In this post, we will look at configuring VLANs, trunk ports, and IRB (or VLAN) interfaces on Junos devices.
The IRB interfaces are layer 3 interfaces for VLANs and are the same as Cisco VLAN or SVI interfaces.
The commands here are based on the Enhanced Layer 2 Software (ELS) style of CLI which is used on modern hardware.
Older EX and SRX models will use the non-ELS style which is different. These will likely have a ‘vlan’ interface rather than an ‘irb’ interface.
Basic VLAN Configuration
The basic setup for VLANs is to:
- Configure the VLANs
- Configure access ports to be part of the VLAN
- Configure trunk ports for inter-switch connections
- Configure layer 3 IRB interfaces and associate them with the relevant VLAN.
Configure The VLAN
The following commands define the VLAN. The description is optional but I highly recommend setting one.
set vlans <<VLAN Name>> vlan-id <<VLAN Number>>
set vlans <<VLAN Name>>description <<VLAN Description>>Configure An Access Port
An interface configured for family ethernet-switching will assume it is an access port if no interface-mode is specified. I like to add it for clarity.
set interfaces <<Interface>> unit 0 family ethernet-switching interface-mode access
set interfaces <<Interface>> unit 0 family ethernet-switching vlan members <<VLAN Name or ID>>Configure A Trunk Port
Trunk ports can have VLANs added to them either one at a time, as a range, or as a space-separated list of VLANs enclosed in square brackets.
set interfaces <<Interface>> unit 0 family ethernet-switching interface-mode trunk
set interfaces <<Interface>> unit 0 family ethernet-switching vlan members <<VLAN Name or ID>>
or
set interfaces <<Interface>> unit 0 family ethernet-switching vlan members [ <<List of VLAN Name or ID>> ]Configure VLAN or IRB Interface
To configure a layer 3 interface for a VLAN we need to do two things. First, create the IRB interface. Although not necessary it is helpful to make the unit number the same as the VLAN ID.
Then, associate the IRB interface with the VLAN, remembering to specify the correct unit number.
set interfaces irb unit <<Unit Number>> family inet address <<IP Address/Netmask>>
set vlans <<VLAN Name>> l3-interface irb.<<Unit Number>>Verification Commands
To verify the configuration you can run the following commands.
show vlans brief
show ethernet-switching interface
or
show ethernet-switching interface <<Interface>>All of the above is shown in more detail in the examples below.
Junos VLAN Configuration Example
Lab Environment
The lab is set up as per the below diagram.
It consists of:
- One virtual EX switch running Junos 23.1R1.
- One virtual QFX switch running Junos 21.3R3.
- Each switch has two clients connected, one in VLAN 10 and the other in VLAN 20.
- VLAN 10 is given subnet 192.168.10.0/24, with Linux-1 having the .11 address and Linux-3 having the .12 address.
- VLAN 20 is given the subnet 192.168.20.0/24 with Linux-2 having the .12 address and Linux-4 having the .12 address.
- Each Linux host uses the .1 address as the default gateway.
I’m using both a vEX and vQFX to show that the configurations for these devices are similar. They are both using the Enhanced Layer 2 Software (ELS) CLI. This is the same as the MX series and the newer SRX series.
Older EX switches and SRX’s use the non-ELS CLI which has some differences.
Configuring VLANs
The first step is the basic configuration on VLANs 10 and 20.
vEX-1
As you can see from the below output, we currently only have the default VLAN 1.
lab@vEX-1> show vlans brief
Routing instance VLAN name Tag Interfaces
default-switch default 1
ge-0/0/0.0*
ge-0/0/1.0*
ge-0/0/2.0*
ge-0/0/3.0*
ge-0/0/4.0*
ge-0/0/5.0*
ge-0/0/6.0*
ge-0/0/7.0*
ge-0/0/8.0*
ge-0/0/9.0*
lab@vEX-1>
We can configure the VLANs as shown below. We can specify the details with separate commands or combine them into one line.
lab@vEX-1> edit
Entering configuration mode
[edit]
lab@vEX-1# set vlans vl-10 vlan-id 10
[edit]
lab@vEX-1# set vlans vl-10 description VLAN-10
[edit]
lab@vEX-1# set vlans vl-20 vlan-id 20 description VLAN-20
[edit]
lab@vEX-1# show vlans
vl-10 {
description VLAN-10;
vlan-id 10;
}
vl-20 {
description VLAN-20;
vlan-id 20;
}
[edit]
lab@vEX-1# commit and-quit
commit complete
Exiting configuration mode
lab@vEX-1>
Next, we can check the VLANs are configured.
