Configure MLFR (Multilink Frame Relay) on Juniper SRX Firewalls

I came across one of the Integrated Services type firewall, and was asked to configure a MLFR bundle on it. The firewall was Juniper SRX (I admit, I love these boxes). But MLFR on a firewall … who has heard of those. I had prepared for doing a MLPPP but on the turn up call, the service provider wanted us to use MLFR as that’s what they supported for that particular site.
For the non techy gurus who are wondering what the MLFR is, it’s a simple Multilink Frame Relay Bundle, meaning you have more than one T1/E1 Link and you bundle them on frame relay (Yes … some of us still use Frame Relay Smile )
More often you would have done MPPP bundling, but the exciting part was to do a MLFR between Juniper and Cisco and on the Juniper end it was a firewall.
Here is a simple diagram

image
As you can see the connectivity from customer perspective is pretty simple. There are 2 Physical links going on the Service Provider network (T1 Links) and we need to create a bundle logical connectivity (The Solid red line ) between us and the service provider.

Points to Note:

  • Since we are creating the MLFR bundle between Cisco and Juniper, we can only use FRF.16 specification for the MLFR bundle.
  • To read about the FRF.16 Specification Click Here
Since we will talk in detail about the juniper end, I would briefly mention the Cisco end Configuration

Cisco Sample Configuration:

 
!
controller T1 0/0/0
framing esf
linecode b8zs
channel-group 0 timeslots 1-24 speed 64 
!
controller T1 0/0/1
framing esf
linecode b8zs
channel-group 0 timeslots 1-24 speed 64 
!
interface MFR1
description MultiLink Bundle 
no ip address
encapsulation frame-relay IETF
frame-relay multilink bid
frame-relay lmi-type ansi
no shutdown
!
interface MFR1.100 point-to-point
description 
ip unnumbered Fastethernet0/0
frame-relay interface-dlci 100 IETF
!
interface Serial0/0/0
description MultiLink Circuit 1 
no ip address
encapsulation frame-relay MFR1
no arp frame-relay
!
interface Serial0/1/0
description MultiLink Circuit 2
no ip address
encapsulation frame-relay MFR1
no arp frame-relay

!

Juniper Configuration:

To configure a MLFR bundle on Juniper routers and Firewalls are the same thing, execpt for the few extra steps on Firewall
  • Configure the T1 Links
  • Bring up the virtual Interfaces
  • Configure the Virtual Interface
  • Assign the Virtual Interface in a Security Zone (Firewall Only)
As you can see the first 3 steps are similar in the Juniper Routers and SRX firewalls

Configure T1 links:
By far the simplest, most of the values for this will be given by the service provider itself
  • Clocking
  • Encapsulation
  • Line Encoding
  • Framing
These are the configurations needed. We first need to boot the SRX and see the T1 cards are recognized or not. You can do that by issuing the “show interface terse | match t1” 
root@DEMOSRX> show interfaces terse | match t1
t1-3/0/0                up    up
t1-4/0/0                up    up
As you can see above the 2 T1 cards are detected in FPC 3 and 4. Now we need to bundle that. Here is the configuration sample for one (Please make sure both have identical configuration) (Under edit Interfaces)
t1-3/0/0 {
keepalives;
clocking external;
encapsulation multilink-frame-relay-uni-nni;
t1-options {
timeslots 1-24;
line-encoding b8zs;
framing esf;
}
}

So you can see that we have set the T1 options for the first t1 card, we will need to do the same for the second one as well.
Bring up Virtual interface
In JunOS, we need to explicitly bring up the virtual interfaces. The virtual interfaces is a multipurpose one. We will not go into detail. But please remember in version 10.x of the JunOS, in SRX, the virtual interfaces are called “lsq” interfaces and in the old versions and the routers we have them as “ls” interfaces.
We need to create the virtual bundles by the following (Under Edit)
chassis {
fpc 0 {
pic 0 {
mlfr-uni-nni-bundles 1;
}
}
}

So here we say that we need to create a single mlfr bundle. We can create upto 32 of these bundles, but I don’t think practically on a SRX, we would go that far.
Once you commit the above configurations you should have new interfaces created, Just type the command “show interface terse | match lsq”
root@DEMOSRX> show interfaces terse | match lsq
lsq-0/0/0               up    up
lsq-0/0/0:0             up    up
As you can see the new Interfaces “lsq-0/0/0:0” was created. So we have created the virtual interface
Configure the Virtual interface:
In configuring the Virtual interface, there are 2 steps, we need to add the T1 interfaces on the virtual interface and we will need to configure the interface itself.
This is how the interface t1-3/0/0 looks 
root@DEMOSRX> show configuration interfaces t1-3/0/0
keepalives;
clocking external;
encapsulation multilink-frame-relay-uni-nni;
t1-options {
timeslots 1-24;
line-encoding b8zs;
framing esf;
}
unit 0 {
family mlfr-uni-nni {
bundle lsq-0/0/0:0;
}
}

