Eric Radman : a Journal

Juniper EX Configuration

The following are notes on configuring the Juniper EX2300-C at home.

USB console

Juniper switches can be managed over a USB since they have a built-in UART

uslcom0 at uhub0 port 4 configuration 1 interface 0 "Silicon Labs CP2104 USB to UART Bridge Controller" rev 2.00/1.00 addr 8
ucom0 at uslcom0 portno 0

To switch output to the USB console run

set system ports auxiliary port-type mini-usb

Now I can connect from my router running OpenBSD using

cu -l cuaU1

Configuring SSH

Enable a management interface

set interfaces me0 unit 0 family inet address 192.168.0.7/24
set routing-options static route 0.0.0.0/0 next-hop 192.168.0.1

Set accepted cypers

set system services ssh hostkey-algorithm ssh-ed25519

Add users

set system login user eradman class super-user
set system login user eradman authentication ssh-ed25519 "ssh-ed25519 key..."

Upgrading JunOS

> show version
> request system software add http://192.168.0.11/junos-arm-32-18.2R3-S5.3.tgz reboot

Or if there isn't enough space

> request system software add http://192.168.0.11/junos-arm-32-18.2R3-S5.3.tgz force unlink no-copy

Remote Sequential Execution Tool

Enabling root login provides access to the Unix shell over SSH, which will allow us to use rset(1) to configure the switch

set system root-authentication ssh-ed25519 "ssh-ed25519 key..."
set system services ssh root-login deny-password

Now that we have SSH access to the JunOS/FreeBSD userland we can add a route entry

# routes.pln
192.168.0.2: juniper/
    ex2300-c.pln

Remember to change the connecting user to root

# ~/.ssh/config
Host 192.168.0.7
  ConnectTimeout=5
  User root

Now we can define the system configuration in a heredoc and run with Junper's cli tool

# ex2300-c.pln
interfaces:
    cli <<-!!
    configure
    load set juniper/ex2300-c
    show | compare
    !!

# vim:noexpandtab:syntax=sh:ts=4

Trunk Interfaces to an OpenBSD Router

First we'll define the vlans on the switch

set vlans vlan80 description wired
set vlans vlan80 vlan-id 80
set vlans vlan80 l3-interface irb.80

set vlans vlan81 description wireless
set vlans vlan81 vlan-id 81
set vlans vlan81 l3-interface irb.81

Instead of using the management interface, you can install a layer 3 interface and assign an IP address that is accessible on a VLAN

set interfaces irb unit 80 description wired-network
set interfaces irb unit 80 family inet address 192.168.0.7/24

Set interfaces to trunk mode to accept 802.1q frames

edit interfaces ge-0/0/0
  set description "Uplink to router"
  edit unit 0 family ethernet-switching
    set interface-mode trunk
    set vlan members vlan80
    set vlan members vlan81
  exit
exit

On the OpenBSD router we'll ensure the physical interface is up and define the VLANs

# hostname.em0
up
# hostname.vlan0
parent em0 vnetid 80
inet 192.168.0.1/24
# hostname.vlan1
parent em0 vnetid 81
inet 192.168.1.1/24

To install these using rset(1), I often use a shell loop and set a variable to indicate the network needs to be reconfigured

# xa10.pln
network:
    let changed=0
    for interface in em0 vlan0 vlan1
    do
        ./rinstall -m 640 xa10/hostname.$interface /etc/hostname.$interface && changed=1
    done
    [ $changed -ge 0 ] && sh /etc/netstart

Aggregate Links

Tagged or untagged interfaces may be set up for load balancing and redundancy

set interfaces ge-0/0/10 ether-options 802.3ad ae0
set interfaces ge-0/0/11 ether-options 802.3ad ae0

edit interfaces ae0
  description "apu4d2 em0,em1"
  aggregated-ether-options lacp active
  edit unit 0 family ethernet-switching
      set interface-mode access
      set vlan members vlan80
    exit
  exit
exit

Then, on the OpenBSD host configure an aggregate interface and it's members. There is some mismatched terminology here, since trunkport on OpenBSD does not mean VLAN tagging, it implies LACP.

# /etc/hostname.aggr0
trunkport em0
trunkport em1
up

# /etc/hostname.em0
up

# /etc/hostname.em1
up

POE

JunOS is far more adaptable to configuration management than most switches since you stage your changes before committing. Another feature is the ability to clear a section using delete in order to ensure you have redefined an entire category

delete poe
set poe interface ge-0/0/6
set poe interface ge-0/0/7

Random Advice

fs.com has everything you need to assemble tidy cabling. These products are a joy to use:

Last updated on March 24, 2021