lab@vEX-1> show vlans brief
Routing instance VLAN name Tag Interfaces
default-switch default 1
ge-0/0/0.0*
ge-0/0/1.0*
ge-0/0/2.0*
ge-0/0/3.0*
ge-0/0/4.0*
ge-0/0/5.0*
ge-0/0/6.0*
ge-0/0/7.0*
ge-0/0/8.0*
ge-0/0/9.0*
default-switch vl-10 10
default-switch vl-20 20
lab@vEX-1> vQFX-1
The vQFX is configured the same, so I’ll only show the VLANs stanza and the commit.
In this case, the vQFX had VLAN 1 defined as part of the default configuration.
{master:0}[edit]
lab@vQFX-1# show vlans
default {
vlan-id 1;
}
vl-10 {
description VLAN-10;
vlan-id 10;
}
vl-20 {
description VLAN-20;
vlan-id 20;
}
{master:0}[edit]
lab@vQFX-1# commit and-quit
configuration check succeeds
commit complete
Exiting configuration mode
{master:0}
lab@vQFX-1> show vlans brief
Routing instance VLAN name Tag Interfaces
default-switch default 1
default-switch vl-10 10
default-switch vl-20 20
{master:0}
lab@vQFX-1>Configuring Access Ports
vEX-1
Before configuring the ports, let’s look at the ethernet switching output for ports ge-0/0/6 and ge-0/0/7.
lab@vEX-1> show ethernet-switching interface ge-0/0/6
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/6.0 524287 8192 untagged
default 1 65535 1024 Forwarding untagged
lab@vEX-1> show ethernet-switching interface ge-0/0/7
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/7.0 524287 8192 untagged
default 1 65535 1024 Forwarding untagged
lab@vEX-1>There are two ways to add a VLAN to an interface. It can be done under the interface using the VLAN name or number, or under the VLAN configuration.
In the below example, I’ve added VLAN 10 under the ge-0/0/6 interface using the VLAN name and added VLAN 20 to the ge-0/0/7 interface under the VLAN configuration.
Normally it is best to choose one way of adding VLANs to an interface instead of using a mix of both methods. I prefer to add them under the interface configuration.
[edit]
lab@vEX-1# show interfaces ge-0/0/6
unit 0 {
family ethernet-switching;
}
[edit]
lab@vEX-1# set interfaces ge-0/0/6 unit 0 family ethernet-switching interface-mode access
[edit]
lab@vEX-1# set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members vl-10
[edit]
lab@vEX-1# show interfaces ge-0/0/6
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vl-10;
}
}
}
[edit]
lab@vEX-1#
[edit]
lab@vEX-1# show vlans
vl-10 {
description VLAN-10;
vlan-id 10;
}
vl-20 {
description VLAN-20;
vlan-id 20;
}
[edit]
lab@vEX-1# set vlans vl-20 interface ge-0/0/7
[edit]
lab@vEX-1# show vlans
vl-10 {
description VLAN-10;
vlan-id 10;
}
vl-20 {
description VLAN-20;
vlan-id 20;
interface ge-0/0/7.0;
}
[edit]
lab@vEX-1# commit
commit complete
[edit]
lab@vEX-1#
Note: If you are configuring the interface under the VLAN itself, you must not configure the interface mode under the interface.
[edit]
lab@vEX-1# show interfaces ge-0/0/7
unit 0 {
family ethernet-switching;
}
[edit]
lab@vEX-1# show vlans vl-20
description VLAN-20;
vlan-id 20;
interface ge-0/0/7.0;
l3-interface irb.20;
[edit]
lab@vEX-1# set interfaces ge-0/0/7 unit 0 family ethernet-switching interface-mode access
[edit]
lab@vEX-1# show interfaces ge-0/0/7
unit 0 {
family ethernet-switching {
interface-mode access;
}
}
[edit]
lab@vEX-1# commit
[edit vlans vl-20 interface]
'ge-0/0/7.0'
Interface with 'interface-mode' config is not allowed under vlans
error: commit failed: (statements constraint check failed)
[edit]
lab@vEX-1#
Checking the output from the show ethernet-switching interface command, we can see the difference now the VLANs have been added.
