Optimization of fortigate IPS

1. IPS signature need select according to infrastructure environment 
   Eg:-  if  we are not have Linux servers this ips signature can disable (default behavior of ips is to monitor TCP/IP packet)
2. Interzone to interzone or inside interfaces to inside interfaces traffic don't call ips profile. this will affect fortigate memory /CPU
3. Only allow/call ips security profile (in firewall rule) from inside zone to outside zone 
4. Always create global profile and call in other VDOMs
5. Always trigger IPS engine update manually using #execute update-ips from global mode (if the updates are not coming from fortiguard cloud) 

• Always check the fortigate OS compatibility with IPS engine .
  
  
  
  
  
  
• In this case the IPS engine is outdated with version 6.4.2 fortigate OS built (above picture)
• Ones upgraded the ips we must restart the IPS engine using
  
  
  # diag test app ipsmonitor 99 (from global mode cli)
  
  #diag autoupdate versions | grep "IPS Attack" -A 6 (this command will help us to see the updated version from cli )
  
  

IPS Attack Engine
---------
Version: 6.00036
Contract Expiry Date: Sat Jan 16 2021
Last Updated using manual update on Mon Aug 31 14:17:05 2020
Last Update Attempt: Mon Oct  5 22:49:27 2020
Result: No Updates

How to troubleshoot the IPS issues in fortigate firewalls

 How to find problem with IPS in fortigate firewall?

In our case issues is High memory utilization in the devices so start the capture memory process first.

1^st step

#diagnose hardware sysinfo memory

Run Time:  41 days, 16 hours and 7 minutes

4U, 0N, 1S, 94I, 0WA, 0HI, 1SI, 0ST; 3615T, 764F

       ipsengine    23181      S <    12.7     3.6   ( Noticed that the IPS engine is taking lot of memory)

       ipsengine    23183      S <     4.9     3.7

       ipsengine    23180      S <     4.9     3.7

       scanunitd     3505      S <     4.9     0.6

       ipsengine    23179      S <     2.9     3.7

         miglogd      262      S       0.9     1.9

                                 

2d step

# diag debug crashlog read          >>>>Not able to find anything related to ips engine

 
3d step

n0_fw (global) # get sys fortiguard-service status

NAME               VERSION LAST UPDATE          METHOD    EXPIRE

AV Engine           6.149  2020-05-29 21:34:00  manual    2025-08-11 23:59:59

Virus Definitions   89.7121  2021-11-23 10:04:37  scheduled 2025-08-11 23:59:59

Extended set        89.7121  2021-11-23 10:04:37  scheduled 2025-08-11 23:59:59

Flow-based Virus Definitions  89.7121  2021-11-23 10:04:37  scheduled 2025-08-11 23:59:59

Attack Definitions  6.741  2015-12-01 02:30:00  manual    2025-08-11 23:59:59  Find this outdated

Attack Extended Definitions  18.200  2021-11-22 20:05:11  scheduled 2025-08-11 23:59:59

IPS Malicious URL Database  3.195  2021-11-22 20:05:11  scheduled 2025-08-11 23:59:59

IPS/FlowAV Engine   6.071  2021-02-17 20:28:04  scheduled 2025-08-11 23:59:59

IPS Config Script   1.009  2019-06-06 14:02:00  manual    2025-08-11 23:59:59

Application Definitions  18.199  2021-11-18 20:07:31  scheduled 2025-08-11 23:59:59

Industrial Attack Definitions  6.741  2015-12-01 02:30:00  manual    n/a

  

4^th step

(Solution for this we need update the IPS from cli using below command)

#execute update-ips  (In global mode)

Note: Performing the activity of upgrading IPS engine will terminate all TCP sessions. This will have impact to firewall. Make sure that you schedule this activity

 Few more commands to trouble shoot the IPS engine

diagnose test application ipsmonitor 5 (This command will help us to bypass the IPS for monitoring)

diagnose ips packet status (This will help to check ips packet counters/monitor the traffic for ips)

