BGP open message receives a TCP RST

On this micro post, I would like to show one reason why a BGP open message receives a TCP RST. For this test, I set up a BGP neighborship between two peers: PeerA(10.82.1.9) and PeerB(10.82.1.10)

PeerA initiates the connection and look what happens in the packet capture.

bgp-open-reset

According to the sequence, TCP seems to have established properly. 3WAY handshake is done and PeerA thinks it can send its capabilities in its OPEN message and it actually sends it but something weird happens. Remote side PeerB first closes the connection [FIN,ACK] and then sends a RST segment to our OPEN message but why does he do that?

Continue reading

OSPF Loop prevention

On this post, I will show an example of loop prevention on OSPF protocol. There is a nice document at here about the principles of loop prevention. What I will just do is to show this on Junos. In order to show this, I am using the following topology;

ospf-loop-prevention

On this topology, J40 and J32 are ABRs. J40 has a connection to Area3 in broadcast segment and J32 also has a link to Area3 via J201. It looks like we have multiple paths towards the same Area3 from backbone area. Let’s see how OSPF handles this.

Continue reading

OSPF equal cost path

On this post, I will try to show how OSPF behaves when there are two equal cost paths towards a destination. To demonstrate this, I have prepared my usual topology.

ospf-equal-cost-path-junos

On this topology all routers are running OSPF but our focus is on the router J32 which is circled at the bottom and our destination network is 172.40.1.0/24 Since we have set the reference bandwidth to 10G and each links are 1G a single link OSPF cost is 10. Now let’s see how J32 device reaches this destination network.

Continue reading

OSPF neighborship, database and routing table

OSPF sometimes can be a confusing protocol. For example if you turn on a light switch, you simply get the immediate result: Light is on. What if when you turn on the light switch but you see the shining light bulb after 40 seconds then it is more difficult to understand the result of your actions. This was a small introduction to this post which I will try to write about he link between OSPF neighborship, OSPF database and routing table. All tests are done on a virtual SRX firewall in packet mode. I have cropped a section of my OSPF topology to simplify this post.

ospf-neighborship-database-lsa

We simply have two routers connected via a point to point link and they both run OSPF. FF31 router is an ABR and J204 is an internal router (which is actually a routing instance on another router but we can ignore this detail)

On this setup following are the OSPF details

J204: Router ID=10.1.1.204, Interface IP: 200.1.2.2
J31: Router ID=10.1.1.31, Interface IP: 200.1.2.1

Continue reading

SRX Tips: Default application timeouts

It can be annoying if you are new to SRX and your SSH connection towards the firewall keeps timing out. You can of course activate keep alive on your SSH client or play with the default ssh timeout on SRX itself. First let’s see how we can check the current timeout.

Current SSH timeout is 1800 seconds. Let’s make it 7200 seconds.

We have increased the SSH timeout on the firewall. You must logout and login to see the changes though. Let’s check it!

Yes, timeout has increased to the new value we set.

SRX Tips: Static Host Mapping

After a year of being away from SRX, I have noticed that I forgot the CLI command to set a static hostname to IP mapping. If you haven’t used this feature so far, it simply allows you to have a /etc/hosts file similar to what we have in Linux and here is how we set and use it.

As you can see, we can resolve hostname “gw1” we just created.

tmux multiple terminals

I think most of us watched the movie Inception in which there was dream within a dream. It was a bit of confusing at some point. There is a Linux version of it 🙂 terminal within terminal provided by the fantastic tool tmux (terminal multiplexer). I use this tool during some troubleshooting scenarios when I would like to see two continuous pings on two terminals. Sometimes, I also divide the screen to 4 terminals. It may not be needed for everyone but in my opinion it is really handy. Here is an example of what you can achieve by tmux on a single terminal.

tmux-screenshot

It is pretty cool right.

Continue reading