3troubleshootingjunos

Not

Relying on in-band m thods to manage your network might seem like a good idea up until the point that a circuit or hardware outage prevents you from accessing your network, and as a result, olongs corrective actions. We highly recommend deploying

foran out-of-band management network because it provides you with a back door into your netwo k du ing times of outage or disruption.

Deploying an ReproductionOut-of-Band Management Network

All JUNOS platfo ms come with a built-in out-of-band interface in the form of fxp0. Note that xp0 is an out-of-band interface because transit traffic cannot be routed over this inter ace. Put another way, if a packet arrives on fxp0 it can never egress on a PFE inter ace, and vice versa. Because of this behavior, we do not recommend running a routing protocol over the fpx0 interface in most cases. Instead, we recommend a static route flagged with no-readvertise. This flag ensures that the static route used out-of-band connectivity does not advertise over any routing protocol.

We also recommend the use of a backup-gateway, especially when your hardware supports redundant REs. You use the backup gateway entry whenever rpd is not running, such as in the case of a backup RE or a system that has had rpd shutdown because of thrashing.

Continued on next page.

Not

Not

Troubleshooting JUNOS Platforms

SynchronizeReproductionRout r Clock

We recomm nd using the N twork Time Protocol (NTP) to synchronize all routers to a common, and f rably accurate, time source. By synchronizing all routers, you ensure that time stamps on log messages are both accurate and meaningful, which is

forespecially important when conducting security-related forensics where you must co elate events that might have occurred on numerous machines.

JUNOS Software Needs a Reference

The basis for the NTP protocol is a series of timing hierarchies, with a Stratum 1 (atomic) timing source at the very top. While accuracy is desirable, you do not need to synchronize to Stratum 1 reference to benefit from having synchronized views as to the time of day. JUNOS Software cannot provide its own timing source because it does not support the definition of a local, undisciplined clock source (for example, the local crystal oscillator). If needed, you can always obtain a commodity UNIX device of some type with a configuration that provides a timing reference based on its local clock. Again, remember that any synchronization, even if based on an inaccurate local clock, is better than none.

JUNOS Software supports client, sever, and symmetric modes of NTP operation, and can also support broadcast and authentication. We recommend the use of authentication to ensure that an attacker cannot compromise your synchronization.

Not

Troubleshooting JUNOS Platforms

dump statusReproductionnormally requires a reboot of the PFE before placing the settings into foreffect. You can place the change into effect immediately by issuing a set coredump

Enable Core Dum s

enable command on each PFE component that contains an embedded host. The chassis dump- -panic statement enables core dumps on all PFE components (at reboot).

Configuration Requires Hidden Commands

The slide shows the hidden configuration statements that you need to enable system and chassis core dumps.

Not

Because core dumps are so critical when dealing with transient software failures, it is worthwhile to confirm the curr nt s ttings for both system and chassis dumps. Waiting until after a crash to find out that you needed a reboot to enable a PFE core file is no way to begin the day.

forThe fi st code example shows the operator using the shell to obtain kernel parameters via the sysctl command. The output pipes to grep with the match criteria of

Confirming DumpReproductionS ttings

c edump. In this example it is clear that we enabled kernel core dumps.

Con irming PFE Dump Settings

You can establish a vty or cty connection from the RE to an embedded host on the PFE to confirm the dump status of a given PFE component by issuing a show coredump command. In this example, we see a confirmation that we enabled core dumps for an M10i router’s CFEB. Note that this setting tells the PFE component that it should place a copy of its core file onto the RE’s /var/tmp directory, where you can easily access the core file.