100G world

100G transceivers have been around for few years already and it is getting affordable since 2016 I guess, and it is now practical to shift to 100G instead of burning N x 10GEs.  To see more info about 100G transmission principles, I find this link very informative -> https://community.fs.com/blog/understand-100g-transceivers-transmission-principles.html

Here are sample 100G transceivers we deployed in our datacenters, it really depends on what type of vendor or hardware you have, but the most popular now is the QSFPs

Juniper 

QSFP-100GBASE-LR4 (blue) -->  100GBASE Ethernet throughput up to 10km over single mode fiber (SMF) using a wavelength of 1310nm via duplex LC connector 

QSFP-100G-SR4 (gold) --> 100GBASE Ethernet throughput up to 100m over OM4 multimode fiber (MMF) using a wavelength of 850nm via a MTP/MPO-12 connector

 

Cisco

CPAK-100G-LR4 -->  support 100Gbps optical links over standard Single-Mode Fiber (SMF) with SC or LC connectors

 

SNMPv2c and SNMPv3 Polling and Traps Configuration in Cisco (IOS-XR)

SNMPv2c

community: snmpcomm123

management IP address: 192.168.10.100

SNMP Polling Server: 192.168.20.199

SNMP Trap Server: 192.168.20.200

SNMPv2c Polling Configuration:

ipv4 access-list SNMP-ALLOW

 10 permit ipv4 host 192.168.20.199 any

snmp-server contact DC-ADMIN

snmp-server location Datacentre

snmp-server trap-source Loopback0

snmp-server community snmpcomm123 RO SystemOwner IPv4 SNMP-ALLOW

SNMPv2c Traps Configuration:

configure

snmp-server traps

snmp-server host 192.168.20.200 traps snmpcomm123  

Verify:

/usr/bin/snmpwalk -M /usr/local/snmp/mibs -v2c -c snmpcomm123 192.168.10.100:161 sysDescr.0 

SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS XR Software (Cisco ASR9K Series),  Version 6.2.3[Default]

Copyright (c) 2018 by Cisco Systems, Inc.

SNMPv3

user: snmpuser

Security Level: Authpriv with SHA authentication and AES 128bit Privacy

management IP address: 192.168.10.100

AuthPass: authpass123!

PrivPass: privpass123!

View Name: ALLVIEW
Username:

Group Name: SNMPGROUP

SNMP Polling Server: 192.168.20.199

SNMP Trap Server: 192.168.20.200

SNMPv3 Polling Configuration:

ipv4 access-list SNMP-ALLOW

 10 permit ipv4 host 192.168.20.199 any

snmp-server view ALLVIEW 1.3 included

snmp-server group SNMPGROUP  v3 priv notify ALLVIEW read ALLVIEW IPv4 SNMP-ALLOW

snmp-server user SNMPUSER SNMPGROUP v3 auth sha authpass123! priv aes 128 privpass123! IPv4 SNMP-ALLOW

SNMPv3 Traps Configuration:

snmp-server host 192.168.20.200 traps version 3 priv SNMPUSER

Additional Tip: (Manual trigger of SNMP traps)

#snmp test trap interface link-down
#snmp test trap interface link-up

Here's the Juniper version for SNMPv2c and SNMPv3 configuration --> SNMP Configuration in Juniper

Control Plane Policing (CoPP) Configuration in Cisco IOS

As per Cisco website definition:

Control Plane Policing (CoPP) is a Cisco IOS-wide feature designed to allow users to manage the flow of traffic handled by the route processor of their network devices. CoPP is designed to prevent unnecessary traffic from overwhelming the route processor that, if left unabated, could affect system performance.

Here's a sample configuration in applying CoPP.

