Configure Layer 2 Switching on Junos

0:05If you follow my content at all in the JNCIA certification playlist that we have here in CBT Nuggets, you heard me say very surprisingly, that layer 2 was not part of the JNCIA certification. I mean it's a critical part of networking. You oftentimes learn layer 2 before you learn layer 3. How does communication within the same network work before we move on to inter-network communication? This is kind of the gist of why Juniper chose to push layer 2 into the JNCIA certifications.

0:35Here's why. Because at the end of the day, all Juniper platforms perform some form of Ethernet switching, even the routers and even the firewalls. Now throughout this playlist, we're going to figure out that even though they all run Junos, that all the exact same operating system, they all approach switching just a little bit differently. The commands from one platform to the next are just different enough to where they get their own unique commands. MX series routers for instance, do not perform the exact same function than an EX series switch does.

1:06So that kind of explains why then the MX series router may approach layer 2 in switching just a little bit differently than an enterprise grade switch. So what we're going to do throughout this skill is actually introduce, what switching does. How does switching actually work, and how does Juniper approach it. Then we're actually going to deploy layer 2 switching solutions on each of the different platforms. We're going to cover EX series switches, which are primarily used in the enterprise. We're going to cover EMX routers which are primarily used in service providers and QFX series switches, which are primarily used in the data centers.

1:37Now if you're here because you want to follow along, let me just tell you right now, there's content in the JNCIA certification playlist, where we talk about how to go about building a home lab, whether virtual or physical. And all of those platforms, whether physical or virtual will be covered throughout this content. So, you may want to jump back to the JNCIA playlist real quick, and then see like, OK he's using an EX series switch. Where did he go to get an EX switch? It was eBay like at the EX 22,100 because they're the most affordable. But go check that content out if you're really interested in following along and labbing your own layer 2 switching environment with a Junos operating system.

2:13So with that being said, in the next Nugget we're going to cover, what is the entire point of layer 2 in switching? And how does Juniper approach layer 2 and switching? Then we're going to follow that up with all of the configuration items creating VLANs, creating access and trunk ports, and then creating switch virtual interfaces. Get ready because it's going to be a blast, and I'll see you there.

0:05So now it's time to talk about layer 2 switching and get refreshed on what the entire point of layer 2 is. We're going to cover what a VLAN is. What is an access port versus a trunk port and any 2.1 queue tagging and then what is a switched virtual interface. All of this is kind of a refresher course because Juniper's expectation, even though it hasn't been covered in a certification up to this point, is that you have a little bit of experience in this type of technology. And what the JNCIS wants you to know is how do the different Juniper platforms approach layer 2 switching.

0:36But before we just dive in and I just assume you already know layer 2. Let's talk about what layer 2 switching is all about. Let's go. This is honestly, one of my favorite topologies that I've ever whipped up for any of our content here on CBT Nuggets. And before you freak out and say, wait a minute, I don't see Juniper devices. That's OK, we're just talking about kind of design right now in the point of layer 2. And in fact, this topology was actually created for a Cisco Enterprise design certification that you could actually learn how enterprises should be laid out and how traffic should flow through an enterprise that's the entire point of the certification.

1:10And what's very interesting is that so much of that was learned in that exam is actually applicable to stuff in really any certification. Now Juniper does have a design track and we're not really going to dwell too much on design itself right now because there's design content out there for those exact things. We're just trying to refresh ourselves on the point of layer 2 and this is a great topology to just get refreshed on layer 2 before we dive into the actual Juniper hardware themselves and start configuring things. So getting started, let's start off with just one of these little box here.

1:41I'm going to zoom in quite a bit and let's just focus on the yellow section here in the screen. Pretend for a moment this yellow section is say, our accounting department on a large enterprise campus maybe even like a university campus and they've got a bursar's office and a finance office. And all of that exists in this one building that's what we're looking at here and we're kind of looking at this yellow section is a building that houses all of our accounting staff. Then let's say we've got four computers just these basic four computers attached in.

2:11Let's say we've got Bob, and Lois, and let's say we've got Knox, and Keith, are all attached here in this little area. We see them that they plug-in to a switch just like so on each one of these sections here and this section is called the access layer. It's very cleverly called the access layer because this is where our devices are, our end-users gain access into the network. Now without dwelling too much on this, we see how these switches can be linked up to another set of switches.

2:43This is actually the layer 3 switch symbol here and then they all kind of interact with each other. They all kind of interconnect. So for instance, if Bob wanted to talk to Keith, Bob's traffic would go something like this. It would come in to switch 18, and then down to switch 20, and then out towards Keith. This is where the whole switching thing comes into play and this is also where it kind of gets into enterprise design because this is kind of a bit of a moving target these days. We'll talk more about why in just a second. If we pretend for a moment that all of my accounting staff are all on the exact same network like 192.168.3.0/24, Bob would then basically be able to communicate directly to Keith without having to pass through a router because this is the entire point of layer 2.

3:32Layer 2 is all about how two devices that are on the exact same network can communicate directly to each other using frames. If you recall for a minute what the entire point of the OSI model is, it's really to logically define how routing and networking decisions can be made one step at a time. And as the decision itself gets a little more complicated, we just introduce some more layers into the mix so you can make even further or more accurate decisions. The cool thing about layer 2 is that because we're on the exact same network, we don't have to add too much complexity in it.

4:07For instance, Bob's traffic that speaking directly to Keith never has to pass through a router. It can just pass through a switch because the entire point of a switch is to send traffic within the same network to each other. So how does it do this? This introduces one of the most major concepts in all of switching and that's how broadcast work and why switching and routers really exist. When it's time for, let me clean up the screen for just a moment and we'll just highlight Bob and Keith. When it's time for Bob to communicate directly to Keith and we know that we're on the exact same network, because maybe Bob looks at his IP address and sees 192.168.3.5 and Keith is 192.168.3.6, I'm going to write 6 here for simplicity's sake.

4:49Bob says, Oh, you're on my same network I can see that because the address that I'm trying to reach is clearly on my same network. What I'm just going to then do is just shout throughout my entire network hey, how do I get to you. Specifically, it uses address resolution protocol or ARP for short. And it literally asks the question or at least if you do a Wireshark packet capture, it says who has 192.168.3.6 and this all takes place in Layer 2 within the switch itself.

5:21The payload asks this question, who has that? Because what they're really asking for is what is your Mac address so that I can send my traffic directly to you. It takes this IP address and maps it to this Mac address so that way we know if we're ever trying to reach this IP address, we can just reach it directly by its Mac address. So it asks this question, who has 192.168.3.6 expecting a reply of, I have it, here's my Mac address. And it becomes a broadcast frame because it sends this to the broadcast IP address and the broadcast Mac address.

5:59If I turn on Wireshark for even a brief moment on my computer, I'm just going to leave it sitting for just a second so it grabs some broadcast frames. There it is, I see a bunch of ARP requests right there. Let me zoom way on in so we can see it. Do you see this one right here? This is my ARP request, I got my mouse on it right now for whatever reason my pin isn't letting me do it. We can see that my source address is asking, is this ubiquiti router is asking, hey, who has 10.21.156 tell 10.10.21.1.

6:29The destination is the all bits broadcast address of ff,ff,ff,ff,ff,ff, that's right. When we send in a broadcast frame into the network destined for ff, ff, ff, ff, this frame is then told you need to go to everyone that's communicating within the same network. This is oftentimes referred to as a virtual LAN. So in the case here, when Bob's computer is goes to speak to Keith's computer here, it's going to send in a broadcast frame, an ARP request asking, how do I reach you at your address?