lab@vEX-1> show ethernet-switching interface ge-0/0/6
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/6.0 524287 8192 untagged
vl-10 10 65535 1024 Forwarding untagged
lab@vEX-1> show ethernet-switching interface ge-0/0/7
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/7.0 0 0 tagged
vl-20 20 65535 1024 Forwarding tagged
lab@vEX-1>Note that the ge-0/0/7 interface has VLAN 20 as being tagged. I tested this. The Linux-1 host could ping Linux-2 connected to that port. It is unusual that the port shows as tagged and I suspect it is due to configuring the interface under the VLAN.
vQFX-1
On the vQFX, the commands are the same. Again, let’s check the ethernet-switching output first.
{master:0}
lab@vQFX-1> show ethernet-switching interface xe-0/0/5
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
xe-0/0/5.0 8192 8192 untagged
{master:0}
lab@vQFX-1> show ethernet-switching interface xe-0/0/6
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
xe-0/0/6.0 8192 8192 untagged
{master:0}
lab@vQFX-1>
Aside from the interface naming the configuration is the same. In this case, I’ll configure the VLANs under the interfaces and use VLAN numbers instead of names.
{master:0}
lab@vQFX-1> edit
Entering configuration mode
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/5
unit 0 {
family ethernet-switching;
}
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/6
unit 0 {
family ethernet-switching;
}
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/5 unit 0 family ethernet-switching interface-mode access
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/5 unit 0 family ethernet-switching vlan members 10
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/6 unit 0 family ethernet-switching interface-mode access
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/6 unit 0 family ethernet-switching vlan members 20
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/5
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members 10;
}
}
}
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/6
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members 20;
}
}
}
{master:0}[edit]
lab@vQFX-1# commit
configuration check succeeds
commit complete
{master:0}[edit]
lab@vQFX-1#
The output from the show ethernet-switching interface command shows the interfaces now in their respective VLANs.
{master:0}
lab@vQFX-1> show ethernet-switching interface xe-0/0/5
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
xe-0/0/5.0 8192 8192 untagged
vl-10 10 1024 1024 Forwarding untagged
{master:0}
lab@vQFX-1> show ethernet-switching interface xe-0/0/6
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
xe-0/0/6.0 8192 8192 untagged
vl-20 20 1024 1024 Forwarding untagged
{master:0}
lab@vQFX-1>Configuring Trunk Ports
Although we have configured our ports into the correct VLANs we can’t test connectivity between our Linux hosts yet. We now need to configure the trunk ports between the two switches.
vEX-1
On vEX-1 we need to configure interface ge-0/0/0. We’ll start by looking at the show ethernet-switching interface output and the show interface output.
lab@vEX-1> show ethernet-switching interface ge-0/0/0
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/0.0 524287 8192 untagged
default 1 65535 1024 Forwarding untagged
lab@vEX-1> show interfaces ge-0/0/0
Physical interface: ge-0/0/0, Enabled, Physical link is Up
Interface index: 141, SNMP ifIndex: 519
Link-level type: Ethernet, MTU: 1514, LAN-PHY mode, Speed: 1000mbps, BPDU Error: None, Loop Detect PDU Error: None,
Ethernet-Switching Error: None, MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled,
Flow control: Enabled, Auto-negotiation: Enabled, Remote fault: Online, Media type: Fiber
Device flags : Present Running
Interface Specific flags: Internal: 0x101200
Interface flags: SNMP-Traps Internal: 0x4000
Link flags : None
CoS queues : 8 supported, 8 maximum usable queues
Current address: aa:bb:cc:00:10:01, Hardware address: aa:bb:cc:00:10:01
Last flapped : 2024-09-01 04:07:01 UTC (07:30:13 ago)
Input rate : 0 bps (0 pps)
Output rate : 96 bps (0 pps)
Active alarms : None
Active defects : None
PCS statistics Seconds
Bit errors 0
Errored blocks 0
Ethernet FEC statistics Errors
FEC Corrected Errors 0
FEC Uncorrected Errors 0
FEC Corrected Errors Rate 0
FEC Uncorrected Errors Rate 0
Interface transmit statistics: Disabled
Logical interface ge-0/0/0.0 (Index 343) (SNMP ifIndex 539)
Flags: Up SNMP-Traps 0x24024000 Encapsulation: Ethernet-Bridge
Input packets : 114
Output packets: 116
Protocol eth-switch, MTU: 1514
Flags: Is-Primary, 0x4000000
lab@vEX-1>
We configure ge-0/0/0 as a trunk port and add the two VLANs. Since there are no VLANs configured on the interface already, we can list several VLANs at once using square brackets to enclose a list of VLANs.