dia ips session list

dia test application ipsmonitor 13 >     This will  soft restart the ips 

diagnose ips packet status

diag ips session performance

diag ips session performance

diag ips signature status

diag ips  packet status

n0_fwl_i (global) # dia ips session list

Total TCP sessions: 165

SESSION id:105637489 serial:754130096 proto:6 group:0 age:6 idle:6 flag:0x200027

        feature:0x202 encap:0 ignore:1,0 ignore_after:0,204800

  C-212.224.76.233:44882, S-94.154.20.19:80

  state: C-ESTABLISHED/731/0/0/0/0, S-ESTABLISHED/0/0/0/0/0 pause:0, paws:0

  expire: 24

  app: unknown:0 last:0 unknown-size:0

  cnfm: http

  set: http sip rtsp

  asm: http

n0_fwl1_i (global) # dia test application ipsmonitor 13

Session List: pid=23179

vf=4 proto=6 194.154.20.10:49770->92.168.217.1:3306

vf=4 proto=6 82.4.241.19:39352->94.154.20.7:443

Total session :26660

n0_fwl1_i (global) # diag ips session performance

PERFORMANCE STATISTICS

name           :       sess |       pkts   cycles |       pkts   cycles

decoder        :          0 | 1007720701        0 |          0        0

session        :          0 | 1007720701        0 |          0        0

protocol       :          0 |  969665012        0 |          0        0

application    :          0 | 1544856777        0 |   63603439        0

detect         :          0 |          0        0 |          0        0

match          :          0 | 2096202687        0 |          0        0

NC match       :          0 | 2931515123        0 |          0        0

Cross Tag      :          0 |  107154002        0 |          0        0

-------------------------------------------------------------------------

How to extend the Mpls network to spoke devices using Juniper Mx480 and Juniper Srx340

We can extend the MPLS backbone to spoke router which we install newly below is the configuration 

Head end   Juniper MX480 < > Spoke device Juniper SRX340

Step by step process 

1. Create the Bgp community.
2. Create the bgp group for bgp peer .
3. Create write the policy for routes to come in and out .
4. Create routing instance and assign interface.
   
5. Check the bgp peer is ping reachable. 

Head end configuration 

------------------------------------------------------

Bgp configuration 

set protocols bgp group SR2_TC1 type external

set protocols bgp group SR2_TC1 hold-time 30

set protocols bgp group SR2_TC1 advertise-inactive

set protocols bgp group SR2_TC1 log-updown

set protocols bgp group SR2_TC1 family inet labeled-unicast

set protocols bgp group SR2_TC1 family inet-vpn unicast

set protocols bgp group SR2_TC1 export BGP-export-l3vpn

set protocols bgp group SR2_TC1 export DEFAULT-ONLY

set protocols bgp group SR2_TC1 peer-as 4099.35

set protocols bgp group SR2_TC1 neighbor 94.54.4.242

BGP Community 

set policy-options community cust-svcs-1121_export members target:503:101121

set policy-options community cust-svcs-1121_import members target:4100:101121

set policy-options community cust_fwl_1121_export members target:503:101279

set policy-options community cust_fwl_1121_import members target:4100:101279

Only adv the default 

set policy-options policy-statement DEFAULT-ONLY term default-only from route-filter 0.0.0.0/0 exact

set policy-options policy-statement DEFAULT-ONLY term default-only then accept

set policy-options policy-statement DEFAULT-ONLY term reject-others then reject

L3VPN routes policy 

set policy-options policy-statement BGP-export-l3vpn term T1 from family inet-vpn

set policy-options policy-statement BGP-export-l3vpn term T1 then accept

set policy-options policy-statement BGP-export-l3vpn term T2 from family route-target

set policy-options policy-statement BGP-export-l3vpn term T2 then accept

Spoke site 

set protocols bgp group SR2_TC1 type external

set protocols bgp group SR2_TC1 hold-time 30

set protocols bgp group SR2_TC1 family inet labeled-unicast

set protocols bgp group SR2_TC1 family inet-vpn unicast

set protocols bgp group SR2_TC1 export bgp-export

set protocols bgp group SR2_TC1 peer-as 5503

set protocols bgp group SR2_TC1 neighbor 94.54.4.241

set protocols bgp group SR2_TC1 neighbor 94.54.4.243

set protocols mpls traffic-engineering mpls-forwarding

Route policy to adv the routes

set policy-options policy-statement bgp-export term T1 from protocol direct

set policy-options policy-statement bgp-export term T1 from route-filter 94.154.4.26/32 exact   (Loopback ip address of router)

set policy-options policy-statement bgp-export term T1 then accept

set policy-options policy-statement bgp-export term T2 then reject

Policy community 

set policy-options policy-statement VRF_1121_export term VRF_1121_export then community add cust-svcs-1121_import

set policy-options policy-statement VRF_1121_export term VRF_1121_export then next term

set policy-options policy-statement VRF_1121_export term VRF_1121_export-1 then community add cust_fwl_1121_import

set policy-options policy-statement VRF_1121_export term VRF_1121_export-1 then accept

set policy-options policy-statement VRF_1121_import term SVC_cust_fwl_1121 from protocol bgp

set policy-options policy-statement VRF_1121_import term SVC_cust_fwl_1121 from community cust_fwl_1121_export

set policy-options policy-statement VRF_1121_import term SVC_cust_fwl_1121 then accept

set policy-options policy-statement VRF_1121_import term SVC_cust_services_1121 from community cust-svcs-1121_export

set policy-options policy-statement VRF_1121_import term SVC_cust_services_1121 then accept