7:03Keith's computer will reply directly back to Bob because it has seen the source Mac address and it knows who is asking specifically for this question and where do we need to go from there. So Bob and Keith now know each other's Mac address after ARP has been handled but very interestingly all the switches in the middle do too. As a frame comes in when it's sourced from a Mac address, the switch remembers on this interface, I learned about this Mac address so it knows exactly which interface each Mac address is connected to.

7:35That way when further flows of traffic need to happen between Bob and Keith, all of the switches along the path remember where the source Mac address was learn from and if it receives a frame destined to that Mac address. It knows which interface to send it which makes this whole process very, very quick. Now taking it even a step further, switches are built with something in there interfaces called ASICs that's application specific integrated circuits and it's all about making this decision of how to forward a frame even quicker.

8:07And this is one of the reasons why switches are typically more expensive than routers. Just a whole lot of R&D has gone into developing the silicon in order to making these ASICs run blazing fast and this is one of the ways that Juniper really prides itself on how performance is switching platforms are. So this is how devices that are on the same network would communicate directly to each other. It's all about finding out where the neighbor is. What their Mac address is and then the switches learn about each of these devices as communication starts to flow back and forth.

8:38But what happens if all of a sudden we have too many devices. You see if everybody is sending in broadcasts all the time then our devices get choked up. And this is one of the reasons why we limit the number of devices on our subnets to a /24. The /24 limits it to basically a broadcast domain meaning, how many devices can broadcast within this entire domain to 255, 254 devices really and that's been just a healthy number for pretty much the entire length or duration of ethernet itself.

9:12So if for instance, maybe Bob and Keith exist on a network like 192-168.3 and then all of a sudden we have 254 users or devices on that network. We've run into a problem and we need to create more networks for more people to attach to. At layer 2, what we begin doing is creating VLANs or virtual local area networks. This is just a way to separate broadcast domains from one another. So maybe now, these two devices, this was Lois and Knox, they join a VLAN that is separated from Bob and Keith.

9:46So these two people, Lois and Knox can communicate directly to each other just like the others have been. And Keith and Bob can communicate directly to each other just like the others have been. However, Lois and Knox exist on a different network than Bob and Keith. Lois and Knox may exist on a 192.168.4 network whereas, Bob and Keith existed on the 192.168.3 network. And in order for now Bob or Keith to ping Lois or Knox, they then have to go through a router to make that happen.

10:19Because we're moving from one network to the next, the thing that you find out pretty quickly is that ARP and broadcast frames in general are only limited to the domain that they can broadcast within. We can't ARP to a different network because then that kind of defeats the entire purpose of limiting the scope of how far we can broadcast out or shout for help. So in this case, if Lois wants to ping Bob, Lois within ARP for her router or her default gateway and then send the packet to the router and the router would have to be connected to both networks to send it back.

10:51But here in the screen you may be thinking yourself, Knox, I don't see any routers, I only see switches. Well, there are lots of switches that can perform this routing option for us and this is where those whole VLANs come into play. For instance on these two devices, we set up the fact that they were in the 192.168.4 subnet. We could actually create them a layer 2 segment or a layer 2 broadcast you may called VLAN4. Bob and Keith however we're located on 192.168.3 so we would create a layer 2 segment for them called VLAN3.

11:23And I keep saying segment, I really meant a whole network not just one ethernet segment. When a user in VLAN3 wants to communicate to a user in VLAN4, like we've said, they have to be routed so it would make its way down to a default gateway like switch 18 located here. But then switch 18 can have an IP address on each one of these VLANs called a switched virtual interface. It's not a physical interface that is plugged into here, it's just basically saying, hey, switch, we just want you to have your own IP address on these VLANs that way you can communicate to these devices.

11:57And when switch 18 has its own IP address, for instance in VLAN3, it may have 192.168.3.1 and in VLAN4 it may have its own IP address of 192.168.4.1 it can then perform the routing option itself. So when Keith sends in a ping destined for Knox, his default gateway is going to be this default gateway, the switched virtual interface of 192.168.3.1. And then the switch itself can perform the routing action of routing it into VLAN4 inserting it onward towards Knox.

12:32So this is the concept of switching and rerouting bits in to play. We're limiting the broadcast domains down so they don't get so big that we have nothing but broadcast going on and on and on. And then we allow routing in between the VLANs when one device on one VLAN wants to communicate to a different VLAN using the switch virtual interface. The last thing we really need to talk about is how the actual mechanism or configuration of each of these interfaces really works. You see, all of our devices up to this point of plug directly into a switch. That's fine, this is very common for the access layer for these devices to plug into an access switch.

13:06We may very frequently also have a voice over IP phone connected into the mix and then off of that voice over IP phone, we have a computer plugged into that. Either way, what happens here is we configure these interfaces as what's called access ports. Basically saying, you belong to this specific VLAN and here's your access into the network, it's going to be through that VLAN. But then in this case, we may have multiple devices connected to different versions on the same switch and whatever this switch needs to carry traffic upstream into the core or from one switch to the next, it needs the capability to be able to carry multiple VLANs on the same ethernet segment.

13:50This is called a trunk port. For instance, when this device on VLAN4 wants to communicate into the network, ethernet 02 here is just configured to be an access port on VLAN4. So when the frame comes into this interface, this switch, switch 21 knows that this belongs to VLAN4. However, the link between switch 21 and switch 18 may need to carry traffic between VLAN4 and VLAN3. So as the frame leaves switch 21 towards switch 18, switch 21 will add an 802.1Q tag.

14:24Just a tag on the actual frame itself that says, this belongs to VLAN4. So the tag will say, 4 on. When switch18 receives it, it says, Oh, I realized that this belongs to VLAN4. So it makes sure to forward it through its VLAN4 interfaces, whether those are trunk ports or access ports itself. As the traffic gets sent back down to the other computer like Knox, the moment it leaves the access port, the 802.1Q tag is removed. It's stripped off and it just becomes the basic naked frame that it was when it begins with.

14:55So this has been the crash course in Layer 2 switching. Now obviously, the expectation that we've set up to this point is that you have some experience with layer 2 switching and this is more or less a refresher at this point. If any of this was brand new, I'd really encourage you to pivot to something like our network plus content or a CCNA content here on CBT Nuggets because that has a lot of dedicated tutorials on what's switching really does and what the use cases are for things like access ports, trunk ports, VLANs, and Switch Virtual Interfaces. So this has been just refreshing the entire point of layer 2 switching.

15:27In the next Nugget, we're going to deploy it. We're going to see it in action on EX series which is. I hope this has been informative for you and I'd like to thank you for viewing.

0:05So our first platform that we're going to cover in our Juniper layer 2 switching journey is going to be the most popular enterprise-grade solution that there is. It's the EX-series switch. I have deployed hundreds of these switches in my time, and they are all just a pleasure to work with, because they are rock-solid devices. So what we're going to cover throughout this Nugget is how to configure a VLAN on an EX-series switch. We're going to build on it over the next couple Nuggets until we've got a full-blown enterprise-grade solution. And then in the next skill, we'll actually cover how to perform layer 2 security options on top of that using the exact same platform.

0:38So let's get started with our first baby steps in layer 2 switching, and that is deploying a VLAN on a Juniper switch. I'll see you there. So like I said already, for this content, what I'm going to be doing is demonstrating how to configure basically VLANs, trunk ports, access ports, and SVIs on an EX-series switch. The EX-series switch that I'm working with is an EX2200 switch, just like the one that we're seeing on the screen here. Let me zoom over It. Yeah, it's just a little 24-port switch. It's an EX2200. It does come with some limitations. It doesn't have every single feature available to it, like an EX4200 might.