Step1: Create necessary ACLs 

a. Important services,e.g.NTP,SSH,SNMP

ip access-list extended SSH-ACL

 permit tcp host 192.168.10.10 any eq 22

 permit tcp host 192.168.20.20 any eq 22

 deny   tcp any any eq 22

ip access-list standard SNMP-ACL

 permit 192.168.30.30

 permit 192.168.40.40

ip access-list standard NTP-ACL

 permit 172.16.18.2

 permit 172.16.18.3

b.ICMP

ip access-list extended ICMP-ACL

  permit icmp any any echo

  permit icmp any any echo-reply

  permit icmp any any ttl-exceeded

  permit icmp any any port-unreachable

c. IGP

ip access-list extended IGP-ACL

  permit ospf any any

  permit tcp 192.168.3.0 0.0.0.255 192.168.3.0 0.0.0.255 eq bgp

  permit tcp 192.168.3.0 0.0.0.255 eq bgp 192.168.3.0 0.0.0.255

d. Those harmful services or traffic

ip access-list extended HARMFUL-ACL

 permit tcp any any fragments

 permit udp any any fragments

 permit icmp any any fragments

 permit ip any any fragments

 permit udp any any range netbios-ns netbios-ss

 permit tcp any any eq 445

 permit udp any any eq 445

 permit udp any any eq 1434

 permit tcp any any range 137 139

e. All traffic

ip access-list extended ALL-ACL

 permit pim any any

 permit igmp any any

 permit icmp any any

 permit gre any any

 permit tcp any any

 permit udp any any

 permit ip any any

Step2: Configure Class Map

class-map match-any CoPP-SSH-SNMP-NTP

 match access-group name SSH-ACL

 match access-group name SNMP-ACL

 match access-group name NTP-ACL

class-map match-all CoPP-ICMP

 match access-group name ICMP-ACL

class-map match-all CoPP-IGP

 match access-group name IGP-ACL

class-map match-all CoPP-HARMFUL

 match access-group name HARMFUL-ACL

class-map match-all CoPP-ALL

 match access-group name ALL-ACL

Step3:Configure Policy Map (conform and exceed-action can be transmit or drop)

 police  [Target Bit Rate] [burst bytes] [burst bytes] [burst bytes] [conform-action] [transmit/drop]  [exceed-action] [transmit/drop]

 police  [cir]  [Target Bit Rate]  [conform burst] [burst bytes] [excess burst] [burst bytes] [conform-action] [transmit/drop]  [exceed-action] [transmit/drop]

Assumption: 5% excess burst

policy-map CoPP

  class CoPP-SSH-SNMP-NTP

  police 200000 10000 10000 conform-action transmit  exceed-action transmit

class CoPP-ICMP

  police 200000 10000 10000  conform-action transmit  exceed-action transmit

 class CoPP-IGP

  police 500000 25000 25000 conform-action transmit  exceed-action transmit

 class CoPP-HARMFUL

  police cir 40000 bc 2000 be 2000 conform-action transmit  exceed-action drop

 class CoPP-ALL

  police 300000 15000 15000 conform-action transmit  exceed-action transmit

For CoPP Best Practices,you can refer to this Cisco CoPP Best Practices

Configuring NetFlow in Cisco (IOS-XR and Nexus OS) and Juniper (JunOS)

Cisco IOS-XR:

The NetFlow use these 3 maps to configure

Step1. EXPORTER MAP - configure parameters like export destination IP, udp port (only supported transport protocol), source interface

IPv4:

flow exporter-map NETFLOW-EXPORTER-MAP

 version v9

  transport udp 9991

  source Loopback0

  destination 192.168.30.100

IPv6:

flow exporter-map IPv6-NETFLOW-EXPORTER-MAP

 version v9

  transport udp 9991

  source Loopback0

  destination 192.168.30.100

Note: destination  udp port can be from  <1024-65535> (this is where Netflow is listening)

Step2. MONITOR MAP includes flow record map and flow exporter map. Some of the attriubtes that can be configured like number of cache entries and timeout. Record that supports are ipv4, ipv6 and mpls.