BGP Community 

set policy-options community cust-svcs-1121_export members target:503:101121

set policy-options community cust-svcs-1121_import members target:4100:101121

set policy-options community cust_fwl_1121_export members target:503:101279

set policy-options community cust_fwl_1121_import members target:4100:101279

Route-instances configuration

set routing-instances Monitoring-LCN-1121 interface ae1.55

set routing-instances Monitoring-LCN-1121 instance-type vrf

set routing-instances Monitoring-LCN-1121 route-distinguisher 94.54.4.26:8757

set routing-instances Monitoring-LCN-1121 vrf-import VRF_1121_import

set routing-instances Monitoring-LCN-1121 vrf-export VRF_1121_export

set routing-instances Monitoring-LCN-1121 vrf-table-label

Cheat sheet FortiGate For Troubleshooting

 L3 Diagnose Commands 
-------------------------------------
 · Diagnose Ip Arp List
 · Debug Flow
 · Diagnose Debug Flow Show Console Enable
 · Diagnose Debug Enable
 · Diag Debug Flow Trace Start 
 · Diagnose Debug Flow Trace Stop
 · Diagnose Debug 
 
--------------------------------------------
CPU Usage Diagnose Commands
--------------------------------------------
 · Get System Performance Status
 · Diagnose Sys Top 1
 · Diagnose Sys Top
 · Diagnose Sys Top-Summary
 · Diagnose Hardware Test Suite All
 
--------------------------------------
Crash Logs Diagnose Commands
--------------------------------------
 · Diagnose Debug  Crashlog Read
----------------------------------------------------
Fortigate Hardware Diagnose Commands 
----------------------------------------------------
 · Get Hardware Status
 · Get Hardware Npu Mp6 Port-List
Network Process Work In Interface Level  L1 Issues
-------------------------------------------------
 · Diagnose Sys Session List
 · Diag Netlink Aggregate Name Agg1
 · Diagnose Npu Spm List
Firewall Disk Space Or To Format The Firewall Disk 
--------------------------------------------------------- 
 · Get Hardware Status
 · Execute Disk List
 · Execute Disk Format
CPU Use And Memory 
--------------------------------------------------------
CPU#    Diagnose Hardware Sysinfo Cpu
Mem#    Diagnose Hardware Sysinfo Memory

Log
------
Diagnose Log Test  ( Test If The Logs Are Generating) 
Execute Backup Disk Alllogs {FTP}Tftp |USB)
Note:- User-Anonymize We Can Set The Log For Users 
---------------------------------------------------

Basic Commands
-----------------------------------------------
Administrative User Only 
----------------------------------
Get System Status
Show Full Configuration System Interface <Port>
Show System Interface <Port>
How Do You Restrict Logins To FortiGate To Be Only From Specific IP Addresses?
 A. Disable HTTPS Access On Interface
 B. Configure Trusted Host
User Administrator
---------------------------------------------
System > Admin Profiles  (Ro View The Admin Profile)
Network > Interfaces  >Address >Administrator Access 
Transparent Mode MAC Table 
--------------------------------------------
Diagnose Netlink Brct1 Name Host < VDOM1>.B
Debug Commands Routing Table Display 
--------------------------------------------------------
 • Get Router Info Routing-Table All 
 • Get Router Info Routing-Table Database  : To See The Inactive Routes From Routing Table
 • Diagnose Firewall Proute List   : - To View Policy Routing Table 

RPF Checks
--------------------------------------- 
 • Strict-Src-Check Disable (Loose RPF )(Default)
 • Strict-Src-Check Enble  (Strict RPF)
 • Set Strict-Src-Check Disable 
Packet Capture In Fortigate 
 • Diagnose Sniffer Packet <Interface> <Filter><Timestamp><Frame Size>
 • Ctrl +C To Stop The Packet Capture 
 • Diagnose Sniffer Packet Any 'Host 192.168.1.254 And Icmp" 3
 • Diagnose Sniffer Packet Any 'Port 443' 4   (It Will Show In/Out Packet

Backup User to pull the configuration from fortigate using SSL keys

In configuration we are setting up 2 trust host to pull the configuration using any backup 

software "Rancid" or scripts.