1:11And the EX2200 series switch, I should point out, is also end of life as of the time of this recording. The EX2300 switches are the ones that are currently supported and run the latest Junos code. But nonetheless, you can see, at the whopping price of $59.95 with free shipping, it's really pretty affordable to get started labbing Juniper devices. You could buy two or three of these and still be under $200 and have a full-blown Juniper switching lab. So with that being said, let's jump over to my command line of my EX-series switch.

1:42This is consoled in. I'm on the console port of my EX-series switch. And I'll give it a show interfaces terse real quick. And you can see just what we have here. We've got 24 ports that we're working with. They're ranging from interface ge-0/0/0 down to ge-0/0/23. We also have a loopback address, and this is where we're going to get started configuring this EX-series device. So here we go. From EX-SW1 on my EX-series device, I'm going to go into configuration mode. And the first thing you really want to do, before you try and do anything else, is you just want to create your VLANs.

2:16You got to remember, why are you creating more VLANs? It's really in order to administratively define how many users should connect to an actual interface or VLAN itself, as well as maybe separate specific classes of users from reaching each other. Let me just say this right now. If I were to, say, create a VLAN for accounting and then create a VLAN for HR, and we limit these to be /24s when we get into layer 3, if I have a user like Lois in HR that connect to the HR VLAN, and I have a user like Bob connects to the accounting VLAN, does that automatically stop us from reaching each other?

2:53If we're performing switched virtual interfaces, or what's called inter-VLAN routing, basically meaning that this device is allowed to perform the routing, no. We don't have any security here by doing that. We've stopped them from reaching each other on layer 2, but there's a very high chance in a correctly-designed enterprise environment that will still going to allow routing between them. However, the idea here is that by administratively separating Bob from Lois, we then have extra mechanisms from stopping them from reaching each other. First of all, they can't reach each other directly by layer 2. But secondly, we can then introduce things like firewall filters, which other vendors call ACLs, or even policies that stop that traffic from flowing one to the next.

3:30So this is one of the ways that at least is a first step in the right direction of security practices, by stopping accounting users from reaching HR users. So you just want to keep this in mind, that it's not the perfect security solution, just creating a VLAN. It's just what the first step is in a security solution is creating a VLAN. But also keeping in mind that the reason why we're really doing this is to limit the broadcast domain itself. So let's pretend for a moment that we have 40 users that we need to set up for HR, and then another 40 for IT, and then another 40 for accounting, and then another 40 for, let's say, C-suite executives.

4:04I know that's going to be a lot of C-suite executives. But we've got four different sets of users with four different sets of security reasons that they would need to be separated from each other. HR has access to everybody's HR records and payroll information. IT is-- well, you know what IT is. Accounting-- obviously, they're going to be the ones who are managing the money. We need them to be secure. And then C-suite executives are the ones who are making all the decisions, so they need to be separated from everybody else, too. So I see four VLANs that we need to create here. Now what we also need to consider is when we create these VLANs, like HR, IT, accounting, and C-suite executives, what are the VLAN numbers that they should have?

4:44This kind of gets outside the scope of what the JNCIS wants you to know, but we are getting into real-world practices at the same time. It makes sense to design our VLAN numbers to coincide with the subnet ranges that are going to match with them, too. For instance, if I give HR the VLAN ID of 4, I may want their IP address to be something like 10.0.4 dot whatever /24. The 10 obviously indicates this is going to be RFC 1918 private address space.

5:16Maybe the second octet could indicate which building they're located in, or which geographical site they're located in. This would represent their VLAN. And then, of course, there's their host bits that are serving as the remainder here. So I could quickly see, private address, this building, this VLAN, and that's their account or host address. For IT, I may do the exact same thing-- give them the VLAN ID of 5. So 10.0.5.X. For accounting, we may give them the VLAN ID of-- make something up-- like 11. 10.0.11.X. And for C-suite executives, let's go with like 254.

5:5110.0.254.X. And this begs the next question. What are the maximum VLAN IDs that we can sets? Traditionally, VLAN IDs could be set between 0 and 4094 or 4095, depending on which vendor you're looking at here. But some of these VLAN IDs are reserved. For instance, VLAN ID 1 in Juniper devices is reserved for what's called the default VLAN. If I take a Juniper switch out of the box, I plug it in, and then I plug hosts directly into it, they can still communicate directly to each other, because without any additional configurations, all of my interfaces by default are placed into the default VLAN, which is VLAN ID 1.

6:29Big talking point coming up when we start talking about trunk interfaces around that. So here we go. On my EX-series switch-- let me put those back up there so I can just remember what to do-- let's create each one of these VLANs. To create a VLAN on a Juniper-series switch, you simply say set vlans. And then this is where it gets pretty stinking interesting. Instead of on other vendors where you just say like the VLAN and then the number, on Juniper devices, all of the VLANs are called out by name. Critical to understand is that in other places of the configuration, you identify the VLAN by name, not by ID.

7:02So in this case, I'll create a VLAN called HR. And then I'll explicitly say your vlan-id is 4. It also doesn't hurt to hit up, delete out the vlan-id-- we've got set vlans HR. And if I hit question mark, we do have the ability to give it a description if that's what we want to do. So I can say description "HR vlan" here, and that way, we actually have a nice little description showing what we're doing whenever we need to read the configuration. It'll make more sense in one second. Let's create the IT VLAN.

7:33So I'll say set vlans IT vlan-id 5. We'll hit up, give it a description of "IT vlan". Notice that my description with spaces also has to be enclosed in double quotes. We'll say set vlans accounting. We'll put it in the vlan-id of 11. And I'll say, description is going to be "Acct vlan". And then lastly, set vlans CSuite with a vlan-id-- look, if I hit a question mark, you can see right here, it does say exactly explicitly that I can only set this VLAN-ID to be 1 through 4094.

8:07Just so you know, just so you can see that that's verified right there. Also, notice that this is primarily going to be used for an 802.1q tag whenever that time comes. But of course, it's also used exactly to identify the access ports, too. And this, of course, was VLAN-ID 254. So now if I give this a commit check, everything looks good. Oh, I forgot to give this a description, didn't I, though? That's important. Let's give it a description-- "Csuite vlan". And now what I'm going to say is show | compare, and we'll see what I've changed. Ah, there we go. So this is what my VLANs configuration looks like.

8:38I have the vlans tier, then each of my VLANs is identified by name. I can see exactly what is covered in the description, as well as which vlan-id do they belong to. So with these all in place, I'm now going to say commit. I'm going to give it a comment that says, "create vlans HR, IT, Acct, CSuite". I'll close my quotes and press Enter. And now my VLANs have been successfully created. If I quit out of configuration mode, I can now do a few things. First of all, just for fun, I'll say show system commit.

9:11And I see where my commit was, specifying what the comment was that I left, so I know exactly what took place in this commit. Secondly, I'll say show vlan. And then if I hit question mark, you see we've got a bunch of different things that we can enter here. We can identify the VLAN by name. We can say brief. We can say detail. We can say extensive. All of these are big, and you should have learned about those in the JNCIA. Let's start off with brief. There we go. It identifies each of the VLANs by name and their tag, whenever we set the layer 3 interface, or the ports that are available in this. In the next Nugget, we'll be circling back to it.

9:42I can also check out extensive, because that is, honestly, one of my favorite parameters to throw onto this. And we see all-- bunch of good information about the VLANs themselves. Notice that when we do extensive, we also see our default VLAN and how the interfaces are actually configured to be. Are they tagged, meaning are they trunk ports? Are they untagged, meaning they're access ports? And what interfaces belong to it? Notice, none of these have physical interfaces connected to it. They're all logical interfaces. And that's what the next Nugget's going to be all about-- what does all this mean?

