Miftah Rahman (Go)-Blog

BGP Configuration on JunOS

April 4, 2016

Play time with JunOS BGP !!!

This article will cover e-BGP, i-BGP, Route Advertisement, and Local Preference configuration on JunOS

Network Design

e-BGP configuration

e-BGP on J1 (J2 and J3 can be done accordingly)

set router-id first…

And then set neighborship

i-BGP configuration

i-BGP on J2 (J3 can be done accordingly)

We can see that J2 has 2 groups…1 for i-BGP peers and 1 for e-BGP peers

BGP Neighborship

Lets take a look at BGP Neighborship on J3 after all converges

show bgp summary

BGP Route Advertisement

BGP Route Advertisement on J1 (J2 and J3 can be done accordingly)

Set policy for advertising the routes, for example we want J1 to advertise 1.1.1.1 from its loopback

Then export the policy into BGP group external

Route advertisement verification on J2

Route advertisement on J2 is slightly a little bit different, we export the policy ABOVE the BGP group (right after we set protocol bgp)

So, both internal and external BGP get the routes

Verification on J1

Configuring Path Modification via Local Preference

Accourding to “show route protocol bgp”, we get information that route 2.2.2.2 can be reach via em0.0 (through J2)

Now lets change it…route 2.2.2.2 will be reached via em1.0 (through J3)

Configure local preference on R1

Import the policy into BGP group *screenshot missing…I forgot haha*

Verification

IPSec Site2Site with VTI (Virtual Tunnel Interface)

September 10, 2015

Kemaren kita bahas tentang salah satu varian Cisco VPN, yaitu DMVPN

Sekarang kita bahas tentang varian lainnya, yaitu VTI (Virtual Tunnel Interface)

Pre-requisite:

GRE (knowledge about DMVPN dan Secure DMVPN much preferred)

———————————————————————

Why VTI?

Kelemahan dari DMVPN adalah dalam pemakaian tunnel-nya, klo kita mau konek ke branch, kita pointing ke IP tunnel-nya (tul gak?!?), bikin IP baru lagi dong (taro di tunnel), dan yang pasti management IP lebih berat lagi dong, belum lagi ga terlalu “routable” itu IP di tunnel (fungsi IP tunnel-nya itu kan buat konekin tunnel satu ke yang lain…itu tok)

Nah, kelemahan ini yang VTI eliminasi, di interface tunnel ga perlu ada IP, pointing tunnel-nya ke IP “beneran” (biasa ke loopback)

Kok bisa? Lets take a look at the network diagram and configuration below

Take a look at “int tunnel 1” with no ip address and replaced by “ip unnumbered loopback 1” command alias R1 akan pointing IP Address tunnel-nya ke loopback

Untuk maksud “tunnel mode ipsec ipv4” dan “tunnel protection ipsec profile [nama]” sudah dijelaskan di Secure DMVPN (artinya lu harus setting sendiri profile-nya…liat aja caranya di link yang gw kasih)

Untuk routing bisa sendirilah…gw pake default route aja

Lets verify is VTI tunnel kita dapet IP apa engga

Take a look at IP address Tunnel1…IP-nya adalah 1.1.1.1, method TFTP…artinya VTI Tunnel kita dapet IP

Lets ping to the R3 tunnel (which is 3.3.3.3)

Done…

——————————————————-

Bonus…

Advantages of VTI

Karena kita pake interface “beneran” (yang IP-nya routable), berarti kita juga bisa taro QoS di VTI

Contohnya…klo ada traffic make IP loopback untuk koneksi normal kita kasi precedence 4 (semakin tinggi nilai semakin di prioritaskan), sedangkan klo ada traffic make IP looback buat VPN-an kita kasi precedence 2 (that’s great!!!)

Nyok kita liat…

Bikin Klasifikasi Traffic (Class-map) dulu …untuk misahin traffic biasa (FastEth-Class) dan traffic VTI (VTI-Class)

Trus bikin Policy untuk masing2 traffic (Policy-map), lalu taro de di interface tunnel dengan service policy output [nama policy-map] seperti yang kita lihat dibawah ini