} }
fe-1/0/0 { unit 0 {
family inet { filter {
input inputfilter;
} } } } }
Assume that a route lookup on 2.2.2 .2 (the tunnel destination) shows a next-hop o e-1/0/0.0.
The rewall lter inputflter needs to allow GRE packets rom 1.1.1.1 to 2.2.2.2 (in other words, it needs to allow the outbound packets).
You can still gain spoo protection by ltering non-GR E trac with your internal source address.
Note that this only aects transit trac. Trac (such as routing protocol trac) originating rom the R, should not be aected by the
rewall lter.
Template: Using the Interace Range Command
Theinterface-rangecommand is quite useul. It allows you to congure multiple interaces at the same time. It also allows you to reerence interaces as a group elsewhere.
C
It’s a common task: you want to congure multiple interaces the same way but you have to congure each interace separately, like this:[edit]
root@myrouter# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members finance
[edit]
root@myrouter# set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members finance
[edit]
root@myrouter# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members finance
[edit]
root@myrouter# set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members finance
[edit]
root@myrouter# show interfaces ge-0/0/0 {
unit 0 {
family ethernet-switching { vlan {
members finance;
} } } }
ge-0/0/1 { unit 0 {
family ethernet-switching { vlan {
members finance;
} } } }
ge-0/0/2 { unit 0 {
family ethernet-switching { vlan {
members finance;
} } } }
ge-0/0/3 { unit 0 {
40 DayOne:JunosTips,Techniques,andTemplates2011
family ethernet-switching { vlan {
members finance;
} } } }
You end up with the desired result but it took our commands. Imagine i you had twenty interaces to congure this way!
As o Junos 10.0, theinterface-rangecommand provides a good solution to this problem. Using the preceding example, the same result can be achieved in just two commands (assume the interaces cong-ured have been deleted). Here are the two commands:
[edit]
root@myrouter# set interfaces interface-range vlan-finance member-range ge-0/0/0 to ge-0/0/3
[edit]
root@myrouter# set interfaces interface-range vlan-finance unit 0 family ethernet-switching vlan members finance
[edit]
root@myrouter# show interfaces interface-range vlan-finance {
member-range ge-0/0/0 to ge-0/0/3;
unit 0 {
family ethernet-switching { vlan {
members finance;
} } } }
You can mix and match interace-range conguration with individual interace conguration; the settings are merged together.
You can also veriy that the settings are correctly applied to each interace in the range by using thedisplay inheritancepipe com-mand:
[edit]
root@myrouter# show interfaces | display inheritance
##
## 'ge-0/0/0' was expanded from interface-range 'vlan-finance'
##
ge-0/0/0 {
##
## '0
## '0' was ' was expaexpanded nded from from interface-range 'vlinterface-range 'vlan-finance'an-finance'
#
## 'ethernet-switching' was exng' was expandpanded froed from interface-range 'vlm interface-range 'vlan-finance'an-finance'
#
## 'vlan' was ean' was expanxpanded ded from from interface-range 'vlinterface-range 'vlan-finance'an-finance'
#
## 'finance' was e' was expanxpanded froded from interface-range 'vm interface-range 'vlan-financelan-finance''
#
### memb
members financeers finance;; }
Now let’s use the
Now let’s use theexceptexceptpipe command to eliminate the hash marks:pipe command to eliminate the hash marks:
[edit]
[edit]
root@
root@myroumyrouter# show | dispter# show | display lay inheritance | except ##inheritance | except ##
ge-0/0/0 {
members financeers finance;; }
members financeers finance;; }
42
42 DaDayyOneOne::JunJunososTipTips,s,TTechechniqniquesues,,andandTTempemplalatetess20120111
vl vlan an {{
memb
members financeers finance;; }
members financeers finance;; }
The output now looks exactly as it
The output now looks exactly as it did when conguring each interacedid when conguring each interace manually
manually. And, . And, most importantly, it unctions most importantly, it unctions the same the same wayway, too., too.
Selecting Interaces Selecting Interaces
Y
You can select non-contou can select non-contiguous interaces and place them iguous interaces and place them in the samein the same interace-range group. This example selects interaces ge-0/0/2 through interace-range group. This example selects interaces ge-0/0/2 through ge-0/0/10, ge-0/0/15 through ge-0/0/17, ge-0/0/19, and ge-0/0/20:
ge-0/0/10, ge-0/0/15 through ge-0/0/17, ge-0/0/19, and ge-0/0/20:
[edit]
[edit]
user@EX#
user@EX#set interfaces interface-range Raset interfaces interface-range Range1 mnge1 memember-range gber-range ge-0/e-0/0/0/2 to ge-0/02 to ge-0/0/10/10;;
[edit]
[edit]
user@EX#
user@EX#set interfaces interface-rangset interfaces interface-range Range Range1 mee1 member-rangmber-range ge-0/0e ge-0/0/15 to ge-0/0/15 to ge-0/0/17/17;;
[edit]
[edit]
user@EX#
user@EX#set interfaces interface-range Raset interfaces interface-range Range1 mnge1 memember-range gber-range ge-0/e-0/0/0/19 to ge-0/019 to ge-0/0/20/20;;
Y
You can also ou can also select interaces using select interaces using a similar (although a similar (although slightly dier-slightly dier-ent) wildcard match notation as is used in con
ent) wildcard match notation as is used in conguration groups. Hereguration groups. Here is an annotated example:
is an annotated example:
user@sw
user@sw> show configuration i> show configuration interfaces interface-range EDGEnterfaces interface-range EDGE /* Match all interfac
/* Match all interfaces thes that starat start with "get with "ge-0/0-0/0/"/". *. *//
membmber "ge-1/0er "ge-1/0/[0-9]/[0-9]";";
/* Matc
membmber "ge-1/0/er "ge-1/0/[20-39][20-39]";";
/* Match any ge- interface o
/* Match any ge- interface on PIC0 of FPC 2 througn PIC0 of FPC 2 through 8. *h 8. *// me
membmber "ge-[2-8]er "ge-[2-8]/0/*"/0/*";;
Note that the square brackets can enclose two
Note that the square brackets can enclose two-digit ranges o numbers.-digit ranges o numbers.
So, [20-39] will match every number rom 20
So, [20-39] will match every number rom 20 through 39 (inclusive),through 39 (inclusive), and create an interace or each o those
and create an interace or each o those numbers.numbers.
Using Interace Ranges Elsewhere Using Interace Ranges Elsewhere
Y
You can also reerence interace ou can also reerence interace ranges in other places ranges in other places where youwhere you
would reerence an actual interace. For example, to set all interaces in would reerence an actual interace. For example, to set all interaces in the interace range named
the interace range namedEDGEEDGEto be edge ports or MSTP:to be edge ports or MSTP:
user@sw
user@sw> show configuration protocols > show configuration protocols mstpmstp .