10:14How do we configure different port types? Get ready to have some fun in the next Nugget. We've now created VLANs on an EX-series enterprise-grade switch. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] The VLANs are all created. But they don't really do anything unless we actually attach those VLANs to ports, whether that's trunk ports or access ports. So what we're going to do in this Nugget is take all that work that we've done in the previous Nugget and then see it in action as we actually deploy trunk ports and access ports. This is going to be a whole lot of fun as we start to explore the different characteristics of trunk ports and access interfaces. So get ready. Let's have some fun as we deploy access in trunk ports on EX series switches.

0:31So now it's time to actually do something with those VLANs. If I give it a show interfaces terse, let's see real quick. Well, I've got all of these ethernet switching ports. But none of them are associated to those VLANs. Remember, if I did show VLANs brief real quick. I see, well, I've got a bunch of VLANs created but no ports. This is actually where you would count up how many ports are in this VLAN. I have no ports listed there. So here's what I suggest. I suggest looking at my show interfaces terse output real quick. Let's have some fun with this.

1:03Let's put port 1 here in HR. Let's put port 2 in IT, port 3 in accounting, port 4 in C-suite. And then very cool, what we should do is talk about what happens when I need to carry all of those VLANs upstream to the next switch. Remember the concept of 802.1Q tagging where we could trunk each of these VLANs over one ethernet link up to the next switch. We would just tag them and let them know, let the upstream switch know which VLAN does this particular frame belong to.

1:36So let's take GE000 and turn it into a trunk port that can carry all of these VLAN. Keep in mind one very important thing about this trunk port that we're going to address when we get to this point, these are the four VLANs that we created, but there is also that concept of a default VLAN that's operating by default, very clever name after all, isn't it. That was VLAN 1 that was our default VLAN. So here we go. Let's get started configuring these interfaces. From configuration mode, the first thing I'm going to do is I'm going to move into edit interfaces GE001.

2:07This is where we wanted our HR report to be. If I say show, by default out of the box on EX series switches, they belong to the family of ethernet switching. That's correct. That's the protocol family that we want this particular interface to be in. It's not in inet because it's not a routed interface. Inet6 is a routed interface. ISO is for something, you know with isis. You'll learn about that later. The same with NPLS if you're in the service provider track. This is where we want this particular interface to behave like a switch. But we need to add some additional parameters to it.

2:38Do we want it to behave like an access port? And if so, which access port? Which VLAN does it belong to? This is where we go to configure this. So we're going to say, set unit 0 family ethernet switching, keeping in exactly the same that it was. But then we're going to say, your port mode is going to be-- hit question mark. We see we've got two options. Is this an access port or is this a trunk port? Recalling what we're doing here, I've got this switch with these interfaces. And I have a user in HR connecting into this interface. I don't want to have my user worry about tagging this frame as a frame comes in to this interface.

3:14I want this switch to already know which VLAN this belongs to. And that's why we would use an access port. An access port is all about the frames that go in or out of this interface are going to automatically belong to that specific VLAN. That way when we spin up another port, like an access port that belongs in the same VLAN, these two would have direct connectivity to each other without ever having to tag a frame. Or if this port becomes a trunk port, we would know that as a frame comes in on an access port, before it leaves the trunk port, make sure to tag it with the associated VLAN.

3:49So in this case, we're saying the port mode is going to be accessed. That way, now, when I say show, we see that this interface is configured for ethernet switching. And it's an access port. But without configuring anything else, which VLAN does it belong to? I'll give you a quiz. Yeah, it belongs to the default VLAN because that's the default setting on all of these. Therefore, this would only communicate to other devices that are communicating within the default VLAN, VLAN1. So we need to override that. We need to tell it, you belong to the HR VLAN.

4:20So I'm going to say, set unit 0 family ethernet switching. Then I'm going to say, VLAN members, and then you hit question. And you see again, you identify these by name. You can also identify a list of VLANs. But that really only applies to trunk ports. So in my case, I'm going to specify the HR VLAN, which it does tell me, this is associated with the VLAN tag of 4. Now, if I hit show, it looks like we've got our access port configured to be in the HR VLAN. I'm going to move up one tier, and we'll move on to the next interface.

4:52So I'll say set GE002 unit 0 family ethernet switching. And we knew that we wanted this one to also be an access port. So we'll say port mode of access. And this was going to for my ITV LAN. So I'll say for the Ethernet switching family, you are a member of VLAN IT. Also keep in mind that because we've now configured the names of each of these VLANs, you can use tab complete on Juniper operating systems to autocomplete them. So there's IT configured.

5:23And if I say show GE002, we see the configuration here. It looks good to go. Let's say set GE003 unit 0 family ethernet switching is going to be a port mode of access. And this one was going to belong to the VLAN members of accounting. If I say show GE003, we're looking good to go there. The last access port that we were configuring was going to be our C-suite executives. So I'll say set GE004 unit 0 family ethernet switching port mode of access and VLAN members of C-suite.

6:02So at this point, it looks like all of my access ports are configured exactly like I want. The last thing I need to do is get this trunk port up and running. That way it knows to tag this traffic as it goes across this one ethernet link towards an upstream switch so that they know, oh, this frame belongs to this VLAN. So what we're going to do is we're going to move into edit GE000. We're going to keep this in the protocol family of ethernet switching. But now of course, our port mode is going to be trunk. And this is where it gets a little bit trickier.

6:33We're going to identify, what are the VLANs that are allowed to be trunked over this port that also need to be tagged? You see, this is a thing about the trunk ports themselves. I'm going to draw two switches here on the screen and talk about what is the behavior between two trunk ports. For instance, if my HR VLAN wants to go across this trunk port, we're going to stick a tag of 4 on it before it goes up towards the interface, then that 4 is removed. However, what happens when I have someone plugged in to the default VLAN down here that was VLAN ID1?

7:06The default behavior on a trunk port is that we want to send that frame across the link completely untagged. That way when it's received, we see, oh, wait, this is an untagged frame. Therefore it belongs to the default VLAN. This is called the native VLAN ID. The native VLAN ID means if this frame is arriving on a trunk port untagged, meaning there's no 802.1Q tag, then it belongs to the native VLAN. And whatever your native VLAN is, you need to configure it so that switches know how to behave when they receive an untagged frame.

7:40It doesn't have to be VLAN ID1. You could change that to be VLAN ID10. You just need to make sure it matches on both sides, so they know not to tag the frame as it leaves the interface, or what to do when it receives an untagged frame. So what we're talking about now is when we say set unit 0 family ethernet switching VLAN members, we're saying, what are the tagged frames that we're going to allow over this trunk port? We specify which VLANs go over the trunk port. And because I'm allowing multiple VLANs over the trunk port, I use an open bracket to say, here's going to be a list of VLANs.

8:15So I'll say ACCT, C-suite, HR and IT. Then I say close brackets. When I press Enter here, now we'll say show. And you see how this is written out. The next thing I need to do is set the native VLAN ID. And this doesn't always show up in the most intuitive place. Let me say, set unit 0. And I'll give it a question mark. And so far everything is looking good. We're going to move into family ethernet switching and then say question mark one more time. And now under the ethernet switching without configuring anything under the VLAN members or without configuring things like the port mode, we see we have a native VLAN identification configuration.

