APPLICATION NOTE J SERIES SERVICES ROUTERS ADVANCED SWITCHING CONFIGURATION Configuring JUNOS Software Advanced Switching on J Series Services Routers Copyright © 2009, Juniper Networks, Inc. APPLICATION NOTE - J Series Service Routers Advanced Switching Configuration Table of Contents Introduction ........................................................................................ 1 Scope .............................................................................................. 1 Hardware Requirements . 1 Software Requirements . 1 JUNOS Software Release 9.2 J Series Switching Features . 1 JUNOS Software Release 9.2 Switching Configuration Examples ........................................... 2 Enabling Enhanced Switching . 2 Configuring Layer 2 Switching . 2 Configuring Bridging Domains . 3 Extending Bridging Domains and Configuring Tagged Interfaces . 3 Configuring Integrated Routing and Bridging . 5 Configuring Link Aggregation . 6 Simple LAN Switching Scenario . 7 Adding VLANS . 8 Routing Traffic Between VLANs. 9 Adding a Tagged Interface . 11 Increasing Capacity with Link Aggregation . 13 Monitoring ........................................................................................ 16 Summary ......................................................................................... 16 About Juniper Networks ............................................................................. 16 Table of Figures Figure 1: VLAN Tagging .............................................................................. 4 Figure 2: Trunk and Access Ports ...................................................................... 4 Figure 3: Integrated Routing and Bridging .............................................................. 5 Figure 4: Layer 2 Switching Topology .................................................................. 7 Figure 5: Adding Sales and Operations VLANs ........................................................... 8 Figure 6: Adding Routing Between VLANs .............................................................. 9 Figure 7: Adding a Tagged Interface .................................................................. 11 Figure 8: Increasing Capacity with Link Aggregation .................................................... 13 ii Copyright © 2009, Juniper Networks, Inc. APPLICATION NOTE - J Series Service Routers Advanced Switching Configuration Introduction Juniper Networks® J Series Services Routers provide high-performance networking for branch-office and regional sites, integrating routing, WAN connectivity, security, LAN switching, VoIP/telephony and WAN optimization, which effectively extends enterprise applications and services to remote locations. A new family of high-density Ethernet Physical Interface Modules (PIMs) was introduced with Juniper Networks JUNOS® Software release 8.5, which allowed small branch offices to aggregate Ethernet connections directly onto J Series Services Routers, eliminating the need for Layer 2 switches. In medium-sized branch offices, J Series routers could also now be used to aggregate traffic from multiple Layer 2 access switches. However, to more effectively collapse part of the switching infrastructure onto J Series routers, JUNOS Software has to be able to provide additional functionality that is commonly offered at the switching layer. JUNOS Software release 9.2 for J Series routers introduces much of this functionality by adding additional Layer 2 switching features, integrated routing and bridging, and support of several Layer 2 protocols. Scope This application note provides an overview of the new JUNOS Software Layer 2 features for J Series routers. It describes several common deployment scenarios, with detailed configurations for each scenario. When configuring JUNOS Software advanced switching on J Series, please note the hardware and software requirements outlined below. Hardware Requirements • J Series Services Routers (Juniper Networks J2320, J2350, J4350, or J6350 Services Routers) - 8-port 10/100/1000BASE-T - 16-port 10/100/1000BASE-T - 6-port SFP (supporting T, LX, SX and LH SFPs) Software Requirements • JUNOS Software with enhanced services release 9.2 or later for the J Series platform JUNOS Software Release 9.2 J Series Switching Features J Series advanced switching is based on current Juniper Networks EX Series Ethernet Switches functionality, which includes, but is not limited to: • Layer 2 switching of traffic, including support for both trunk and access ports • Integrated routing and bridging • Loop-avoidance protocols - Spanning Tree Protocol - Rapid Spanning Tree Protocol (RSTP) - Multiple Spanning Tree Protocol (MSTP) - Redundant trunk groups • Link aggregation IEEE 802.3ad - both static and using Link Aggregation Control