IPv4:

flow monitor-map NETFLOW-MONITOR-MAP

 record ipv4

 exporter NETFLOW-EXPORTER-MAP

 cache timeout active 10

 cache entries 1000

IPv6:

flow monitor-map IPv6-NETFLOW-MONITOR-MAP

 record ipv6

 exporter IPv6-NETFLOW-EXPORTER-MAP

 cache timeout active 10

 cache entries 1000

3.SAMPLER MAP - configure the packet rate (one out of n packets) to sample

sampler-map NETFLOW-SAMPLER-MAP

 random 1 out-of 100

sampler-map IPv6-NETFLOW-SAMPLER-MAP

 random 1 out-of 100

Note: Sampling interval to use random mode for sampling packets of 1 through 65535 units

Application:

Apply in interface (can be applied in L3 bundle or physical interface, on single or both direction)

configure

  interface Te0/0/0/0

   flow ipv4 monitor NETFLOW-MONITOR-MAP sampler NETFLOW-SAMPLER-MAP ingress

   flow ipv6 monitor IPv6-NETFLOW-MONITOR-MAP sampler NETFLOW-SAMPLER-MAP ingress

Cisco Nexus:

[Pre-config] Enable netflow 

configure 

 feature netflow

Step1. Configure EXPORTER MAP

flow exporter ExporterMap

  description Exporter Map to Netflow Server

  destination 192.168.30.100 use-vrf management

  transport udp 9991

  source mgmt0

  version 9

    option exporter-stats timeout 120

    option sampler-table timeout 120

Step2. Configure MONITOR MAP

flow monitor MonitorMap

  record netflow-original

  exporter ExporterMap

where:netflow-original  is the traditional IPv4 input NetFlow with origin ASs

 or can use a customized flow record

e.g.

flow record CustomRecord

  match ipv4 source address

  match ipv4 destination address

  match ip protocol

  match ip tos

  match transport source-port

  match transport destination-port

  collect transport tcp flags

  collect counter bytes

  collect counter packets

flow monitor MonitorMap

  record CustomRecord

  exporter ExporterMap

Step3. Configure SAMPLER MAP

sampler SamplerMap

  mode 1 out-of 100

Application:

configure

 interface Eth1/1

 ip flow monitor MonitorMap input sampler SamplerMap

Juniper (JunOS):

Step1. Configure EXPORTER MAP

set services flow-monitoring version9 template NETFLOW_MONITOR template-refresh-rate seconds 15

set services flow-monitoring version9 template NETFLOW_MONITOR option-refresh-rate seconds 15

set services flow-monitoring version9 template NETFLOW_MONITOR ipv4-template

Step2. Configure MONITOR MAP

set forwarding-options sampling instance NETFLOW_INSTANCE family inet output flow-server 192.168.30.100 port 9991

set forwarding-options sampling instance NETFLOW_INSTANCE family inet output flow-server 192.168.30.100 source-address 192.168.1.100

set forwarding-options sampling instance NETFLOW_INSTANCE family inet output flow-server 192.168.30.100 version9 template NETFLOW_MONITOR

set forwarding-options sampling instance NETFLOW_INSTANCE family inet output inline-jflow source-address 192.168.1.100

Step3. Configure SAMPLER MAP

set forwarding-options sampling instance NETFLOW_INSTANCE input rate 100

set forwarding-options sampling instance NETFLOW_INSTANCE input run-length 0

Application:

set interfaces ge-0/0/0 unit 0 family inet sampling input

Configuring Banner or Login Message in Cisco and Juniper

Taking Cisco's  Sample Legal Banner message from their Network Security Baseline page.

Sample Legal Banner Notification Configuration

! Present a legal notification banner approved by company legal counsel

banner login #

UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED

You must have explicit, authorized permission to access or configure this device.

Unauthorized attempts and actions to access or use this system may result in civil and/or 

criminal penalties.

All activities performed on this device are logged and monitored.

#

!