8:52And this is the next most confusing part. In this case, we specify the VLAN by ID, not by name. This is like the only place in Juniper switching where we specify it by the VLAN ID and not by name. But this is where we would go to do it. In this case, since I want it to be my default VLAN, which is VLAN ID by default, I'm just going to set it to 1 and press Enter. So now when I say, show, this is how my trunk port is configured. We see that I have the protocol family of ethernet switching turned on. And it's going to behave like a trunk. These VLAN members are what's going to be tagged as they go across the trunk port.

9:24And this is what's going to be untagged as it goes across the trunk port. Let's give it a permit check. Waiting for the commit check. The EX 2200s are a little bit slower. So sometimes it takes a little bit longer for the commit check to take effect. But the configuration check succeeds. So let's commit and quit. Now we've created VLANs and attached them to interfaces. So we've done a huge amount of ethernet switching work on our EX series Switch. Now what I want to have happen is I want this EX 2200 to be able to handle routing traffic from one VLAN to the next. That way, if we have a host on the HR VLAN that needs to talk to the IT VLAN, they could communicate through the switch by allowing the switch to do the routing.

10:01That's what the next nugget's all about. I'll see you there. In the meantime, this has been configuring the interfaces on an EX series switch. I hope this has been informative for you. And I'd like to thank you for viewing.

0:05We touched on that concept of intervlan routing, and how it's an absolutely critical feature when it comes to deploying Juniper devices or really any device that a host needs to use as its default gateway. That way we could just push some of that stress of routing down closer towards the host themselves, and let maybe even the access core or the distribution core of our network handle that routing for us if it all takes place on the exact same device. So in this Nugget what we're going to do is, we're actually going to explore how to take those VLANs that we created and all of the access and trunk parts and then add one special interface into the mix that could perform some intervlan and routing for us directly on the Juniper switch itself.

0:42So let's get going deploying the layer 3 interface for each one of our VLANs oftentimes referred to as the Switched Virtual Interface. Let's get going. So now here's the scenario that we're going to have some fun with. We're going to be taking this Ethernet series, this EX series, which ethernet. EX series yes it is ethernet, EX series switch that we configured here and pretend for a moment that we had to say, an HR user right here, which was VLAN 4, and we had an IT user here, which was VLAN 5, and they wanted to communicate directly to each other maybe sharing a file or something like that, and we don't necessarily want to trump this up to a router and then back down the trunk port and out the interface so that the router can handle this.

1:22This is actually a design scenario called a Router on a Stick or RoaS, if that's what you want to call it. Because we have a one ethernet link going up that's trunking VLAN tagged traffic up to the router. The router performs the routing operation and sends the tag traffic back down destined for the other subnet or the other VLAN, and it's kind of an inefficient use of resources. I mean especially think about it like this, how stinking inefficient would it be if this device wanted to ping this device, and it had to go all the way down into the core in order to be routed back up or worse all the way over to a router in order to be routed back up when the devices that are located right here could perform this routing option for us.

2:05Or even better if the other device that we were trying to ping was connected to the exact same switch? We don't want to have to send it upstream just to send it back downstream and then over. These switches can handle this routing operation for us because a locally connected route is not that big of a lift first switch to perform. So let's talk about how to get this going. Jumping back to my EX series switch, let's say show VLANs real quick. And now I see this is why my VLANs look, I see which VLANs are participating in it. Notice when I do show VLANs, the trunk ports also show up as participating in the VLAN that's ge 0, 0, 0.

2:38So I have see that I have these VLANs, and what I want to have happen is a HR user to be able to speak directly to an IT user. The way this switch needs to make this happen is we have the switch, we need to basically turn a little router on inside of it. And the way routers work is they have to have a leg in each Ethernet segment to do this. So we're virtually going to accomplish this by just giving the switch an IP address located on each VLAN. So if I go into configuration mode, this is how I do this.

3:08I have VLAN ID 4 and VLAN ID 5. What I'm going to do is, I'm going to create an interface on the VLAN. We're going to say set interface is VLAN and then subinterface is going to be mapped directly to the VLAN ID itself. Note, you do not need to do this, it's just a cleanliness thing that you probably should do it this way. The subinterface of 4 is going to map to the VLAN ID of 4. However just creating the subinterface of 4 doesn't actually perform the map itself, you do have to explicitly set this again, this is just a naming convention in order to make it easier.

3:43So I'm going to say for the VLAN interface with a subunit of 4 we're going to use the family of inet address because we're creating an IPv4 address. Let's go ahead and give us IP address of-- oh, no, we used 10 in the earlier example. 10 dot 0 dot 4 dot 1, we'll put it 1 and slash 24. I'll now create the other interface that will be put into the other VLAN. Set interface is unit family inet address 10, 0, 5, 1, slash 24. So here's the thing we created the IPv4 address that's going to be usable by the VLAN itself, but the VLANs don't actually know, they're not actually associated to this interface yet.

4:24You have to go in the VLAN configuration and say, hey, HR VLAN that's your layer 3 interface. Hey, IT VLAN that's your layer 3 interface. So here's how we do this. I'm going to say set VLANs HR, and then the command is layer 3 interface. You then say this is going to be your VLAN subunit of 4. I'll say set VLANs IT is going to have the layer 3 interface, a VLAN subunit 5. All commit this configuration or at least I'll do a check first to validate that it works.

4:56She always want to do a commit check. Make sure that it's going to work before you actually just pull the trigger on this thing. And now I'll say commit with a comment intervlan routing enabled, and press Enter, and that's it. That's what it takes to actually configure this device to perform intervlan routing, that way this device now has an IP address on each of these VLANs. We create the VLAN interface and I'd like to put a subunit that matches the VLAN ID, that way it's nice and clear what's going on. Then we just associate that VLAN interface with the VLAN itself with the L3 interface command.

5:30So now, our EX series switch has been configured for VLANs interfaces and intervlan routing. I hope this has been informative for you, and I'd like to thank you for viewing.

0:05In a previous Nugget, I did sneakily mention that there is a scenario where we could have a phone and a computer plugged in to, essentially, the exact same port, right? We've got the computer passing through the phone to get to the actual internet or the internetwork that we're trying to run itself. How, then, do we set up a scenario where we've got two devices connected to the same port, but we want them in separate VLANs because we don't want our voice VLAN to be on the same traffic as someone browsing ESPN or, at least, writing data to a database or a file share, or something like that?

0:37We want those to be separated. Juniper has a way of handling this by configuring the voice VLAN. And it's a little bit different from other vendors' implementation of the voice VLAN. This is going to have a separate section under Ethernet switching options, where we tell it, for voice traffic, treat this interface differently. Let's get going, talking about how to configure the voice VLAN on EX Series switches. There is an interesting switching scenario that especially comes up in the enterprise, especially at the access tier, when it talks about IP phones and voice over IP and telephony. We did hint at this a little bit already, where we could have a switch, like, this one, and connected to it, is, first of all, a phone.

1:14This is going to be my attempt to draw a phone. It kind of looks, honestly, like, the mushroom guy on Mario Brothers right there. Doesn't it look like? OK, anyway, sorry. Here we go. So there's the phone. Well, maybe I'll put it like-- no, this is getting worse. I was going to put a dial there, but-- and then off of the phone, we have daisy chained a computer. Now, how does this work, because voice is often on a different VLAN than data, isn't it? I mean, it makes a whole lot of sense to do it that way. But we've only got one little switch configured here. Now, in the olden days, we would actually configure this to be an 802.1Q trunk. And theoretically, that is how it works.

1:47However, Juniper devices are configured specifically to identify what voice traffic is going to look like versus what data traffic is going to look like. And then we tell this interface that it has a voice VLAN that is separate from the data VLAN. Ultimately, what's going to happen is native frames that come in on this interface untagged are going to be associated with the voice VLAN. And the phone itself will tag the traffic from the computer as part of the data VLAN. [SOUND EFFECT] Wait, what did I just say?