 fwl1(backup) # show

config system admin
    edit "backup"
        set trusthost1 1.2.4.107 255.255.255.255
        set trusthost2 1.28.49.1 255.255.255.255
        set accprofile "super_admin"
        set vdom "root"
        set ssh-public-key1 "ssh-rsa M+hK0a60Hw== rancid"  >>>Full key need to put here
        set ssh-public-key2 "ssh-rsa +Yptf rancid" >>>>>>>>>>>>full key need put here
        
    next
end

How to set the debug file in juniper device for ospf

How to set the debug file in juniper device for ospf 

set protocols ospf traceoptions file ospf-log

set protocols ospf traceoptions file size 10k

set protocols ospf traceoptions file files 5

set protocols ospf traceoptions flag lsa-ack

set protocols ospf traceoptions flag database-description

set protocols ospf traceoptions flag hello

set protocols ospf traceoptions flag lsa-update

set protocols ospf traceoptions flag lsa-request

set protocols ospf traceoptions flag error

 show log ospf-log | last 10

Feb  6 05:35:09.041161 OSPF hello from 194.154.4.28 (IFL 81, area 0.0.0.0) absorbed

Feb  6 05:35:09.046626 OSPF periodic xmit from 194.154.4.232 to 224.0.0.5 (IFL 81 area 0.0.0.0)

Feb  6 05:35:09.926405 OSPF periodic xmit from 194.154.4.232 to 224.0.0.5 (IFL 81 area 0.0.0.0)

Feb  6 05:35:09.951517 OSPF hello from 194.154.4.28 (IFL 81, area 0.0.0.0) absorbed

Feb  6 05:35:10.712453 OSPF hello from 194.154.4.28 (IFL 81, area 0.0.0.0) absorbed

Feb  6 05:35:10.893468 OSPF periodic xmit from 194.154.4.232 to 224.0.0.5 (IFL 81 area 0.0.0.0)

NOTE

The Routing Engine copies the forwarding table to the Packet Forwarding Engine, the part of the router that is responsible for forwarding packets. To display the entries in the Packet Forwarding Engine's forwarding table, use the show pfe route command.

root@> show pfe route summary

================ master ================


IPv4 Route Tables:
Index         Routes     Size(b)
--------  ----------  ----------
Default          109       10024
1                 12        1100
2                  6         548
3                  9         824
5                  5         456

MPLS Route Tables:
Index         Routes     Size(b)
--------  ----------  ----------
Default            5         456
7                  1          88

IPv6 Route Tables:
Index         Routes     Size(b)
--------  ----------  ----------
Default            4         388
1                  4         388
5                  4         388

CLNP Route Tables:
Index         Routes     Size(b)
--------  ----------  ----------
Default            1          88
5                  1          88

MSTP-instance Route Tables:
Index         Routes     Size(b)
--------  ----------  ----------
Default            1          88


root@>

Fortigate Vdom

VDOM administration

Super _admin profile can have access to all VDOM

Policy- based routes configuration in

Network > policy routes

Enable the ipv6 / or any other feature

System>Feature visibility    (to view the feature set)

Fortigate ECMP

Config system settings

Set v4-ecmp-mode [source-ip-based ] by default
---------------------------------------------------------------------
Learning mode :- in Fortinet Enable devices detection on the source interfaces

Traffic shapers  :- - Shared traffic

For mapping the more than one services we can create  :- services object


Session table in fortigate

Session diagnose (output)

Session table >   Fortiview > all sessions

TCP default TTL vale for session table on firewall

3600 sec default vale

Firewall services> firewall policies >global sessions

Clear any previous filters
------------------------------------------------------------
Diagnose sys session filter clear
Diagnose sys session list
Diagnose sys session clear


Eg :- Diagnose sys session filter dst 10.200.1.254
Diag sys session filter dport 80
Diag sys session list


Show the routing table
------------------------------------------
Get router info routing-table all 

What criteria are used to install routes in the "bgp.l3vpn.0" routing table?

Nice one

What criteria are used to install routes in the "bgp.l3vpn.0" routing table?


https://kb.juniper.net/InfoCenter/index?page=content&id=KB1534

Steps to create VPNv4 routes in Juniper

Steps to create VPNv4 routes in Juniper 

(CE)-----(PE-A)-------(OSPF-MPLS-LDP-IBGP--VPNv4PEERING)----(PE-B)--(CE)

1, Create a routing path between PE to PE(using IGP or IBGP)

2, Create VPN VRF instances in PE routers (eg VRF_Customer1)

3, Create the L3vpn BGP peer 

4, Create a policy for import and export to filter the VPNV4 routes from neighbors 

Create a policy in PE's and bring them to VRF instances

PE-A                                                        PE-B

------------                                            ---------------------------

Import : 100300                              Export 100300

Export :100301                              Import 100301   

Use policy to redistribute routes from OSPF to BGP 

Import and Export VRF in juniper

Import and Export VRF in juniper 

--------------------------------------------

The simple explanation for Import and Export routing instances.

So the export targets from the services vrf need to be the import target in customer vrf and import target from the services vrf will be the export targets in customer vrf. 

