The firewall filters are applied to the routed vlan interfaces themselves so only need to be applied on the switch with these interfaces configured.
The downstream switches in your case have only one routed interface so they cannot cross vlans directly. They are using the interface on the core switch.
Does EX4600 come with a two power supplies ?
in other words if i'm going to use it with another EX4600 in a VC shall I purchase another power supply to avoid failure in the power source ?
or it is enough the power it has ?
Hi HDawood,
1] Yes, the EX4600 is shipped from the factory with two power supplies.
Each power supply is a hot-removable and hot-insertable field-replaceable unit (FRU) when the second power supply is installed and running.
2] If you are going to purchase another EX 4600 to setup Virtual Chassis, that too will be shipped with 2 Power Supplies. I believe you can purchase another power supply a spare, also note that if you have a valid support contract then you could get a replacement for the failed power supply.
For more details wrt EX 4600 Power Supply, refer : https://www.juniper.net/documentation/en_US/release-independent/junos/topics/topic-map/ex4600-power-system.html
Hope this helps. 
Please mark "Accept as solution" if this answers your query.
Kudos are appreciated too!
Regards,
Sharat Ainapur
If I could trouble you, an example would be great.
This is a generic example of controling traffic on ex switches with firewall filters.
@HDawood I am not sure where you are getting your info from, but that SKU (JNP-10G-SR-8PACK) is still in the Juniper Price List as of June, and I do not remember any End of Sale announcement for that SKU, nor could I find any.
Now if indeed that SKU is now EoS, the replacement would be to purchase [in qty of 8] any other of the many 10GE-SR SKUs - these all now provide the same optic.
The 8-pack SKU provided no price reduction, was just created to ease of ordering large quantities. I believe this was not a popular item, as most people just order the single unit SKU with proper quantities.
Hopefully this helps. I doubt Customer Care would know anymore, as these are product PLM decisions.
Hello, thanks for you response.
I added a new IP to the lo0 and marked it as primary, and configured the -default-address-selection.
But even with that i still see the following:
------------------------
show interfaces lo0
Physical interface: lo0, Enabled, Physical link is Up
Interface index: 6, SNMP ifIndex: 6
Type: Loopback, MTU: Unlimited
Device flags : Present Running Loopback
Interface flags: SNMP-Traps
Link flags : None
Last flapped : Never
Input packets : 10347840
Output packets: 10347840
Logical interface lo0.0 (Index 563) (SNMP ifIndex 16)
Flags: SNMP-Traps Encapsulation: Unspecified
Input packets : 0
Output packets: 0
Protocol inet, MTU: Unlimited
Max nh cache: 0, New hold nh limit: 0, Curr nh cnt: 0, Curr new hold cnt: 0,
NH drop cnt: 0
Flags: Sendbcast-pkt-to-re
Addresses, Flags: Is-Default Is-Primary
Local: 10.99.99.40
Logical interface lo0.16385 (Index 545) (SNMP ifIndex 22)
Flags: SNMP-Traps Encapsulation: Unspecified
Input packets : 10347137
Output packets: 10347137
Protocol inet, MTU: Unlimited
Max nh cache: 0, New hold nh limit: 0, Curr nh cnt: 0, Curr new hold cnt: 0,
NH drop cnt: 0
Flags: None
------------------------------
And when removing the IP:
root@HOST-SW01> show interfaces lo0
Physical interface: lo0, Enabled, Physical link is Up
Interface index: 6, SNMP ifIndex: 6
Type: Loopback, MTU: Unlimited
Device flags : Present Running Loopback
Interface flags: SNMP-Traps
Link flags : None
Last flapped : Never
Input packets : 10351717
Output packets: 10351717
Logical interface lo0.0 (Index 563) (SNMP ifIndex 16)
Flags: SNMP-Traps Encapsulation: Unspecified
Input packets : 0
Output packets: 0
Protocol inet, MTU: Unlimited
Max nh cache: 0, New hold nh limit: 0, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0
Flags: Sendbcast-pkt-to-re
Logical interface lo0.16385 (Index 545) (SNMP ifIndex 22)
Flags: SNMP-Traps Encapsulation: Unspecified
Input packets : 10351012
Output packets: 10351012
Protocol inet, MTU: Unlimited
Max nh cache: 0, New hold nh limit: 0, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0
Flags: None
It doesnt seem to work..
Hi Spluka,
Yes adding the options for 'source-adress' and 'routing-instance' does help my problem with certain configuration like radius and etc.
But i cant seeem to get it working with NTP, and archival-site with FTP.
All i would want is to be able to configure a new MGMT vlan which uses it IP as default source adress, it must be possible to overwrite the routing-instance/lo0?
For instance, if i configure a vlan/irb with a low unit number it outranks the default 101 vlan and since there is no lo0 configured it works, and i dont understand why it doesnt work as is with the ISP loopback adress which has been given to us and is the router ID. the lo0 interface is in the inet.0 but if i write following "ping <HOST> source 10.99.99.40 it cant assign the adress, if i specify the routing-instance with the IP 10.99.99.40 as the router-id it works "ping <HOST> routing-instance 901>"
Hi Reload,
To answer your queries:
1) As per my knowledge, there is no zone concept in QFX series devices as seen in MX. One reason why I believe this to be true is, the power supplies are 1+1 redundant. The device is capable of working on a single power supply and there is no load sharing as far as I am aware of.
2) Yes, you can remove a PEM with the other PEM in its slot (PEMs are hot-insertable and hot-removable). At a given point in time, the chassis should have one healthy PEM inserted in the PEM slot. As mentioned above, the power supplies are 1+1 redundant.
3) If the device has a working and healthy power supply inserted in one of the PEM slots, the device stays up.