Protocol (LACP) • Generic Virtual LAN (VLAN) Registration Protocol (GVRP) • Port security - Per port MAC address limits - IEEE 802.1x and MAC authentication Copyright © 2009, Juniper Networks, Inc. 1 APPLICATION NOTE - J Series Service Routers Advanced Switching Configuration Although advanced switching for the J Series is sourced from the EX Series product family, J Series features are a subset of those offered in the EX Series. In particular, the following features are not included in JUNOS release 9.2 for the J Series: • Layer 2 access control lists (ACLs) • Layer 2 Quality of Service (QOS) for ports in switching mode • Internet Group Management Protocol (IGMP) snooping • Dynamic Host Configuration Protocol (DHCP) snooping • Address Resolution Protocol (ARP) inspection • MAC spoofing protection • SNMP MIB support (for the new Layer 2 features) • Virtual chassis Future feature additions to EX Series platforms will not automatically be ported to JUNOS for J Series routers. Layer 2 features from earlier JUNOS releases continue to be supported for compatibility purposes. In the current implementation, only one advanced switching uPIM is supported per J Series chassis (additional uPIMs can operate in routed mode or in legacy Layer 2 mode). Although future versions of JUNOS may remove this restriction, VLANs will not be able to cross uPIM boundaries as J Series routers do not have a fabric backplane, which would allow the switching of traffic between different uPIMs without sending frames to the CPU. Additionally, the designated advanced switching uPIM is able to support a combination of switched and routed ports as necessary. JUNOS Software Release 9.2 Switching Configuration Examples This section discusses several deployment scenarios and their associated configurations. Enabling Enhanced Switching The first configuration step is to enable enhanced switching on the PIM, which is done at the [chassis fpc pic ethernet] level of the configuration hierarchy. For example, the following configuration enables a PIM in slot 1. chassis { fpc 1 { pic 0 { ethernet { pic-mode enhanced-switching; } } } } Configuring Layer 2 Switching Physical interfaces (IFDs in JUNOS terminology) can operate in two modes. When an interface is given a Layer 3 address (such as an IPv4, IPv6, or ISO address), the interface will route traffic based on the destination address of each packet. If an interface is not given a Layer 3 address but is configured as part of the Ethernet switching protocol family, the interface will forward traffic based on the link layer destination address. The following configuration defines an interface as a switching port (note that Layer 2 configuration is limited to unit 0 of an interface). interface { ge-<slot number>/0/<port number> { unit 0 { family ethernet-switching; } } } 2 Copyright © 2009, Juniper Networks, Inc. APPLICATION NOTE - J Series Service Routers Advanced Switching Configuration Configuring Bridging Domains As in most modern switches, bridging domains can be segmented using VLANs, an approach that allows device segmentation by assigning ports to administrative domains. Traffic can be forwarded between member interfaces of the same VLAN, but not between interfaces that belong to different VLANs, effectively allowing the same physical device to be shared between different non-connected networks (a later section of this document describes how to forward traffic between different VLANs). By default, all switching-enabled ports form part of the same bridging domain. If an interface is enabled for Layer 2 switching but not associated with any VLAN, it will become part of the default VLAN. To configure a new domain, a VLAN has to be defined under the [vlans] hierarchy and given a unique identifier (VLAN ID). vlans { <vlan name> { vlan-id <id>; } } Additionally, you have to specify which interfaces will be part of the newly created domain. There are two ways to allocate interfaces. (These ways are identical from a functional point of view; it is up to you to choose the method you prefer). The first way, under the [interface <name> unit 0 family ethernet-switching] hierarchy, is to declare the VLAN as part of an interface configuration. interface { ge-<slot number>/0/<port number> { unit 0 { family ethernet-switching { vlan members <vlan name or id> } } } } The second way, under the [vlan <name>interface] hierarchy, is to define VLAN member interfaces. vlans { <name> { interfaces { <interface name>; <interface name>; … } } } Both methods can be combined as long as no inconsistencies are introduced (for example, the same interface cannot be defined as a member of two or more VLANs). Extending Bridging Domains and Configuring Tagged Interfaces Modern switching networks can be large enough to require the use of