2:18No, that's backwards. I got myself completely turned around here and just confused myself. Forget everything that I just said. The way this really works, the phone just behaves like a dumb switch. As the data packets themselves from the computer pass through the phone, they remain untagged. We're going to let the switch handle figuring out what untagged frames are all about. And that's why we configure our switchboards to be access boards and tell them what VLAN they belong in. So if we're using an accounting VLAN or an IT VLAN, or an HR VLAN, the computer doesn't have to worry about tagging those frames.

2:49And the phone doesn't have to worry about tagging those frames. The switchboard itself will just use the basic configuration and treat untagged frames the way it's always done. For the phone itself, when it needs to send voice traffic into the switch, it will have to tag that traffic with the voice VLAN tag. And then we configure the voice VLAN interface itself. And we tell it how it is should treat these tagged frames within the voice VLAN. So let's get going, creating a voice VLAN. What we're going to do is we're just going to create a voice VLAN first. I'm going to say, create set vlans voice and then give it a voice VLAN ID of something, like, vlan-id 99.

3:25I'll go ahead and just set the description here, too, at the same time. Why not? It's good measure here. Let's say, description, "voice vlan," and press Enter. That's created the voice VLAN. Now we need to do is associate that voice VLAN with the interface itself. I've been picking on my HR VLAN. So why not stick with it? I'm going to say run show vlan real quick. And I see my HR VLAN is configured on interface ge-0/0/1. So what I'm going to do is I'm going to say set an Ethernet switching option. This is where you go to configure the voice VLAN.

3:57Under Ethernet switching options, we have VoIP as one of our options that we can set. So this is where we're going to be saying, hey, these interfaces here can use a voice VLAN. In fact, what we're about to specify is the voice VLAN. I'll say interface ge-0/0/1.0 because we do have to specify the logical interface since that's where the protocol family is configured. Now I can say question mark, and we see what we can set. We can set the VLAN and then specify voice-- voice, right there. Beyond that, it's interesting to know that outside of the interface, if I hit question mark, we can also set things, like, class of service, like, the forwarding class.

4:33If I hit question mark here, now, we can say something, like, assured forwarding. That way, we can actually set class of service bits or QoS bits on the actual voice over IP frames themselves. Now, that's outside of the JNCIS topic. But it's such an easy configuration, I wanted you to know about that. So let me say show routing options. And you can see how this configure-- (SOUND EFFECT) oop, no-- show ethernet-switching-options, and you can see how this is configured right now. We created the voice VLAN under VLANs. And then under Ethernet switching options, we created the voice over IP tier. We said, for this interface, this VLAN is going to be associated with voice over IP traffic.

5:09Then we also set some very easy class of service bits allowing a shared forwarding to be tagged in the CoS bits on the frame itself. So if I give this a commit check, everything, I assume, is going to check out just fine. Ah, it does. Let's commit and quit. And now what you should know is the untagged traffic that comes in is going to be treated like a data VLAN. And the phone will now have to tag the outgoing frames with the voice traffic. Our switch, now knows how to treat the untagged versus tagged traffic and forward it on-- a little bit different from the trunk configuration, even though, theoretically, it does the exact same thing.

5:42So this has been understanding how to configure a voice VLAN on an EX Series switch. I hope this has been informative for you. And I'd like to thank you for viewing.

0:05The crazy thing about the MX-Series router is that they don't just stick to layer 3. In fact, one of the more popular service provider services that they could provide, very coincidentally named, to their customers is a layer 2 ethernet segment. That way, a customer who's got one site in, say, New York City, and a different site across town in New York City could still be connected as if they're on the layer 2 segment. The service provider provides their own backbone as a layer 2 ethernet segment for them to be carried. Now, there's a lot of content in the JNCIS service provider playlists on how this is actually done using QinQ technologies as well as link aggregation of multi-chassis link aggregation.

0:45It's fascinating stuff. But for now, what you should know is that the MX-Series router doesn't just call these VLANs. They actually call this a bridge domain because what they're really doing, at the end of the day, is bridging one customer site all the way to the other customer site. So let's explore how we would go through the bridge domain configurations on an MX-Series router to basically perform the same tasks as an EX-Series switch. Let's go. So switching is switching at the end of the day. But it does help to see what is the point of what it is that we're trying to do. And this topology-- if you're not following along in the JNCIS service provider-- this is a topology that we very much use in the JNCIS service provider studies that we have here at CBT Nuggets.

1:24Even though you're in the enterprise track and you may not be going for service provider, there's still a lot of enterprise in it because enterprises consume service provider services. The idea here is that we may have a device, like, this router here. Behind this device, we have a lot of hosts and servers that we have wanting to use service provider services. And then we have a remote site down here. And maybe a user in this remote site wants to access a server in this site. And beyond that, they want to do it directly using layer 2.

1:55They want to do a broadcast or an ARP and trunk all the way across the service provider backbone in order to reach end to end. This is absolutely something that service providers can do, believe it or not. They do this a bunch of different ways. The simplest way is QinQ. The most complicated way is EVPN or layer 2 VPN. There's also something called VPLS that leverages MPLS to make all of this happen. Anyway, they can do it. And you may encounter a vMX router at some point in your studies.

2:26And then be totally confused as to how to configure switching, and VLANs, and interface trunk ports, and layer 3 routed interfaces on these MX-Series routers because they're wildly different than the config-- actually, they're not wildly different-- they're essentially the exact same thing. But it's very different, at the same time, when you see it compared to the EX-Series switch. You don't create VLANs on a MX-Series router. You don't create VLAN interfaces on an MX-Series router. You don't even configure a port mode on the MX-Series router.

2:56There's different commands on an MX-Series router to accomplish the exact same thing. So I think I'm waiting on my MX-Series router to boot-- Oh, it is booted up here. Let me just get logged in here and I'll show you how we go about configuring this one step at a time. The first thing that you should know on an MX-Series router is that they don't consider this a VLAN or, at least, an area of a VLANs that they configure. What they configure is bridge domain. You see, the idea is that we may have multiple customers-- right here is one customer. But what if we had another customer up here and another customer up here, and they all wanted to trunk VLANs across our provider network?

3:29What we then need to do is create a domain for this customer, so that they can bridge from one site to the next site over our network. So what we do is we create a bridge domain and say what all interfaces or what all VLANs are associated with that bridge domain. So from vMX1-- oop, it's giving me some virtualization messages here-- Sorry about that. I'm going to go into configuration mode. And what I'm going to do is instead of creating VLANs, I'm going to create bridge domain. And just like the VLAN configuration, we identify our bridge domains by name.

4:00I'll say customer one, for instance, could be one of our customers that's going to send VLANs to us. Maybe I'll say this customer one BD, so that I know it's a customer one bridge domain. Then check this out. I can hit question mark here and there's a lot of additional configuration. But this one should look nice and familiar, VLAN ID. That's right. We can associate a VLAN with this customer or we can create a list of VLANs for this customer. Both are common deployment scenarios. For now, I'll say VLAN ID. And we'll put something, like, VLAN ID 101.

4:30That way, we know that the customer that's going to be sending stuff in to us, maybe we're going to tag those customers frames with our own frame of 101, or maybe we're expecting the customer to send tagged frames with 101 on them, already on them. And that way, we know how to receive them. I can also create a bridge domain for my customer two. I'll call this customer two BD. And maybe this customer is going to send multiple VLANs to us. So with a VLAN ID list, I can create a list of VLANs identified by number, like, 202, 203, 204, and then close the list.