The export command in juniper

VRF Export if you see in any juniper devices it means it is exporting(giving) the routes to VRF/VR/Other routing tables etc.... 

In summary, it is giving its routes to other routing tables.

Import command in juniper 

VRF Import if you see in juniper devices it means it importing(accepting)the routes from neighbor devices or VR, VRF etc...

In summary, it is taking the routes from Peer devices 

Juniper Nat configuration sample

A simple one to one nat configuration sample edit copy paste and enjoy.

set security nat source rule-set trust-to-untrust from zone trust

set security nat source rule-set trust-to-untrust to zone untrust-airtel

set security nat source rule-set trust-to-untrust to zone untrust-mtnl

set security nat source rule-set trust-to-untrust rule source-nat-off match destination-address 1.1.23.206/32

set security nat source rule-set trust-to-untrust rule source-nat-off then source-nat off

set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0

set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface

set security nat destination pool pool1 address 172.168.100.152/32

set security nat destination pool pool2 address 172.168.100.19/32

set security nat destination pool pool3 address 172.168.100.74/32

set security nat destination pool pool4 address 172.168.100.47/32

set security nat destination pool pool5 address 172.168.100.220/32

set security nat destination pool pool6 address 172.168.100.221/32

set security nat destination pool pool7 address 172.168.100.222/32

set security nat destination pool pool8 address 172.168.100.223/32

set security nat destination pool pool9 address 172.168.100.224/32

set security nat destination pool pool10 address 172.168.100.225/32

set security nat destination rule-set Dst-Nat-Rule from zone untrust-airtel

set security nat destination rule-set Dst-Nat-Rule rule r1 match destination-address 1.1.23.206/32

set security nat destination rule-set Dst-Nat-Rule rule r1 match destination-port 1433

set security nat destination rule-set Dst-Nat-Rule rule r1 then destination-nat pool pool1

set security nat destination rule-set Dst-Nat-Rule rule r2 match destination-address 1.1.23.206/32

set security nat destination rule-set Dst-Nat-Rule rule r2 match destination-port 491

set security nat destination rule-set Dst-Nat-Rule rule r2 then destination-nat pool pool1

set security nat destination rule-set Dst-Nat-Rule rule r3 match destination-address 1.1.23.206/32

set security nat destination rule-set Dst-Nat-Rule rule r3 match destination-port 80

set security nat destination rule-set Dst-Nat-Rule rule r3 then destination-nat pool pool1

set security nat destination rule-set Dst-Nat-Rule rule r4 match destination-address 1.1.23.206/32

set security nat destination rule-set Dst-Nat-Rule rule r4 match destination-port 88

set security nat destination rule-set Dst-Nat-Rule rule r4 then destination-nat pool pool2

set security nat destination rule-set Dst-Nat-Rule rule r5 match destination-address 1.1.23.206/32

set security nat destination rule-set Dst-Nat-Rule rule r5 match destination-port 3389

set security nat destination rule-set Dst-Nat-Rule rule r5 then destination-nat pool pool4

set security nat destination rule-set Dst-Nat-Rule rule r6 match destination-address 1.1.23.217/32

set security nat destination rule-set Dst-Nat-Rule rule r6 match destination-port 3389

set security nat destination rule-set Dst-Nat-Rule rule r6 then destination-nat pool pool5

set security nat destination rule-set Dst-Nat-Rule rule r7 match destination-address 1.1.23.219/32

set security nat destination rule-set Dst-Nat-Rule rule r7 match destination-port 3389

set security nat destination rule-set Dst-Nat-Rule rule r7 then destination-nat pool pool7

set security nat destination rule-set Dst-Nat-Rule rule r8 match destination-address 1.1.23.220/32

set security nat destination rule-set Dst-Nat-Rule rule r8 match destination-port 3389

set security nat destination rule-set Dst-Nat-Rule rule r8 then destination-nat pool pool8

set security nat destination rule-set Dst-Nat-Rule rule r9 match destination-address 1.1.23.221/32

set security nat destination rule-set Dst-Nat-Rule rule r9 match destination-port 3389

set security nat destination rule-set Dst-Nat-Rule rule r9 then destination-nat pool pool9

set security nat destination rule-set Dst-Nat-Rule rule r10 match destination-address 1.1.23.222/32

set security nat destination rule-set Dst-Nat-Rule rule r10 match destination-port 3389

set security nat destination rule-set Dst-Nat-Rule rule r10 then destination-nat pool pool10

set security nat proxy-arp interface fe-0/0/0.0 address 1.1.23.218/32

set security nat proxy-arp interface fe-0/0/0.0 address 1.1.23.217/32

set security nat proxy-arp interface fe-0/0/0.0 address 1.1.23.219/32

set security nat proxy-arp interface fe-0/0/0.0 address 1.1.23.220/32

set security nat proxy-arp interface fe-0/0/0.0 address 1.1.23.221/32

set security nat proxy-arp interface fe-0/0/0.0 address 1.1.23.222/32

Port mirroring in juniper devices and storm control in EX switch.

