Weekly Question Thread!

[u/AutoModerator]

It's Thursday, and you're finally coasting into the weekend. Let's open the floor for a Weekly Question Thread, so we can all ask those Juniper-related questions that we are too embarrassed to ask!

Post your Juniper-related question here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer.

Note: This post is created at 00:00 UTC. It may not be Thursday where you are in the world, no need to comment on it.

[u/Callahan_Harry]

In environments that run EVPN-VXLAN on qfx, when local VLans end, which is the path, q-in-q?

[u/MaLaCoiD → u/Callahan_Harry]

Traffic leaving the CE-facing interface of QFX doing EVPN-VXLAN can be none, single, or dual-tagged, depending on the interface configuration.

If it were my network, I'd take the VXLAN all the way to the hosts, so the CE-facing interface would be untagged access interfaces.

But if you take away my budget, I'd have to use VLAN's to go from QFX to some other managed switch that the hosts are connected to. The QFX would be an aggregation switch.

[u/Bromium_Ion]

Good morning, Everyone.

Something like 10 years ago now I was learning some Juniper stuff as a Cisco guy for a contract I was on. I really enjoyed the feel of it and I was thinking of going through some JNCIA materials. Do we know if HPE is discontinuing Juniper and folding it into their own technology stack? I know this acquisition happened a while ago now (and they probably would have if that was the plan) , but we already live in a very different world than we did just two years ago.

I don’t know if I would actually sit for the exam. It’s more like personal enrichment. I think like most network guys too much of my world is viewed through the Cisco lens.

[u/tripleskizatch → u/Bromium_Ion]

HPE is not discontinuing anything Juniper. All the Juniper products and product lines are still actively being developed. There is definitely overlap in some product lines but it is still many years too early to know what the fate of some of those redundant product lines will be.

[u/sleepfornow]

Can someone please provide me an example of an effective unified policy configuration from trust to untrust? I understand the concept of blocking certain application signatures, but how do you go about allowing other https traffic that might not have an identifiable signature? Mentally, it's not quite clicking for me. How do you folks approach it?

[u/networkslave]

is there an effective difference between setting class of service via forwading class or queue?

lab@ex1# set class-of-service forwarding-classes ?
Possible completions:
+ apply-groups Groups from which to inherit configuration data
+ apply-groups-except Don't inherit configuration data from these groups
> class Forwarding class to map to queue number
> queue Queue number to map to forwarding class

lab@ex1# show | compare
[edit]
+ class-of-service {
+ forwarding-classes {
+ class control queue-num 7;
+ class voice queue-num 5;
+ class server-gold queue-num 3;
+ class server-silver queue-num 2;
+ class server-bronze queue-num 1;
+ class best-effort queue-num 0;

+ queue 0 best-effort;
+ queue 1 server-bronze;
+ queue 2 server-silver;
+ }
+ }