Wednesday 25 March 2020

Configure Management Interface in Juniper

One of the best security practices in networking is separation of management traffic and data/control traffic. One way to achieve this is to use the management ports of Juniper devices to physically connect it preferably to different network.
The management Ethernet interface is usually em0 or fxp0 in Juniper, and provides out-of-band(OOB)management network of the device.
Assuming UTP cables are already connected to both management ports of both routing engine (RE) of the Juniper devices, here are the steps to follow:

1. Configure the following management IP address.
e.g.
re0 = 192.168.1.20
re1 = 192.168.1.21
vip = 192.168.1.22

configure:
#set groups re0 system host-name JUNOS-BOX-re0
#set groups re0 interfaces em0 unit 0 family inet address 192.168.1.22/26 master-only
#set groups re0 interfaces em0 unit 0 family inet address 192.168.1.20/26

#set groups re1 system host-name JUNOS-BOX-re1
#set groups re1 interfaces em0 unit 0 family inet address 192.168.1.22/26 master-only
#set groups re1 interfaces em0 unit 0 family inet address 192.168.1.21/26


It will be something like this when use show command
networkbio@JUNOS-BOX-re0# show groups re0
system {
    host-name JUNOS-BOX-re0;
}
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 192.168.1.22/26 {
                    master-only;
                }
                address 192.168.1.20/26;
            }
        }
    }
}



networkbio@JUNOS-BOX-re0# show groups re1
system {
    host-name JUNOS-BOX-re1;
}
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 192.168.1.22/26 {
                    master-only;
                }
                address 192.168.1.21/26;
            }
        }
    }
}

2. Configure Routing instance for management.  The name of the dedicated management instance is reserved and hardcoded as mgmt_junos. 
The name of the dedicated management instance is reserved and hardcoded as mgmt_junos

As per Juniper official website:
Once the mgmt_junos routing instance is deployed, management traffic no longer shares a routing table (that is, the default.inet.0 table) with other control or protocol traffic in the system, nor is configuring dynamic protocols on the management interface supported.

#set system management-instance

3. Configure the next-hop (192.168.1.1 is the gateway)

#set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 next-hop 192.168.1.1

Commands to verify:
show route
show route protocol static
show route forwarding-table


No comments:

Post a Comment