Tuesday, October 25, 2016

Port mirroring in juniper devices and storm control in EX switch.


--------------------------------------------------------------------------------------------------------------------------
set interfaces ge-0/0/10 unit 0 family ethernet-switching  (My laptop port).
set ethernet-switching-options analyzer employee–monitor input ingress interface ge-0/0/1.0(uplink to qfx port).
set ethernet-switching-options analyzer employee–monitor output interface ge-0/0/10.0 (Laptop interface).
Verification commands
show analyzer
--------------------------------------------------------------------------------------------------------------------------
set interfaces interface-range Access-ports member-range ge-0/0/0 to ge-0/0/10  === > Create interface range including only Access interfaces
set ethernet-switching-options storm-control action-shutdown
set ethernet-switching-options storm-control interface Access-ports level 20  ==== > Call the interface-range under the storm control configuration.
set ethernet-switching-options port-error-disable disable-timeout 20  === > Recovery time out is set to 20 seconds.
--------------------------------------------------------------------------------------------------------------------------
set interfaces interface-range STORM-ACCESS-PORTS member-range ge-0/0/0 to ge-0/0/10
set interfaces interface-range STROM-CONTROL-UPLINK member-range ge-0/0/22 to ge-0/0/23
set ethernet-switching-options port-error-disable disable-timeout 20
set ethernet-switching-options storm-control action-shutdown
set ethernet-switching-options storm-control interface STORM-ACCESS-PORTS level 20
set ethernet-switching-options storm-control interface STROM-CONTROL-UPLINK level 50
set ethernet-switching-options storm-control interface all

To clear if broadcast storm above 50% of bandwidth (if not recovered)

clear ethernet-switching port-error interface ge-0/0/23 (Uplink port)

Optimization of fortigate IPS

IPS signature need select according to infrastructure environment  Eg:-  if  we are not have Linux servers this ips signature can disable (d...