4) In case you want to inter-change the PEMs in their slots, you can choose to do this one PEM at a time. If you do not want your device to undergo a shutdown, please use a spare third PEM to achieve this seamlessly.
5) I believe both AC and DC power supplies are 1+ 1 redundancy which makes it, NO. There is no specific AC DC type that will change this rule.
6) You need not change both the PEMs in slots to check the issue with one PEM. In case there is an issue with both PEMs, the device is taken down in an ideal case.
The below links might help you with replacements(or even in swap test):
Hope this helps
Please mark "Accepted Solution" if this helps you solve your query. Kudos are always appreciated.
Hi,
Power supplies should be redundent to each other not having certain power zones to serve.
If this solves your problem, please mark this post as "Accepted Solution.
Hi everybody,
I finally got that up and running. I've disabled the xe-0/1/1 port and enabled ge-0/1/1 port. Then I configured trunk mode including targeted VLAN subnets and the link became available with just 1GbE on a 10GbE SFP+ port. The only thing that is annoying is the blink speed LED that isn't attached to the info-select button at all. Link is working stable since 4 days ago running a non-Juniper SFP module.
So this is really strange that the docuumentation is telling is that this wouldn't work at all but the reality is showing us something else. But once again many thanks for the help I got - I've learned a lot.
Hi Reload,
Greetings,
Verify the status of PEM and also if the PEM airflow direction matches the chassis:
show chassis hardware | match Power show chassis environment | match Power show chassis environment pem
Caution:
Verify that the airflow direction on the power supply handle matches the direction of airflow in the chassis. Ensure that each power supply you install in the chassis has the same airflow direction. If you install power supplies with two different airflow directions, Junos OS raises an alarm. If you need to convert the airflow pattern on a chassis, you must change out all the fans and power supplies at one time to use the new direction.
Reference Links:
Hope this helps.
Please mark "Accept as solution" if this answers your query. Kudos are appreciated too!
Regards,
Sharat Ainapur
Hi F1ght3r & Shlinga,
Thanks for your help.
Hi Sharat,
Thanks for your answer.
Actually I want to know if there is an EX Series Switch that support G8032v2.
Regards
Thats exactly the same document I've referenced. The syntax vary between that and the version on my switch. For example I have to use following:
edit firewall family ethernet-switching filter vlan_50 set term 1 from ip-destination-address 192.168.48.0/24 set term 1 then discard set vlans 50 forwarding-options filter input vlan_50
What confuses me where input/output and ingree/egress filters are applied. If you look at my example, filter is applied on vlan 50 on the input although the traffic originates from vlan 50 and goes to vlan 48. Shouldn't the filter be applied on the egress traffic of vlan 50?
On the other note, I'm having issue with web-management interface. If I only have https enabled:
web-management {
http;
https {
system-generated-certificate;
interface irb.10;
}
}I get err_too_many_redirects error. If I enable http, that works but its not secure.
Also, in one of the switch I'm getting Phone Home Client on the web interface. I saw following in its conf:
groups {
phcd_user_script {
system {
scripts {
op {
allow-url-for-python;
}
language python;
}
}
}
}
apply-groups phcd_user_script;I have removed delete apply-groups phcd_user_script but the issue persists. How do I get rid of this and get to normal Juniper Web Device Manager ?
Hi Septo_DW
Greetings,
I believe G8032v2 is not supported on the EX series switches.
As per this documentation : Using G.8032 Ethernet Stitching released on Feb 2017(which is quite old for now) .
By default, version 2 is enabled on the following Junos OS Releases for the following platforms:
Again, if someone can point to latest documentation for G8032v2 support on EX series switches, maybe some expert could help us find the right documentation which explains this.
Hope this helps.
Please mark "Accept as solution" if this answers your query.
Kudos are appreciated too!
Regards,
Sharat Ainapur
hi all,
There are optic devices on the qfx. How to determine about how many km optic devices can support? And what is the difference between 1310 and 1533nm?
>show chassis pic fpc-slot 0 pic-slot 0
FPC slot 0, PIC slot 0 information:
PIC port information:
Fiber Xcvr vendor Wave- Xcvr JNPR
Port Cable type type Xcvr vendor part number length Firmware Rev
0 10GBASE LR SM SOURCEPHOTONICS SPP10ELRCDFFJNP 1310 nm 0.0 REV 01
1 10GBASE SR MM SumitomoElectric SPP5100SR-J3 850 nm 0.0 REV 01
2 10GBASE LR SM SOURCEPHOTONICS SPP10ELREDFFJNP 1310 nm 0.0 REV 01
4 GIGE 1000T n/a CISCO-METHODE SP7041_Rev_F 1533.07 nm 0.0 2
37 10GBASE SR MM FINISAR CORP. FTLX8571D3BCL-J1 850 nm 0.0 REV 01
40 10GBASE LR SM SOURCEPHOTONICS SPP10ELREDFFJNP 1310 nm 0.0 REV 01
Hi Sharat,
Thanks for your help, really appreciate it.
Hey Arix,
Greetings,
The values 1310nm and 1533nm are wavelength values for the optics. Typically, 1310nm is used for single-mode shorter length applications. Whereas 1533nm is used for extremely long distance high bandwidth applications.
I believe there is NO command to get the reach of these optics and few of them could be non-juniper as well.
Per my understanding, the maximum reach for :
1310 SMF (Single Mode Fiber) is approximately 10kms
1533 SMF (Single Mode Fiber), 1533nm - considering it close to 1550 nm would be around 70-80 kms.
For the Juniper Optics Modules, you could use this table and understand the distance in the Max Reach column:
https://www.juniper.net/us/en/local/pdf/datasheets/1000329-en.pdf
Hope this answers your query.
Mark "Accept as solution" if this answers. Kudos are appreciated too!
Regards,
Sharat Ainapur