Here's how to configure for:

Cisco

RP/0/0/CPU0:R3#configure 

Wed Jun 24 05:33:02.134 UTC

RP/0/0/CPU0:R3(config)#banner login #

Enter TEXT message. End with the character '#'

*************************************************************************

        UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED

You must have explicit, authorized permission to access or configure this 

device.Unauthorized attempts and actions to access or use this system may

result in civil and/or criminal penalties. 

All activities performed on this device are logged and monitored.

*************************************************************************

#

RP/0/0/CPU0:R3#commit

Sample Output:

Juniper

darwin@vMX-1>configure

darwin@vMX-1#set system login message "\n*************************************************************************\n       UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED\n\nYou must have explicit, authorized permission to access or configure this \ndevice.Unauthorized attempts and actions to access or use this system may \nresult in civil and/or criminal penalties.\nAll activities performed on this device are logged and monitored.\n\n*************************************************************************\n\n"

darwin@vMX-1#commit

As per Juniper website, message can be formatted using these following characters:

\n—New line

\t—Horizontal tab

\'—Single quotation mark

\"—Double quotation mark

\\—Backslash

Sample output:

Sample Juniper Firewall Configuration to Protect Routing Engines

Here's sample firewall configuration in protecting the box and its services.

ICMP:
ICMP message types are essential for network administration and troubleshooting. There are quite a number of ICMP parameters, you can refer to IANA ICMP Parameters for the list or if you want to learn more details about ICMP can refer to RFC792.
Here's the 4 types I consider useful for troubleshooting and need to be allowed.


Type 0 — Echo Reply --> response from target to host
Type 8 — Echo Request--> host to target
Type 11 — Time Exceeded --> returned to host when doing traceroute
Type 3 — Destination Unreachable --> for MTU path discovery

Pre-config (create a policer)

set firewall policer limit-128k if-exceeding bandwidth-limit 128k

set firewall policer limit-128k if-exceeding burst-size-limit 15k

set firewall policer limit-128k then discard

Juniper Configuration:
set firewall family inet filter FIREWALL-RE term ICMP_PING from protocol icmp
set firewall family inet filter FIREWALL-RE term ICMP_PING from icmp-type echo-request
set firewall family inet filter FIREWALL-RE term ICMP_PING from icmp-type echo-reply
set firewall family inet filter FIREWALL-RE term ICMP_PING then policer limit-128k
set firewall family inet filter FIREWALL-RE term ICMP_PING then count ICMP
set firewall family inet filter FIREWALL-RE term ICMP_PING then accept

set firewall family inet filter FIREWALL-RE term ICMP_TTL from protocol icmp
set firewall family inet filter FIREWALL-RE term ICMP_TTL from icmp-type time-exceeded
set firewall family inet filter FIREWALL-RE term ICMP_TTL from icmp-type unreachable
set firewall family inet filter FIREWALL-RE term ICMP_TTL then policer limit-128k
set firewall family inet filter FIREWALL-RE term ICMP_TTL then accept

SSH:

It is recommended to use SSH for remote access for better security. Telnet is strictly discourage because of unencrypted communication for potential network sniffing.

Juniper Configuration:

set firewall family inet filter FIREWALL-RE term REMOTE_ACCESS from source-prefix-list SSH-PREFIX-LIST

set firewall family inet filter FIREWALL-RE term REMOTE_ACCESS from protocol tcp

set firewall family inet filter FIREWALL-RE term REMOTE_ACCESS from port ssh

set firewall family inet filter FIREWALL-RE term REMOTE_ACCESS then count REMOTE_ACCESS

set firewall family inet filter FIREWALL-RE term REMOTE_ACCESS then accept

set policy-options prefix-list SSH-PREFIX-LIST 192.168.10.101/32

set policy-options prefix-list SSH-PREFIX-LIST 192.168.10.102/32

where: 192.168.10.101 & 102 are the authorized IPs that are allowed to SSH into the device.

