172.16.1.3; no-cspf; } interface all; interface fxp0.0 { disable; } } bgp { group NS { type internal; local-address 172.16.1.5; family traffic-engineering { unicast; } export ISIS-TE; neighbor 192.168.1.253; } } isis { export [ Redistribute-L2-to-L1 Export-L2 ]; no-ipv6-routing; backup-spf-options { remote-backup-calculation; use-source-packet-routing; } traffic-engineering { family inet-mpls { shortcuts; } } source-packet-routing { srgb start-label 5000 index-range 1024; node-segment ipv4-index 5; } interface xe-5/0/9.0 { point-to-point;



} interface af0.0 { point-to-point; } interface lo0.0; } spring-traffic-engineering { lsp-external-controller pccd; } pcep { pce ns { destination-ipv4-address 192.168.1.254; destination-port 4189; pce-type active stateful; lsp-provisioning; spring-capability; } } } policy-options { policy-statement Export-L2 { term L1-to-L2 { from { protocol isis; level 1; route-filter 172.16.1.0/24 prefix-length-range /32-/32; } to level 2; then accept; } } policy-statement ISIS-TE { term 1 { from { traffic-engineering { protocol [ isis-level-1 isis-level-2 ]; } } then accept; } } policy-statement Redistribute-L2-to-L1 { term L2-to-L1 { from { protocol isis; level 2; route-filter 172.16.1.0/24 prefix-length-range /32-/32; } to level 1; then accept; } }



policy-statement lb { then { load-balance per-packet; } } }



bsys-mx1-node-slicing.cfg version 17.4X48-D10.3; groups { re0 { system { domain-name example.net; backup-router 10.161.39.254 destination 0.0.0.0/0; time-zone America/Los_Angeles; root-authentication { encrypted-password "$ABC123"; ## SECRET-DATA } name-server { 10.161.30.30; 10.161.30.18; } login { user jnpr { uid 2001; class superuser; authentication { encrypted-password "$ABC123"; ## SECRET-DATA } } } services { ftp; ssh; telnet; xnm-clear-text; netconf { ssh; } } syslog { file messages { any any; interactive-commands none; archive size 10m files 10; } } ntp { server 172.21.200.60; } } chassis { redundancy { routing-engine 0 master; routing-engine 1 backup; } } interfaces {



fxp0 { unit 0 { family inet { address 10.161.32.48/21; } } } } routing-options { static { route 10.255.255.0/24 { next-hop 10.161.39.254; retain; no-readvertise; } route 10.161.0.0/16 { next-hop 10.161.39.254; retain; no-readvertise; } route 172.16.0.0/12 { next-hop 10.161.39.254; retain; no-readvertise; } route 192.168.0.0/16 { next-hop 10.161.39.254; retain; no-readvertise; } route 10.8.4.105/32 next-hop 10.161.39.254; } } } re1 { system { domain-name example.net; backup-router 10.161.39.254 destination 0.0.0.0/0; time-zone America/Los_Angeles; root-authentication { encrypted-password "$ABC123"; ## SECRET-DATA } name-server { 10.161.30.30; 10.161.30.18; } login { user jnpr { uid 2001; class superuser; authentication { encrypted-password "$ABC123"; ## SECRET-DATA



} } } services { ftp; ssh; telnet; xnm-clear-text; netconf { ssh; } } syslog { file messages { any any; interactive-commands none; archive size 10m files 10; } } ntp { server 172.21.200.60; } } chassis { redundancy { routing-engine 0 master; routing-engine 1 backup; } } interfaces { fxp0 { unit 0 { family inet { address 10.161.32.49/21; } } } } routing-options { static { route 10.255.255.0/24 { next-hop 10.161.39.254; retain; no-readvertise; } route 10.161.0.0/16 { next-hop 10.161.39.254; retain; no-readvertise; } route 172.16.0.0/12 { next-hop 10.161.39.254;



retain; no-readvertise; } route 192.168.0.0/16 { next-hop 10.161.39.254; retain; no-readvertise; } route 10.8.4.105/32 next-hop 10.161.39.254; } } } } apply-groups [ re0 re1 ]; system { host-name MX1; commit synchronize; } chassis { redundancy { graceful-switchover; } network-services enhanced-ip; network-slices { guest-network-functions { gnf 1 { fpcs [ 1 2 ]; af0 { peer-gnf id 2 af0; } af1 { peer-gnf id 5 af0; } } gnf 2 { fpcs 4; af0 { peer-gnf id 1 af0; } } gnf 5 { fpcs 5; af0 { peer-gnf id 1 af1; } } } } }

Documents

Node Slicing on the MX960 - Juniper Networks · Node Slicing on the MX960 1. Initial Preparation A. Juniper Software Packages There are three software packages required for implementing