lab@vEX-1> edit
Entering configuration mode
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching;
}
[edit]
lab@vEX-1# set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk
[edit]
lab@vEX-1# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [ 10 20 ]
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 ];
}
}
}
[edit]
lab@vEX-1# commit
commit complete
[edit]
lab@vEX-1#
We can look at the switching interface and the interface information and see the difference.
lab@vEX-1> show ethernet-switching interface ge-0/0/0
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/0.0 524287 8192 tagged
vl-10 10 65535 1024 Forwarding tagged
vl-20 20 65535 1024 Forwarding tagged
lab@vEX-1> show interfaces ge-0/0/0
Physical interface: ge-0/0/0, Enabled, Physical link is Up
Interface index: 141, SNMP ifIndex: 519
Link-level type: Ethernet, MTU: 1514, LAN-PHY mode, Speed: 1000mbps, BPDU Error: None, Loop Detect PDU Error: None,
Ethernet-Switching Error: None, MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled,
Flow control: Enabled, Auto-negotiation: Enabled, Remote fault: Online, Media type: Fiber
Device flags : Present Running
Interface Specific flags: Internal: 0x101200
Interface flags: SNMP-Traps Internal: 0x4000
Link flags : None
CoS queues : 8 supported, 8 maximum usable queues
Current address: aa:bb:cc:00:10:01, Hardware address: aa:bb:cc:00:10:01
Last flapped : 2024-09-01 04:07:01 UTC (07:35:46 ago)
Input rate : 0 bps (0 pps)
Output rate : 104 bps (0 pps)
Active alarms : None
Active defects : None
PCS statistics Seconds
Bit errors 0
Errored blocks 0
Ethernet FEC statistics Errors
FEC Corrected Errors 0
FEC Uncorrected Errors 0
FEC Corrected Errors Rate 0
FEC Uncorrected Errors Rate 0
Interface transmit statistics: Disabled
Logical interface ge-0/0/0.0 (Index 343) (SNMP ifIndex 539)
Flags: Up SNMP-Traps 0x24024000 Encapsulation: Ethernet-Bridge
Input packets : 126
Output packets: 129
Protocol eth-switch, MTU: 1514
Flags: Trunk-Mode, 0x4000000
lab@vEX-1>vQFX-1
Once again, we check the details for the interface, in this case xe-0/0/8.
{master:0}
lab@vQFX-1> show ethernet-switching interface xe-0/0/8
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
xe-0/0/8.0 8192 8192 untagged
{master:0}
lab@vQFX-1> show interfaces xe-0/0/8
Physical interface: xe-0/0/8, Enabled, Physical link is Up
Interface index: 658, SNMP ifIndex: 533
Link-level type: Ethernet, MTU: 1514, LAN-PHY mode, Speed: 10Gbps, Duplex: Full-Duplex, BPDU Error: None,
Loop Detect PDU Error: None, Ethernet-Switching Error: None, MAC-REWRITE Error: None, Loopback: Disabled,
Source filtering: Disabled, Flow control: Disabled, Media type: Fiber
Device flags : Present Running
Interface flags: SNMP-Traps Internal: 0x4000
Link flags : None
CoS queues : 8 supported, 8 maximum usable queues
Current address: aa:bb:cc:00:20:23, Hardware address: aa:bb:cc:00:20:23
Last flapped : 2024-09-01 04:00:39 UTC (07:44:05 ago)
Input rate : 0 bps (0 pps)
Output rate : 0 bps (0 pps)
Active alarms : None
Active defects : None
PCS statistics Seconds
Bit errors 0
Errored blocks 0
Ethernet FEC statistics Errors
FEC Corrected Errors 0
FEC Uncorrected Errors 0
FEC Corrected Errors Rate 0
FEC Uncorrected Errors Rate 0
Interface transmit statistics: Disabled
Logical interface xe-0/0/8.0 (Index 577) (SNMP ifIndex 542)
Flags: Up SNMP-Traps 0x24024000 Encapsulation: Ethernet-Bridge
Input packets : 1807
Output packets: 121
Protocol eth-switch, MTU: 1514
{master:0}
lab@vQFX-1>This time, instead of configuring both VLANs at once, we will specify them in two commands.