Related config: SSH Configuration Examples in Cisco (IOS,IOS-XE,NX-OS,IOS-XR) and Juniper(JunOS)

AAA(Tacacs):

Juniper Configuration:

set firewall family inet filter FIREWALL-RE term AAA_ALLOW from source-prefix-list TACACS-PREFIX-LIST

set firewall family inet filter FIREWALL-RE term AAA_ALLOW from protocol tcp

set firewall family inet filter FIREWALL-RE term AAA_ALLOW from source-port tacacs

set firewall family inet filter FIREWALL-RE term AAA_ALLOW then count AAA

set firewall family inet filter FIREWALL-RE term AAA_ALLOW then accept

set policy-options prefix-list TACACS-PREFIX-LIST  192.168.10.200/32

where: 192.168.10.200 is Tacacs Server

See more details here for Tacacs (Authentication and Accounting) Configuration in Juniper

SNMP:

Juniper Configuration:

set firewall family inet filter FIREWALL-RE term SNMP_ALLOW from source-prefix-list SNMP-PREFIX-LIST

set firewall family inet filter FIREWALL-RE term SNMP_ALLOW from protocol udp

set firewall family inet filter FIREWALL-RE term SNMP_ALLOW from destination-port snmp

set firewall family inet filter FIREWALL-RE term SNMP_ALLOW then count SNMP

set firewall family inet filter FIREWALL-RE term SNMP_ALLOW then accept

set policy-options prefix-list SNMP-PREFIX-LIST  192.168.20.200/32

where: 192.168.20.200 is SNMP Polling Server

Related config: SNMPv2c and SNMPv3 Pollling and Traps Configuration in Juniper

NTP:

Juniper Configuration:

set firewall family inet filter FIREWALL-RE term NTP_ALLOW from source-prefix-list NTP-PREFIX-LIST

set firewall family inet filter FIREWALL-RE term NTP_ALLOW from protocol udp

set firewall family inet filter FIREWALL-RE term NTP_ALLOW from port ntp

set firewall family inet filter FIREWALL-RE term NTP_ALLOW then policer limit-128k

set firewall family inet filter FIREWALL-RE term NTP_ALLOW then count NTP

set firewall family inet filter FIREWALL-RE term NTP_ALLOW then accept

set policy-options prefix-list NTP-PREFIX-LIST  192.168.30.200/32

where: 192.168.30.200 is NTP Server

Related config: NTP Configuration via Management Routing Instance in Juniper

IP Protocols

OSPF

set firewall family inet filter FIREWALL-RE term OSPF_ALLOW from protocol ospf

set firewall family inet filter FIREWALL-RE term OSPF_ALLOW then count OSPF

set firewall family inet filter FIREWALL-RE term OSPF_ALLOW then accept

LDP

set firewall family inet filter FIREWALL-RE term LDP_ALLOW from protocol tcp

set firewall family inet filter FIREWALL-RE term LDP_ALLOW from protocol udp

set firewall family inet filter FIREWALL-RE term LDP_ALLOW from port 646

set firewall family inet filter FIREWALL-RE term LDP_ALLOW then count LDP

set firewall family inet filter FIREWALL-RE term LDP_ALLOW then accept

set firewall family inet filter FIREWALL-RE term LDP_ALLOW then accept

RSVP

set firewall family inet filter FIREWALL-RE term RSVP_ALLOW from protocol rsvp

set firewall family inet filter FIREWALL-RE term RSVP_ALLOW then count RSVP

set firewall family inet filter FIREWALL-RE term RSVP_ALLOW then accept

PIM

set firewall family inet filter FIREWALL-RE term PIM_ALLOW from protocol pim

set firewall family inet filter FIREWALL-RE term PIM_ALLOW then count PIM

set firewall family inet filter FIREWALL-RE term PIM_ALLOW then accept

IGMP

set firewall family inet filter FIREWALL-RE term IGMP_ALLOW from protocol igmp

set firewall family inet filter FIREWALL-RE term IGMP_ALLOW then count IGMP

set firewall family inet filter FIREWALL-RE term IGMP_ALLOW then accept

MSDP

set firewall family inet filter FIREWALL-RE term MSDP_ALLOW from protocol tcp

set firewall family inet filter FIREWALL-RE term MSDP_ALLOW from protocol udp

set firewall family inet filter FIREWALL-RE term MSDP_ALLOW from port msdp

set firewall family inet filter FIREWALL-RE term MSDP_ALLOW then count MSDP

BGP

set firewall family inet filter FIREWALL-RE term BGP_ALLOW from source-prefix-list BGP-PREFIX-LIST