 

Here you see that we created a unit and then mentioned the name of the lsq interface, which will associate the t1 link to that bundle. Similarly, we need to do that on the t1-4/0/0 as well 

AS far as the configuration of the lsq interface itself is concerned, here is how it looks 




root@DEMOSRX> show configuration interfaces lsq-0/0/0:0
description ***MLFR Bundle Logical Interface***;
encapsulation multilink-frame-relay-uni-nni;
mlfr-uni-nni-bundle-options {
cisco-interoperability {
send-lip-remove-link-for-link-reject;
}
lmi-type ansi;
}
unit 0 {
dlci 100;
}
  



So you can see that here is where we mention the DLCI and the LMI type. 

If you are on a router, the link is now going to be up, you can verify that by looking at the show interface terse and the lsq sub interface will show as up – up 


Associating Security Zone:
Once you are trying to do it in a SRX, you will need to associate it to a security zone and the interface needs to be bound to the zone and the policies need to be applied. 




root@DEMOSRX> show configuration security zones security-zone external-zone
screen untrust-screen;
host-inbound-traffic {
system-services {
ping;
}
}
interfaces {
lsq-0/0/0:0.0;
}



So here we created a zone called external-zone and map the interface lsq-0/0/0:0.0 to this zone. Once this is done, and you have made a security policy and applied for this zone and added routes, you should be up and running. 
Hope you find this informative and please let me know if you have questions, I will try my best to answer them.









































Comments















Post a Comment



















Popular posts from this blog









Juniper Aggregate Interfaces (LACP/No LACP)




















Image







    Last week, I was implementing link aggregation on Juniper EX Series switches (EX4200). I was moving them off HP switches and putting them into Juniper.   We were moving VMWare ESX boxes, NetApp and some physical boxes, though the configuration is very simple, I would like to mention how to do those with these boxes.   Points to remember:     You will explicitly need to create “Aggregated Ethernet” interfaces on juniper     You cannot have more than 64 AE interfaces on a single Virtual Chassis     You cannot change the algorithm for load balancing between the multiple links. (If you are interested in the Junipers LAG algorithm read this  )     Now having said this, lets look at the common steps, you need to create the Aggregated Ethernet interfaces on the Juniper.    root@EX4200#set chassis aggregated-devices ethernet device-count  4    The above command will create 4 “ae” interfaces, after you commit, you should see ae0 – ae 3 created. You can have any value between 1 and 64 in...








Read more










Exporting Contacts out of Blackberry with Windows Contacts




















Image







So, you are trying to get your contacts out of your blackberry and sync it to your Android / iPhone / Windows Phone, or just want to sync it to your Google account for backup purposes. Here are a few tips that will get you started – I have just enumerated some methods.  Option 1: Use Blackberry Desktop 6 (Manual)   (Not the most updated software) – It can directly export out your contacts out in the CSV Format. Please read the official How-To here  Option 2: Using Blackberry Desktop 7 (Manual)  If you have a Blackberry Desktop 7 – Which most likely you may end up having, here is how you can do it – For people who don’t want to use the sync (Option 3)  Step 1: Backup BB Contacts to Windows Contacts     Connect your Phone to your Windows (Assuming you have Windows 7/8/8.1)   Click On Organizer       Select Configure       Select “One-Way to Your Computer and Windows Contacts (You may Sync it to your outlook, but that’s not covered in this blog)      Click on Sync Organizer (Sync All) on ...








Read more










Configuring Multicasting with Juniper EX switches (Part 1)




















Image







    Configuring multicast routing using Protocol Independent Multicast in a all Juniper environment is as simple as the Cisco environment, but when I searched, I dint find good articles or KB’s explaining this, so I decided to write one.   I am fairly certain that if you have searched and arrived at this post, you know the basics of multicasting and IGMP, but yet, for the benefit of all readers, I will in brief describe the need for multicast. Please note, that this is just the IPv4 version of the story presented in a understandable manner and not all aspects of multicast are covered, but only the ones needed for this post.   What is Multicast ?   In IPv4 we have 3 kinds of packets,     Unicast – One Source, One Destination     Broadcast – One source and all destinations     Multicast – One source and many destinations     Now, all of us are familiar with the first one, we use it almost every minute we are on a network connected equipment.   To, explain all this, lets choose different ...








Read more