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/8
unit 0 {
family ethernet-switching;
}
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/8 unit 0 family ethernet-switching interface-mode trunk
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/8 unit 0 family ethernet-switching vlan members 10
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/8
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members 10;
}
}
}
{master:0}[edit]
lab@vQFX-1# set interfaces xe-0/0/8 unit 0 family ethernet-switching vlan members 20
{master:0}[edit]
lab@vQFX-1# show interfaces xe-0/0/8
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 ];
}
}
}
{master:0}[edit]
lab@vQFX-1# commit
configuration check succeeds
commit complete
{master:0}[edit]
lab@vQFX-1#
A quick post-check of the details for the interface shows the following
{master:0}
lab@vQFX-1> show ethernet-switching interface xe-0/0/8
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
xe-0/0/8.0 8192 8192 tagged
vl-10 10 1024 1024 Forwarding tagged
vl-20 20 1024 1024 Forwarding tagged
{master:0}
lab@vQFX-1> show interfaces xe-0/0/8
Physical interface: xe-0/0/8, Enabled, Physical link is Up
Interface index: 658, SNMP ifIndex: 533
Link-level type: Ethernet, MTU: 1514, LAN-PHY mode, Speed: 10Gbps, Duplex: Full-Duplex, BPDU Error: None,
Loop Detect PDU Error: None, Ethernet-Switching Error: None, MAC-REWRITE Error: None, Loopback: Disabled,
Source filtering: Disabled, Flow control: Disabled, Media type: Fiber
Device flags : Present Running
Interface flags: SNMP-Traps Internal: 0x4000
Link flags : None
CoS queues : 8 supported, 8 maximum usable queues
Current address: aa:bb:cc:00:20:23, Hardware address: aa:bb:cc:00:20:23
Last flapped : 2024-09-01 04:00:39 UTC (07:49:36 ago)
Input rate : 0 bps (0 pps)
Output rate : 0 bps (0 pps)
Active alarms : None
Active defects : None
PCS statistics Seconds
Bit errors 0
Errored blocks 0
Ethernet FEC statistics Errors
FEC Corrected Errors 0
FEC Uncorrected Errors 0
FEC Corrected Errors Rate 0
FEC Uncorrected Errors Rate 0
Interface transmit statistics: Disabled
Logical interface xe-0/0/8.0 (Index 577) (SNMP ifIndex 542)
Flags: Up SNMP-Traps 0x24024000 Encapsulation: Ethernet-Bridge
Input packets : 1990
Output packets: 134
Protocol eth-switch, MTU: 1514
Flags: Trunk-Mode
{master:0}
lab@vQFX-1> Testing Connectivity
Now we have the VLANs, access ports, and trunk ports configured on the two switches we can test the connectivity between the Linux hosts.
Linux-1:
eve@Linux-1:~$ ping -c2 192.168.10.12
PING 192.168.10.12 (192.168.10.12) 56(84) bytes of data.
64 bytes from 192.168.10.12: icmp_seq=1 ttl=64 time=329 ms
64 bytes from 192.168.10.12: icmp_seq=2 ttl=64 time=122 ms
--- 192.168.10.12 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 121.648/225.329/329.011/103.681 ms
eve@Linux-1:~$ ping -c2 192.168.20.12
PING 192.168.20.12 (192.168.20.12) 56(84) bytes of data.
From 192.168.10.11 icmp_seq=1 Destination Host Unreachable
From 192.168.10.11 icmp_seq=2 Destination Host Unreachable
--- 192.168.20.12 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1014ms
pipe 2
eve@Linux-1:~$As you can see, Linux-1 can ping Linux-3 since we have trunked VLAN 10 between the two switches. Since we have not yet configured the inter-VLAN routing by setting up an IRB interface Linux-1 can’t ping Linux-4, which is on a different subnet.
Configuring An IRB Interface
We will configure vEX-1 to act as the default gateway. The Linux hosts are already configured so we only need to add the .1 address to the switch.
