User manual JUNIPER NETWORKS JUNOS 10.1 CONFIGURATION GUIDE 1-2010

[. . . ] JUNOS® Software Network Interfaces Configuration Guide Release 10. 1 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408-745-2000 www. juniper. net Published: 2010-01-22 This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright © 1986-1997, Epilogue Technology Corporation. This program and its documentation were developed at private expense, and no part of them is in the public domain. This product includes memory allocation software developed by Mark Moraes, copyright © 1988, 1989, 1993, University of Toronto. [. . . ] You can achieve the functionality of "force authorized" mode by disabling dot1x on the required port. You can achieve the functionality of "force unauthorized" mode by disabling the port itself. Understanding the Administrative Mode of the Authenticator Port JUNOS Software supports the supplicant mode "single" and not the "single secure" nor "multiple" modes. The "Single" mode option authenticates only the first client that connects to a port. All other clients that connect later (802. 1x compliant or noncompliant) are allowed free access on that port without any further authentication. If the first authenticated client logs out, all other users are locked out until a client authenticates again. Configuring the Authenticator To configure the IEEE 802. 1x Port-Based Network Access Control protocol on Ethernet interfaces you must configure the authenticator statement at the [edit protocols dot1x] hierarchy level. Use the authentication-profile-name access-profile-name statement to specify the authenticating RADIUS server, and use the interface statement to specify and configure the Gigabit Ethernet or Fast Ethernet interface on the router specifically for IEEE 802. 1x protocol use; both at the [edit protocols dot1x authenticator] hierarchy level. [edit protocols dot1x] authenticator { authentication-profile-name access-profile-name; interface (xe-fpc/pic/port | ge-fpc/pic/port | fe-fpc/pic/port) { maximum-requests seconds; quiet-period seconds; reauthentication (disable | interval seconds); retries integer; server-timeout seconds; supplicant (single); 772 Understanding the Administrative State of the Authenticator Port Chapter 45: Configuring IEEE 802. 1x Port-Based Network Access Control supplicant-timeout seconds; transmit-period seconds; } } Viewing the dot1x Configuration Purpose Action To review and verify the dot1x configuration. To view all dot1x configurations, use the show dot1x interface operational mode command. To view a dot1x configuration for a specific interface, use the show dot1x interface (xe-fpc/pic/port | ge-fpc/pic/port | fe-fpc/pic/port) detail operational mode command. See the Network Interfaces Command Reference for more information about this command. Viewing the dot1x Configuration 773 JUNOS 10. 1 Network Interfaces Configuration Guide 774 Viewing the dot1x Configuration Chapter 46 Configuring IEEE 802. 3ah OAM Link-Fault Management IEEE 802. 3ah OAM Link-Fault Management Overview on page 775 Configuring IEEE 802. 3ah OAM Link-Fault Management on page 776 Enabling IEEE 802. 3ah OAM Support on page 776 Configuring Link Discovery on page 776 Configuring the OAM PDU Interval on page 777 Configuring the OAM PDU Threshold on page 777 Configuring Threshold Values for Local Fault Events on an Interface on page 777 Disabling the Sending of Link Event TLVs on page 778 Detecting Remote Faults on page 778 Configuring an OAM Action Profile on page 778 Specifying the Actions to Be Taken for Link-Fault Management Events on page 779 Monitoring the Loss of Link Adjacency on page 780 Monitoring Protocol Status on page 780 Configuring Threshold Values for Fault Events in an Action Profile on page 780 Applying an Action Profile on page 781 Setting a Remote Interface into Loopback Mode on page 781 Enabling Remote Loopback Support on the Local Interface on page 781 Example: Configuring IEEE 802. 3ah OAM Support on an Interface on page 782 IEEE 802. 3ah OAM Link-Fault Management Overview Ethernet interfaces capable of running at 100 Mbps or faster on MX Series, M Series (except M5 and M10 routers), and T Series routers support the IEEE 802. 3ah standard for Operation, Administration, and Management (OAM). You can configure IEEE 802. 3ah OAM on Ethernet point-to-point direct links or links across Ethernet repeaters. The IEEE 802. 3ah standard meets the requirement for OAM capabilities as Ethernet moves from being solely an enterprise technology to being a WAN and access technology, as well as being backward-compatible with existing Ethernet technology. JUNOS Software supports IEEE 802. 3ah link-fault management. IEEE 802. 3ah OAM Link-Fault Management Overview 775 JUNOS 10. 1 Network Interfaces Configuration Guide The features of link-fault management are: Discovery Link monitoring Remote fault detection Remote loopback NOTE: Ethernet running on top of a Layer 2 protocol, such as Ethernet over ATM, is not supported in OAM configurations. Configuring IEEE 802. 3ah OAM Link-Fault Management You can configure threshold values for fault events that trigger the sending of link event TLVs when the values exceed the threshold. To set threshold values for fault events on an interface, include the event-thresholds statement at the [edit protocols oam ethernet link-fault-management interface] hierarchy level. You can also configure OAM threshold values within an action profile and apply the action profile to multiple interfaces. To create an action profile, include the action-profile statement at the [edit protocols oam ethernet link-fault-management] hierarchy level. To view OAM statistics, use the show oam ethernet link-fault-management operational mode command. To clear OAM statistics, use the clear oam ethernet link-fault-management statistics operational mode command. To clear link-fault management state information and restart the link discovery process on Ethernet interfaces, use the operational clear oam ethernet link-fault-management state mode command. For more information about these commands, see the JUNOS Interfaces Command Reference. Enabling IEEE 802. 3ah OAM Support To enable IEEE 802. 3ah OAM support, include the interface statement at the [edit protocols oam ethernet link-fault-management] hierarchy level: [edit protocols oam ethernet link-fault-management interface interface-name] When you enable IEEE 802. 3ah OAM on a physical interface, the discovery process is automatically triggered. Configuring Link Discovery When the IEEE 802. 3ah OAM protocol is enabled on a physical interface, the discovery process is automatically triggered. The discovery process permits Ethernet interfaces to discover and monitor the peer on the link if it also supports the IEEE 802. 3ah standard. 776 Configuring IEEE 802. 3ah OAM Link-Fault Management Chapter 46: Configuring IEEE 802. 3ah OAM Link-Fault Management You can specify the discovery mode used for IEEE 802. 3ah OAM support. The discovery process is triggered automatically when OAM IEEE 802. 3ah functionality is enabled on a port. Link monitoring is done when the interface sends periodic OAM PDUs. [. . . ] Configuring 10-Gigabit Ethernet Link Down Notification for Optics Options Alarm or Warning on page 821 Related Topics 1540 warning Chapter 62: Summary of Interface Configuration Statements watch-list Syntax watch-list { [ routes ]; } Hierarchy Level [edit interfaces dln unit logical-unit-number dialer-options] Release Information Description Statement introduced before JUNOS Release 7. 4. On J Series Services Routers with ISDN interfaces, configure an ISDN list of routes to watch. Used only for dialer watch. routes--IP prefix of a route. The primary interface is considered Options up if there is at least one valid route for any of the addresses in the watch list to an interface other than the backup interface. Required Privilege Level interface--To view this statement in the configuration. [. . . ]