--------------------------------------------------------------------------------------------------------------------------
set interfaces ge-0/0/10 unit 0 family ethernet-switching  (My laptop port).
set ethernet-switching-options analyzer employee–monitor input ingress interface ge-0/0/1.0(uplink to qfx port).
set ethernet-switching-options analyzer employee–monitor output interface ge-0/0/10.0 (Laptop interface).
Verification commands
show analyzer
--------------------------------------------------------------------------------------------------------------------------
set interfaces interface-range Access-ports member-range ge-0/0/0 to ge-0/0/10  === > Create interface range including only Access interfaces
set ethernet-switching-options storm-control action-shutdown
set ethernet-switching-options storm-control interface Access-ports level 20  ==== > Call the interface-range under the storm control configuration.
set ethernet-switching-options port-error-disable disable-timeout 20  === > Recovery time out is set to 20 seconds.
--------------------------------------------------------------------------------------------------------------------------
set interfaces interface-range STORM-ACCESS-PORTS member-range ge-0/0/0 to ge-0/0/10
set interfaces interface-range STROM-CONTROL-UPLINK member-range ge-0/0/22 to ge-0/0/23
set ethernet-switching-options port-error-disable disable-timeout 20
set ethernet-switching-options storm-control action-shutdown
set ethernet-switching-options storm-control interface STORM-ACCESS-PORTS level 20
set ethernet-switching-options storm-control interface STROM-CONTROL-UPLINK level 50
set ethernet-switching-options storm-control interface all

To clear if broadcast storm above 50% of bandwidth (if not recovered)

clear ethernet-switching port-error interface ge-0/0/23 (Uplink port)

DMVPN 1,2 and 3 Theory

DMVPN Phase I:(Outdated) This phase involves configuring a single mGRE interface on the hub, and all the spokes are still static tunnels so you won’t get any dynamic spoke-to-spoke connectivity. The only advantage of the phase I setup is the fact the hub router’s configuration is much simpler.



DMVPN Phase II: This phase involves every site being configured with mGRE interface so you get your dynamic spoke-to-spoke connectivity, no more static tunnel destination’s will be configured.



DMVPN Phase III: This phase expands on the scalability of the DMVPN network. This involve summarizing into the DMVPN cloud to provide (Remember EIGRP allows us to summarize out interfaces and BGP allows us to advertise aggregate addresses to neighbors). Along with configuring NHRP redirects and NHRP shortcut switching. NHRP redirects tells the source to find a better path to the destination it is trying to reach. NHRP shortcuts allow DMVPN to learn about other networks behind other DMVPN routers (kind of like ARP for DMVPN).


Preferred routing protocol :- Eigrp/Bgp.

Juniper devices configuration for SNMP and Tacacs

Tacacs configuration:

 

set system authentication-order tacplus

set system authentication-order password

set system accounting events login

set system accounting events change-log

set system accounting events interactive-commands

set system tacplus-server 10.56.252.252 secret (Secret key)

set system tacplus-server 10.56.252.252 single-connection

set system tacplus-server 10.10.0.204 secret (Secret key)

set system tacplus-server 10.10.0.204 single-connection

set system accounting destination tacplus server 10.56.252.252 source-address (switch management vlan IP)

set system accounting destination tacplus server 10.10.0.204 source-address (switch management vlan IP)

set system login user remote uid 2002

set system login user remote class super-user

 

SNMP configuration 

set  snmp location "Bangalore"

set  snmp community AnoopL authorization read-only

set  snmp community AnoopL clients default restrict

set  snmp community AnoopL!vv0 clients 10.10.14.192/26

set  snmp community AnoopL!vv0 clients 10.59.247.192/26

set  snmp community AnoopL!vv0 clients 10.13.45.0/26

set  snmp community AnoopL!vv0 clients 10.59.125.192/26

set  snmp community AnoopL!vv0 clients 10.30.5.128/26

set  snmp community AnoopL!vv0 clients 10.53.126.0/26

set  snmp community Anoopfvu! authorization read-write

set  snmp community Anoopfvu! clients default restrict

set  snmp community Anoopfvu! clients 10.10.14.192/26

set  snmp community Anoopfvu! clients 10.59.247.192/26

set  snmp community Anoopfvu! clients 10.13.45.0/26

set  snmp community Anoopfvu! clients 10.59.125.192/26

set  snmp community Anoopfvu! clients 10.30.5.128/26

set  snmp community Anoopfvu! clients 10.53.126.0/26

set  snmp trap-group Anoopfvu! targets 10.59.247.213

set  snmp trap-group Anoopfvu! version v1

set  snmp trap-group AnoopL!vv0 targets 10.59.247.213

set  snmp trap-group AnoopL!vv0 version v1

 