5:03Now, if I say show bridge domains, we actually see how the actual bridge domains are listed out. And very cleverly-- I love this about the MX-Series routers-- because it identified that we did 202 through 204, it actually wrote it out as 202 through 204. It's a very handy way that we could actually create these VLANs. So now, we've created VLANs on this particular device on an MX-Series router. This is what it takes to do it. Instead of creating VLANs, we're creating bridge domains. Now, in the next Nugget, what we're going to do is assign these bridge domains on the interfaces themselves, both as access ports and as trunk ports.

5:36It's going to be a lot of fun. We'll see how to do this on an MX-Series router. I hope this has been informative for you. And I'd like to thank you for viewing.

0:05So now, that the bridge domains are created, that really, by de facto, created the VLANs themselves that the image series router can now use for its interfaces. And just like the EX switches, we could create access ports and trunk ports, so can we on the MX series routers. The crazy thing is if you haven't seen an MX series router, it kind of looks like a gigantic six foot tall chassis with just rows and rows and rows of ports. It kind of looks like a mega switch, even though its primary purpose is to be a router. So we can now configure all of these rows of ports to behave trunk ports or access ports if that's what we want them to do.

0:39We're just going to use the bridge protocol family on the interfaces themselves. Let's get go and explore how to configure an MX series routers interfaces to behave like a switchboard. So, our bridge domains are created for our customers. Now, what we need to do is actually associate their interfaces with the bridge domains themselves. What we're really talking about is these are the interfaces that we're expecting customers to send traffic to us. Again, maybe we are doing the ones doing the tagging as their frame arrives on this interface, or maybe they're sending tag frames up to us.

1:09It really depends on the deployment scenario. I'm not going to dig too deep into that. If you're interested in how you would actually do those things or why and when you would actually do those things totally covered on the JNCIS service provider, check out the content called service provider bridging concepts, as well as deploying QNQ. Whole lot of fun. All right. Here we go. So, what I'm going to do is I'm just going to move into edit interfaces ge-0/0/0. Let's pretend for a moment that this is going to be customer ones interface. If I say show, we actually have the family of inet configured on this interface.

1:40One of the things that you find out about in a MX series routers is they can either be layer 3 or they can be layer 2, but they can't be both. So what we need to do is we need to delete the family of inet because we want this interface to be doing switching. Now, what I'll do is I'll set the family of bridge. We're not setting the protocol of ethernet switching, we're setting this as the bridge family. And then interestingly, we don't actually associate-- we don't actually say you're part of customer 1 BD, we go straight into specifying the VLAN ID itself, like one on one.

2:12Because that's what we created above when we created the bridge domain. Now, I also want to point out another way that you could do this is you could set the interface within the bridge domain itself right there. So if I say top, it may be a good scenario for you to say set bridge domains customer 1 BD, and then specify the interface that you want to be associated with this bridge domain. So now, I can say show bridge domains, and we see it's created VLAN ID 101, and associated the interface to it, or I can say show interfaces ge-0/0/0.0.

2:46Oh, too many slashes. There we go. And now, I see that I've created this to be a switchboard in VLAN ID 101. We should also tell this explicitly that it's going to be an access port if we don't want to tag any frames going back out towards the customer. So, I'll say set interfaces ge-0/0/0.0 family bridge and the configuration here isn't porth mode, it's interface mode. Here, I can say you're on access port. The same thing can go for customer two. We go through a similar configuration. We'll do this on interfaces ge-0/0/1, pretending that's what's going to connect the customer to.

3:20I'll say family bridge, and then we're going to say the VLAN ID list. , Because up above we used a VLAN ID list. I can use the exact same syntax here and specify 202 through 204. But because this is sending multiple VLANS, we're definitely going to need to tag this, aren't we? So, I'll hit up and under the family of bridge for ge-0/0/1, I'll set the interface mode to be shrunk. Now, if I give it a commit check, let's just see how things are looking. And this is one of the first things that you should know, if we configure our interface under the bridge domain section, we cannot also configure it under the ethernet interface, at least not with an interface mode already set to it.

4:02So, what I'm going to do is I'm going to delete out the bridge domains command that we set for customer 1 BD. Let's specify the interface of ge-0/0/0.0. You're going to have one or the other. So, if you're going to configure the interfaces under the bridge domains, don't configure it under the interface or vise versa. Let me give it another commit check real quick. Everything checks out OK. But before I commit this, I want to also be able to configure layer 3 inter VLAN routing. That way, these bridge domains know which layer 3 interface they can broadcast into and use in order to communicate.

4:34That's what the next Nugget's all about. I hope this has been informative for you, and I'd like to thank you for viewing.

0:05Just like on the EX Series switch, where we had a switch virtual interface that could perform routing options and inter-VLAN and routing for us directly on the switch itself, we can do the very same thing with our bridge domains in the MX Series routers. What we're going to do in this particular Nugget is configure the routing interface on the bridge domain itself. This is going to feel very similar to what we did on the EX Series switch. It's just some slightly different commands that get us there. The end result is the exact same. So let's get going, getting the routing interface on a bridge domain configured in an MX Series router.

0:36I'll see you there. So our last step is to configure inter-VLAN routing. Another very common deployment scenario on Juniper MX Series routers. We already configured the Ethernet switching on it or at least we configured it under bridge domains. Now we're going to take those bridge domains and those VLANs associated with those bridge domains and configure the actual routing interfaces themselves. This is familiar to what we did on the EX Series switch, but it's just different enough to be kind of confusing. I'm going to start off by creating the interface first, and it's not the VLAN interface.

1:08Juniper devices uses the integrated routing and bridging interface or IRB. So instead of VLANs we're setting the IRB on the router. Then we say what unit we want this to be associated with. Again, I do this based on the VLAN IDs themselves. So I'm going to set unit 101 for VLAN ID of 101. Now I can set the family inet address. Let's put 192.168.101.1/24 just for cleanliness sake. For VLAN ID 202, I'm going to do the exact same thing.

1:38We're going to say set interfaces IRB unit 202 family inet address, the setting IP address, 2, 1 six 192.168.202.1/24. So this creates the interfaces themselves. Now I need to associate them with the bridge domains. Let's say set bridge domains for customer 1, and then the command that we're setting here is routing interface, not layer 3 interface routing interface. Then we specify irb.101 to set the sub-interface of 101 with it.

2:10Just like before, will say set bridge-domains this time for customer 2. And the routing interface is going to be irb.202. Now if I give this a commit check well, this makes a whole lot of sense because the previous bridge domain for customer two had a VLAN I'd list. It's expecting to have multiple VLANs and how can we associate one layer 3 interface with multiple VLAN, it makes a whole lot of sense. And that's why I configure this to actually show you explicitly what is the configuration failure error here. It says we need to have either a vlan-id or a vlan-tag not a vlan-id of list because that doesn't make a whole lot of sense, Knox.

2:46Of course not, that's why we're demonstrating this. So let's delete this configuration out. Now give it a commit check and at a minimum, the configuration check succeeds and now my customer 1 has the ability to actually be routed between VLANs on this particular bridge. We may not want to have our customers being routed themselves, but there are scenarios in the course of service providers where we may have layer 3 interfaces that we want to perform bridging and routing this way. You actually see this in JNCIA service provider content when you go to deploy multi-chassis link aggregation, specifically using the ICCP protocol.