There are two parts to this. The first is to create the IRB interface and unit. The second is to associate that as the layer-3 interface for the VLAN.
vEX-1
[edit]
lab@vEX-1# set interfaces irb unit 10 family inet address 192.168.10.1/24
[edit]
lab@vEX-1# set interfaces irb unit 20 family inet address 192.168.20.1/24
[edit]
lab@vEX-1# set vlans vl-10 l3-interface irb.10
[edit]
lab@vEX-1# set vlans vl-20 l3-interface irb.20
[edit]
lab@vEX-1# show | compare
[edit interfaces]
+ irb {
+ unit 10 {
+ family inet {
+ address 192.168.10.1/24;
+ }
+ }
+ unit 20 {
+ family inet {
+ address 192.168.20.1/24;
+ }
+ }
+ }
[edit vlans vl-10]
+ l3-interface irb.10;
[edit vlans vl-20]
+ l3-interface irb.20;
[edit]
lab@vEX-1# commit and-quit
commit complete
Exiting configuration mode
lab@vEX-1>
Next, we can check the IRB interfaces are up. When dealing with IRB or VLAN interfaces, at least one interface in the VLAN must be in the up state. This can be either an access or a trunk port.
lab@vEX-1> show interfaces irb* terse
Interface Admin Link Proto Local Remote
irb up up
irb.10 up up inet 192.168.10.1/24
multiservice
irb.20 up up inet 192.168.20.1/24
multiservice
lab@vEX-1>Linux-1 can now ping hosts in both VLANs.
eve@Linux-1:~$ ping -c2 192.168.10.12
PING 192.168.10.12 (192.168.10.12) 56(84) bytes of data.
64 bytes from 192.168.10.12: icmp_seq=1 ttl=64 time=135 ms
64 bytes from 192.168.10.12: icmp_seq=2 ttl=64 time=108 ms
--- 192.168.10.12 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 107.683/121.181/134.679/13.498 ms
eve@Linux-1:~$ ping -c2 192.168.20.12
PING 192.168.20.12 (192.168.20.12) 56(84) bytes of data.
64 bytes from 192.168.20.12: icmp_seq=1 ttl=63 time=328 ms
64 bytes from 192.168.20.12: icmp_seq=2 ttl=63 time=115 ms
--- 192.168.20.12 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 115.371/221.553/327.735/106.182 ms
eve@Linux-1:~$vQFX-1
The configuration on the vQFX is exactly the same as the vEX. It has been configured with the .2 address for each subnet as shown below.
{master:0}[edit]
lab@vQFX-1# show | compare
[edit interfaces]
+ irb {
+ unit 10 {
+ family inet {
+ address 192.168.10.2/24;
+ }
+ }
+ unit 20 {
+ family inet {
+ address 192.168.20.2/24;
+ }
+ }
+ }
[edit vlans vl-10]
+ l3-interface irb.10;
[edit vlans vl-20]
+ l3-interface irb.20;
{master:0}[edit]
lab@vQFX-1# commit and-quit
configuration check succeeds
commit complete
Exiting configuration mode
{master:0}
lab@vQFX-1> show interfaces irb* terse
Interface Admin Link Proto Local Remote
irb up up
irb.10 up up inet 192.168.10.2/24
irb.20 up up inet 192.168.20.2/24
{master:0}
lab@vQFX-1> To prove it is reachable we can ping it from Linux-1 as well.
eve@Linux-1:~$ ping -c2 192.168.10.2
PING 192.168.10.2 (192.168.10.2) 56(84) bytes of data.
64 bytes from 192.168.10.2: icmp_seq=1 ttl=64 time=312 ms
64 bytes from 192.168.10.2: icmp_seq=2 ttl=64 time=108 ms
--- 192.168.10.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 107.740/209.966/312.193/102.226 ms
eve@Linux-1:~$ ping -c2 192.168.20.2
PING 192.168.20.2 (192.168.20.2) 56(84) bytes of data.
64 bytes from 192.168.20.2: icmp_seq=1 ttl=64 time=328 ms
64 bytes from 192.168.20.2: icmp_seq=2 ttl=64 time=165 ms
--- 192.168.20.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 164.725/246.186/327.648/81.461 ms
eve@Linux-1:~$Adding And Removing VLANs FromTrunk Ports
Adding or removing VLANs from a trunk port is an easy process. On vEX-1 I have added VLANs 30 and 40.