Polycom Group series 500 Ports

Function	Port Range
point to point call+ People&Content
Gatekeeper Discovery (RAS)	1718-1719 UDP
Q.931 Call Setup	1720 TCP
Audio Call Control	1731 TCP
Video Range	3230-3253 TCP/UDP
Audio Range	3230-3253 TCP/UDP
Data/FECC Range	3230-3253 TCP/UDP
multipoint call+ People&Content
Gatekeeper Discovery (RAS)	1718-1719 UDP
Q.931 Call Setup	1720 TCP
Audio Call Control	1731 TCP
Video Range	3230-3253 TCP/UDP
Audio Range	3230-3253 TCP/UDP
Data/FECC Range	3230-3253 TCP/UDP

BGP Path selection For Cisco devices.

Note referenced by http://www.ciscozine.com/bgp-best-path-selection

Basic configuration for Juniper Qfx Switches

{master:0}[edit]

root# run show configuration |display set |no-more

set version 13.2X51-D35.3

set system host-name S

set system no-multicast-echo

set system no-ping-record-route

set system no-ping-time-stamp

set system arp aging-timer 5

set system internet-options tcp-drop-synfin-set

set system root-authentication encrypted-password

set system login user w uid 2000

set system login user w class super-user

set system login user w authentication encrypted-password Gva8RCKITh1wEGOZ8R7k18DxeAYa"

set system login password minimum-length 8

set system login password maximum-length 22

set system login password minimum-numerics 1

set system login password minimum-upper-cases 1

set system login password minimum-lower-cases 1

set system login password minimum-punctuations 1

set system login password format sha1

set system services ssh protocol-version v2

set system services telnet

set system commit synchronize

set system processes app-engine-virtual-machine-management-service traceoptions level notice

set system processes app-engine-virtual-machine-management-service traceoptions flag all

set chassis redundancy graceful-switchover

set chassis aggregated-devices ethernet device-count 30

set interfaces xe-0/0/46 description "Connected to YBLDRSRVCSW01-Rack 9 - Port - Xe-0/0/38"

set interfaces xe-0/0/46 unit 0 family ethernet-switching interface-mode trunk

set interfaces xe-0/0/46 unit 0 family ethernet-switching vlan members 417

set interfaces xe-0/0/46 unit 0 family ethernet-switching vlan members 428

set interfaces xe-0/0/47 unit 0 family ethernet-switching interface-mode trunk

set interfaces xe-0/0/47 unit 0 family ethernet-switching vlan members 417

set interfaces xe-0/0/47 unit 0 family ethernet-switching vlan members 428

set interfaces xe-1/0/47 unit 0 family ethernet-switching interface-mode trunk

set interfaces xe-1/0/47 unit 0 family ethernet-switching vlan members 417

set interfaces xe-1/0/47 unit 0 family ethernet-switching vlan members 428

set interfaces vme unit 0 family inet address 10.224.252.80/24

set forwarding-options storm-control-profiles default all

set forwarding-options storm-control-profiles sc all bandwidth-level 15000

set routing-options nonstop-routing

set protocols lldp interface all disable

set protocols lldp-med interface all

set protocols igmp-snooping vlan default

set protocols layer2-control nonstop-bridging

set protocols layer2-control bpdu-block disable-timeout 60

set protocols rstp interface xe-0/0/46

set protocols rstp interface xe-0/0/47

set protocols rstp interface xe-1/0/47

set virtual-chassis preprovisioned

set virtual-chassis no-split-detection

set virtual-chassis member 0 role routing-engine

set virtual-chassis member 0 serial-number VF371

set virtual-chassis member 1 role routing-engine

set virtual-chassis member 1 serial-number VF37

set virtual-chassis member 2 role line-card

set virtual-chassis member 2 serial-number PE37

set vlans HSD vlan-id 428

set vlans Management-monitoring vlan-id 417

set vlans default vlan-id 1

set vlans default l3-interface irb.0

Polycom Basic videos

https://www.youtube.com/user/PolycomFederalBlog/videos

People + Content Software link

http://www.polycom.co.in/products-services/hd-telepresence-video-conferencing/realpresence-accessories/people-content-ip.html

Juniper Basic configuration Part 1

How to configure the Vlan in juniper switch

Step 1 , For all configuration process

root@CORESWITCH:RE:0% cli     ß---------------------        CLI MODE only for maintenances

({master:0} ß--------------------------------------------- Operational Mode

root@CORESWITCH>Edit ß-------------------------------- enter into configuration mode for changing the devices configuration only for show commands