3:20Fascinating stuff, and I'd really encourage you to check it out. So this is how to deploy inter-VLAN routing on an MX Series rather. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] So we've covered the Enterprise, we've covered the Service Provider. Now do it in the Data Center, that's what we're here to do. When you're working in a data center, you're more likely to encounter the Juniper QFX Series switch. And a switch is still a switch at the end of the day, so a lot of the stuff that you've seen on the EX Series switch is really applicable to the QFX Series switch. However, there are some slightly different commands for the QFX Series switch than the EX Series switch and I just wanted you to be aware of that.

0:31So what we're going to see here in this Nugget is a lot of stuff that you've already seen, probably in the EX Series switch, but just a slightly different command. And I'll call it out when we get to that point. So here's how we go configuring VLANs, access, trunk ports, and SVIs, all on a QFX Series switch. Now we're going to talk about one of the big whoppers in the Juniper lab and virtualization world, and that is the QFX Series switch here. This is what's used in the data center world, and this is going to be your primary usage when you start going into JNCIP Data Center. That being said, it is a good way to get some hands-on experience with data center technologies.

1:05Now, a lot of the stuff that you're looking at here is part of the Spanning Tree Protocol learning in skills and Nuggets that are coming up in the JNCIS playlists. And we do use the QFX Series routers to perform that because it's just an easier way to lab a bunch of different switches. But here we go. We're going to check out how to perform these configurations on the QFX switch. Now, it does take a while to mount and boot these devices up because they are whoppers. So I'm going to sit back and let it boot up here for a few minutes, and we'll come back to it once we're on the command line and we can get logged in to this QFX series switch.

1:36All right, here we are on the command line. It is booted up. It still may take a minute to recognize the packet forwarding engine because that's just the nature of these QFX devices. But let's get logged in here. Let's see. Just going to log in, type in the password. Oh-- it's struggling here today. One more time. There we go. OK, so I'm finally on the command line of this QFX Series device. Let's go into the configuration mode, and we're going to do the exact same things that we've been doing. Let's mimic what we did when we did this for the EX Series switch. We had HR, accounting, IT, and a C-suite executive.

2:08We'll do the same things here. I'll say set VLANs-- try it one more time because I keep getting syslog messages. There we go. Set VLANs then we'll say HR and VLAN ID. Exact same configurations as we did before. The VLAN ID was 4 for this one. We'll set VLANs for the IT VLAN, and we'll set the VLAN ID of 5. And I'm just going to stop there because that's all we need in order to demonstrate how to configure these items on a QFX Series switch. Where it starts to shake up a little bit, and I mean just a tiny little bit, is when we go into configuring the interfaces themselves.

2:40First of all, the EX Series switches, if you're an astute observer, you'd notice these are actually using 10 gig Ethernet interfaces. So the commands with GE are gone. Now we're actually using XE. Let's pick on xe-0/0/0 here and maybe xe-0/0/4 because I see my xe-0/0/0 would be an access port connecting to this host, but xe-0/0/4 may be a trunk port connecting to an upstream switch. So we'll say set interfaces xe-0/0/0 unit 0, and then the family here is Ethernet switching, just like it was on the EX Series switch.

3:14But this is where the one tiny command is a little bit different. Xe-0/0/0, we knew we wanted it to be an access port. The command on the EX Series switch was port mode, right? Well, we don't have a port mode on these 10 gig interfaces. We have an interface mode. Isn't that interesting? We had port mode, then we had, on the MX Series routers, we had interface type, and now on the 10 gig interfaces on the QFX Series switches, we have interface mode. And there's a syslog message again, throwing me off. Let's hit Up, and we've got interface mode. We're going to set this to be an access port.

3:46Now if I hit Up, we're going to set the VLANs. And again, the command is just like before, VLAN-members. Just like on the EX Series switch, we identify these by name. But because I haven't committed my configuration yet, I don't actually see the VLANs listed above. So I will have to explicitly type these out instead of tag completing them. So I'll say HR just for good measure here. And now if I say show interfaces xe-0/0/0, there's my configuration. Oh, it looks like I already had data on this one from a previous configuration. Let's delete that out.

4:16Unit 0, delete interfaces xe-0/0/0 unit 0, family Ethernet switching, VLAN members, data. Now, before I actually hit Enter, why do you think I want to delete data here out of this configuration? (SINGING) do-do-do. Because we set this to be access. And since we have an access port here, we can't have two VLANs associated with one access port on the Juniper platform. So I'll delete the data member out, and then say show interfaces xe-0/0/0. And now we have just the HR configuration.

4:47Now I want to configure the trunk port on the other end, going towards xe-0/0/3. So I'll say set interfaces xe-0/0/3, unit 0, family Ethernet switching. Again, my interface mode is going to be a trunk. Then under Ethernet switching, I can specify my VLAN members in an array. So I'll say HR and IT, enclose those brackets. And now if I say show interfaces xe-0/0/3. Oh, it looks like I already had the all VLANs allowed to traverse over this trunk port as a previous configuration.

5:20That's another good talking point. On the EX Series and QFX Series switches, instead of explicitly typing out every single VLAN, if you do want it to be trunked across that entire port, we can specify it right there with just an all, and that's allowable. So all of those VLANs would be trunked across it. And now with that being said, we can create the actual VLAN interfaces themselves. Yet this is another minor way that the QFX Series deviates from the EX Series. On the EX Series switches, we created the VLAN interface. On the MX Series, we created the IRB interface.

5:53The QFX Series also needs an IRB interface in order to create this configuration, even if the command that we type on the EX Series is the same. Watch this. It's going to be set interfaces IRB unit 4, to map to the HR VLAN, I'll say family inet address 192.168-- actually let's give it the IP address 10.0.4.1/24. Then I'll hit up. We'll do the exact same thing for unit 5, which was the IT VLAN.

6:23And now what I'll say is, I'll say set VLANs HR, layer 3 interface, exact same command that we did with EX Series devices. But now I'll say irb.4. If I hit Up, I can set the IT interface to be associated with IRB unit 5. If I say show VLANs, I see how the configuration is now set up. If I commit check this, it honestly may fail out because of this whole virtualization thing where it's stuck on the line card. It doesn't-- oh there it goes. It finally said it succeeded.

6:53I've been sitting here waiting for a while. OK, so it does check out. The configuration is good. So now we configured VLANs on the QFX appliance, identical to what we did with the EX Series switch. Then we configured the actual ports themselves. It's kind of a mix of both. We have the Ethernet switching family, but we're specifying an interface mode instead of a port mode. Then we configured Switched Virtual Interfaces and inter-VLAN routing. The actual Switched Virtual Interface is configured under the IRB, or the integrated routing and bridging interface, as opposed to the VLAN interface.

7:25This was much closer to what we saw on the MX Series switches. But then we configured the VLANs themselves to have a layer 3 interface, just like we did on the EX Series switches. So the QFX Series switch, the reason why I saved it for last, is it's kind of a blend between what happens on the EX Series switch and the MX series router. So that's been understanding how to deploy switching on the QFX appliances. I hope this has been informative for you, and I'd like to thank you for viewing.

0:05So there you have it. There's the Juniper switching journey, and you're now acclimated to how Juniper approaches layer 2. It's not terribly different from other vendors until you start getting into the switch virtual interfaces. VLAN is still a VLAN, and a trunk port is still a trunk port and an access port isn't access port. But then when you attach those interfaces to the VLANs and then the VLANs to the switch virtual interface, it can get a little fuzzy the first couple of times you do it. Trust me after you've typed those commands a few 100,000 times like I have, you'll be just on autopilot, and you'll just truly understand how Juniper approaches layer 2 switching.

0:40So that's been how to handle layer 2 switching on EX series, EMX series, and QFX series devices. I hope this has been informative for you, and I'd like to thank you for viewing.