Adding VLANs:
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 ];
}
}
}
[edit]
lab@vEX-1# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 30
[edit]
lab@vEX-1# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 40
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 30 40 ];
}
}
}
[edit]
lab@vEX-1# Removing VLANs:
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 30 40 ];
}
}
}
[edit]
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 30
[edit]
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 40
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 ];
}
}
}
[edit]
lab@vEX-1# commit
commit complete
[edit]
lab@vEX-1#To add multiple VLANs at once, you can enclose them in square brackets.
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 ];
}
}
}
[edit]
lab@vEX-1# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [30 40]
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 30 40 ];
}
}
}
[edit]
lab@vEX-1#Be aware, that you can’t seem to remove multiple VLANs at once. It does not like the square brackets or trying to enter multiple VLANs.
[edit]
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [
^
name: '[': Must be a valid VLAN name, VLAN tag or VLAN range string at '['
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 10 20
^
syntax error, expecting ';', [Enter], or '|'.
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 10,
^
name: '10,': Must be a valid VLAN name, VLAN tag or VLAN range string at '10,'
lab@vEX-1#You can however use a range, as shown below.
[edit]
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 10-20
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
}
}
[edit]
lab@vEX-1#Adding All VLANs To A Trunk Port
Further to the example above, we can also specify all VLANs are added to a trunk port.
On vEX-1, port ge-0/0/0 is currently carrying VLANs 10 and 20.
lab@vEX-1> show ethernet-switching interface ge-0/0/0
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/0.0 524287 8192 tagged
vl-10 10 65535 1024 Forwarding tagged
vl-20 20 65535 1024 Forwarding tagged
lab@vEX-1>We can reconfigure the interface as follows.
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ 10 20 ];
}
}
}
[edit]
lab@vEX-1# delete interfaces ge-0/0/0 unit 0 family ethernet-switching vlan
[edit]
lab@vEX-1# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members all
[edit]
lab@vEX-1# show interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members all;
}
}
}
[edit]
lab@vEX-1# commit and-quit
commit complete
Exiting configuration mode
lab@vEX-1>We can now see all the configured VLANs on the trunk port.
lab@vEX-1> show ethernet-switching interface ge-0/0/0
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
LH - MAC limit hit, DN - interface down,
MMAS - Mac-move action shutdown, AS - Autostate-exclude enabled,
SCTL - shutdown by Storm-control, SL - Secure Learning,
MI - MAC+IP limit hit)
Logical Vlan TAG MAC MAC+IP STP Logical Tagging
interface members limit limit state interface flags
ge-0/0/0.0 524287 8192 tagged
vl-10 10 65535 1024 Forwarding tagged
vl-20 20 65535 1024 Forwarding tagged
default 1 65535 1024 Forwarding tagged
vl-30 30 65535 1024 Forwarding tagged
vl-40 40 65535 1024 Forwarding tagged
lab@vEX-1> Changing An Access Port’s VLAN
To change an access port from one VLAN to another we have to remove the existing VLAN first, then add the new one. This is shown by changing ge-0/0/6 from VLAN 10 to VLAN 20.
[edit]
lab@vEX-1# show interfaces ge-0/0/6
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vl-10;
}
}
}
[edit]
lab@vEX-1# delete interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members vl-10
[edit]
lab@vEX-1# set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members vl-20
[edit]
lab@vEX-1# show interfaces ge-0/0/6
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vl-20;
}
}
}
[edit]
lab@vEX-1# commit
commit complete
[edit]
lab@vEX-1#If we don’t delete the existing VLAN, setting the new VLAN will add a second VLAN to the interface. This is fine for a trunk port, but for an access port, it will cause an issue when we try to commit the configuration.
[edit]
lab@vEX-1# show interfaces ge-0/0/6
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vl-10;
}
}
}
[edit]
lab@vEX-1# set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members vl-20
[edit]
lab@vEX-1# show interfaces ge-0/0/6
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members [ vl-10 vl-20 ];
}
}
}
[edit]
lab@vEX-1# commit
[edit interfaces ge-0/0/6 unit 0 family ethernet-switching]
'vlan'
Access interface can be part of only one vlan
error: configuration check-out failed
[edit]
lab@vEX-1#Closing Thoughts
Working with VLANs on Junos is pretty straightforward. If you have any questions let me know in the comments below.
VLANs can also be configured on Aggregated Ethernet interfaces.