{master:0}[edit] ß-----------------------configuration mode for configuration change

Layer 3 Vlan creation in Juniper 

set vlans v1 vlan-id 1                         <v1 is just name /Vlan-id 1 is vlan tagging number it should be same for L3-interface vlan.1

set vlans v1 l3-interface vlan.1   < making this vlan as Layer 3 vlan

set interfaces vlan unit 1 family inet address 10.1.1.1/24                <assigning vlan ip address

Juniper user modes for more please refer below link from Juniper Knowledge web

http://kb.juniper.net/InfoCenter/index?page=content&id=KB15719&smlogin=true

Vlan assignment in juniper 

Assigning the ge-0/0/5 to vlan 1

Step 1 then enter

set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members v1

Juniper Vlan creation for more please refer below link from Juniper Knowledge web

http://www.juniper.net/documentation/en_US/junos11.4/topics/task/configuration/bridging-vlans-ex-series-cli.html

Verification commands for vlan

root@CORE_EX3300_VLAN5# run show ethernet-switching interfaces

ge-0/0/15.0  up     v1                  1    untagged unblocked

Flooding of vlans using trunking

Vlan flooding commands (interface xe-1/0/0 and xe-0/0/0)

set interfaces  xe-1/0/0 unit 0 family ethernet-switching vlan members all

set interfaces  xe-0/0/0 unit 0 family ethernet-switching vlan members all

Trunking commands (interface xe-1/0/0 and xe-0/0/0)

set interfaces xe-1/0/0 unit 0 family ethernet-switching port-mode trunk

set interfaces xe-0/0/0 unit 0 family ethernet-switching port-mode trunk

Juniper Link aggregation (LACP Link aggregation on juniper ex switch)

Step1 need to follow

Before configuring the ae0 need delete the ethernet switch under the interface 

set chassis aggregated-devices ethernet device-count 5

set interfaces ae0 aggregated-ether-options lacp active

set interfaces ge-0/0/0 ether-options 802.3ad ae0              >>>>>Link switch 1 for High Availability

set interfaces ge-0/0/1 ether-options 802.3ad ae0             >>>>>Link switch 2 High Availability

root> show interfaces terse |match ae0

ae0                     up    UP

ae0.0                   up    UP eth-switch

For more references  

http://kb.juniper.net/InfoCenter/index?page=content&id=KB10927

How to configure the DHCP relay

Step 1 need to follow

set forwarding-options helpers bootp server 10.1.2.11  ß------ server ip address of DHCP

set forwarding-options helpers bootp interface vlan.4  ß--which vlan should get the ip address

set forwarding-options helpers bootp interface vlan.5

set forwarding-options helpers bootp interface vlan.6

set forwarding-options helpers bootp interface vlan.8

set forwarding-options helpers bootp interface vlan.7

For more references

http://kb.juniper.net/InfoCenter/index?page=content&id=KB11020

How enable Juniper stacking

In Juniper Ex3300 is using hardware stacking so not required to  put the CLI commands for doing the stacking Port number xe-0/0/2 and xe-0/0/3 are already in stacked mode (only required to doing the cabling part)

For more information on Ex3300 stacking

http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/reference/requirements/cable-ex3300-virtual-chassis-cabling-examples.html

Stacking in 4550 juniper switch

We required choosing the link first and enabling the stacking on them.

Request virtual-chassis vc-port set pic-slot 0 port  xe-0/0/31 ß and restart  /switch1

Request virtual-chassis vc-port set pic-slot 0 port  xe-0/0/31 ß switch 2

Verification commands

Show interface terse

Show interface Xe-0/0/30

root> show virtual-chassis status

Virtual Chassis ID: cff4.00d3.611b

Virtual Chassis Mode: Enabled

                                           Mstr           Mixed Neighbor List

Member ID  Status   Serial No    Model     prio  Role      Mode ID  Interface

0 (FPC 0)  Prsnt    GB0215061093 ex3300-48p 128  Master*     NA  1  vcp-255/1/2

                                                                 3  vcp-255/1/3

1 (FPC 1)  Prsnt    GB0215060650 ex3300-48p 128  Linecard    NA  2  vcp-255/1/2

                                                                 0  vcp-255/1/3

2 (FPC 2)  Prsnt    GB0215060913 ex3300-48p 128  Linecard    NA  3  vcp-255/1/2

                                                                 1  vcp-255/1/3

3 (FPC 3)  Prsnt    GB0215060607 ex3300-48p 128  Backup      NA  0  vcp-255/1/2

                                                                 2  vcp-255/1/3

For more references

http://www.juniper.net/techpubs/en_US/release-independent/junos/information-products/pathway-pages/ex-series/ex4550/ex4550.html