set firewall family inet filter FIREWALL-RE term BGP_ALLOW from protocol tcp

set firewall family inet filter FIREWALL-RE term BGP_ALLOW from port bgp

set firewall family inet filter FIREWALL-RE term BGP_ALLOW then count BGP

set firewall family inet filter FIREWALL-RE term BGP_ALLOW then accept

set policy-options prefix-list BGP-PREFIX-LIST  192.168.40.0/24

Others

BFD

set firewall family inet filter FIREWALL-RE term BFD_ALLOW from protocol udp

set firewall family inet filter FIREWALL-RE term BFD_ALLOW from source-port 49152-65535

set firewall family inet filter FIREWALL-RE term BFD_ALLOW from destination-port 3784

set firewall family inet filter FIREWALL-RE term BFD_ALLOW then count BFD

set firewall family inet filter FIREWALL-RE term BFD_ALLOW then accept

Traceroute

set firewall family inet filter FIREWALL-RE term TRACEROUTE from protocol udp

set firewall family inet filter FIREWALL-RE term TRACEROUTE from destination-port 33434-33678

set firewall family inet filter FIREWALL-RE term TRACEROUTE then policer limit-128k

set firewall family inet filter FIREWALL-RE term TRACEROUTE then count TRACEROUTE

set firewall family inet filter FIREWALL-RE term TRACEROUTE then accept

FINALLY.... need to put this "discard" statement at the end.

set firewall family inet filter FIREWALL-RE term REJECT_ALL then count REJECT_ALL

set firewall family inet filter FIREWALL-RE term REJECT_ALL then discard

Apply:

set interfaces lo0 unit 0 family inet filter input FIREWALL-RE

How does it looks like?

Policer:

lab@vMX-1> show configuration firewall policer limit-128k 

if-exceeding {

    bandwidth-limit 128k;

    burst-size-limit 15k;

}

then discard;

Firewall:

lab@vMX-1> show configuration firewall 

family inet {

    filter FIREWALL-RE {

        term ICMP_PING {

            from {

                protocol icmp;

                icmp-type [ echo-request echo-reply ];

            }

            then {

                policer limit-128k;

                count ICMP;

                accept;

            }

        }

        term ICMP_TTL {

            from {

                protocol icmp;

                icmp-type [ time-exceeded unreachable ];

            }

            then {

                policer limit-128k;

                accept;

            }

        }

        term REMOTE_ACCESS {            

            from {

                source-prefix-list {

                    SSH-PREFIX-LIST;

                }

                protocol tcp;

                port ssh;

            }

            then {

                count REMOTE_ACCESS;

                accept;

            }

        }

        term AAA_ALLOW {

            from {

                source-prefix-list {

                    TACACS-PREFIX-LIST;

                }

                protocol tcp;

            }

        }

        term SNMP_ALLOW {

            from {

                source-prefix-list {    

                    SNMP-PREFIX-LIST;

                }

                protocol udp;

                destination-port snmp;

            }

            then {

                count SNMP;

                accept;

            }

        }

        term NTP_ALLOW {

            from {

                source-prefix-list {

                    NTP-PREFIX-LIST;

                }

                protocol udp;

                port ntp;

            }

            then {

                policer limit-128k;

                count NTP;

                accept;

            }                           

        }

        term OSPF_ALLOW {

            from {

Prefix-sets

lab@vMX-1> show configuration policy-options 

prefix-list SSH-PREFIX-LIST {

    192.168.10.101/32;

    192.168.10.102/32;

}

prefix-list TACACS-PREFIX-LIST {

    192.168.10.200/32;

}

prefix-list SNMP-PREFIX-LIST {

    192.168.20.200/32;

}

prefix-list NTP-PREFIX-LIST {

    192.168.30.200/32;

}

prefix-list BGP-PREFIX-LIST {

    192.168.40.0/24;

}

                protocol ospf;

            }

            then {

                count OSPF;

                accept;

            }

        }

        term LDP_ALLOW {

            from {

                protocol [ tcp udp ];

                port 646;

            }

            then {

                count LDP;

                accept;

            }

        }

        term RSVP_ALLOW {

            from {

                protocol rsvp;          

            }

            then {

                count RSVP;

                accept;

            }

        }

        term PIM_ALLOW {

            from {

                protocol pim;

            }

            then {

                count PIM;

                accept;

            }

        }

        term IGMP_ALLOW {

            from {

                protocol igmp;

            }

            then {

                count IGMP;

                accept;

            }                           

        }

        term MSDP_ALLOW {

            from {

                protocol [ tcp udp ];

                port msdp;

            }

            then count MSDP;

        }

        term BGP_ALLOW {

            from {

                source-prefix-list {

                    BGP-PREFIX-LIST;

                }

                protocol tcp;

                port bgp;

            }

            then {

                count BGP;

                accept;

            }

        }

        term BFD_ALLOW {

            from {                      

                protocol udp;

                source-port 49152-65535;

                destination-port 3784;

            }

            then {

                count BFD;

                accept;

            }

        }

        term TRACEROUTE {

            from {

                protocol udp;

                destination-port 33434-33678;

            }

            then {

                policer limit-128k;

                count TRACEROUTE;

                accept;

            }

        }

        term REJECT_ALL {

            then {

                count REJECT_ALL;       

                discard;

            }

        }

    }

}

policer limit-128k {

    if-exceeding {

        bandwidth-limit 128k;

        burst-size-limit 15k;

    }

    then discard;

}

Apply in interface loopback

lab@vMX-1> show configuration interfaces lo0 

unit 0 {

    family inet {

        filter {

            input FIREWALL-RE;

        }

    }

}

Hidden Command to support 3rd-Party Transceivers for Cisco

service unsupported-transceiver

Why considered hidden? Because you won't see it in the command.

Sample output:

RP/0/RSP1/CPU0:CORE1#ser?

service

RP/0/RSP1/CPU0:CORE1#service ?

  redundancy  Service Director related commands.

Applying:

Cisco IOS-XE

Router1(config)#service unsupported-transceiver

Warning: When Cisco determines that a fault or defect can be traced to

the use of third-party transceivers installed by a customer or reseller,

then, at Cisco's discretion, Cisco may withhold support under warranty or

a Cisco support program. In the course of providing support for a Cisco

networking product Cisco may require that the end user install Cisco

transceivers if Cisco determines that removing third-party parts will

assist Cisco in diagnosing the cause of a support issue.

Cisco IOS-XR

RP/0/RSP1/CPU0:CORE1#configure

RP/0/RSP1/CPU0:CORE1(config)#service unsupported-transceiver

RP/0/RSP1/CPU0:CORE1(config)#show configuration

Wed Jun 17 19:08:29.229 SST

Building configuration...

!! IOS XR Configuration 5.3.3

service unsupported-transceiver

end

Additional:

There's this command "transceiver permit pid all" applied under the interface.

RP/0/RSP1/CPU0:CORE1(config)#commit

RP/0/RSP1/CPU0:CORE1(config)#interface GigabitEthernet0/1/0/0

RP/0/RSP1/CPU0:CORE1(config-if)#transceiver permit ?

  pid  Permit pluggable pid (Product ID) all

RP/0/RSP1/CPU0:CORE1(config-if)#transceiver permit pid all