API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Mar 11th, 2025
635
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 32.98 KB | None | 0 0
raw download clone embed print report
  1. ## Last commit: 2025-03-11 11:48:48 CDT by me
  2. version 23.4R2-S3.9;
  3. system {
  4. host-name MDCCR;
  5. root-authentication {
  6. encrypted-password ""; ## SECRET-DATA
  7. }
  8. login {
  9. retry-options {
  10. tries-before-disconnect 3;
  11. backoff-threshold 2;
  12. lockout-period 5;
  13. }
  14. class read-only-remote {
  15. idle-timeout 10;
  16. login-alarms;
  17. permissions [ view view-configuration ];
  18. }
  19. class service-accounts {
  20. idle-timeout 5;
  21. login-alarms;
  22. permissions [ secret view view-configuration ];
  23. allow-commands "(request system power-off.*|show configuration \| display set \| no-more)";
  24. }
  25. class super-user-local {
  26. login-alarms;
  27. permissions all;
  28. }
  29. class super-user-remote {
  30. idle-timeout 10;
  31. login-alarms;
  32. permissions all;
  33. }
  34. user admin {
  35. full-name Administrator;
  36. uid 2000;
  37. class super-user-local;
  38. authentication {
  39. encrypted-password ""; ## SECRET-DATA
  40. }
  41. }
  42. user remote-admin {
  43. full-name "Remote Admins";
  44. uid 2001;
  45. class super-user-remote;
  46. }
  47. user remote-read-only {
  48. full-name "Remote Read-Only Users";
  49. uid 2002;
  50. class read-only-remote;
  51. }
  52. user service-accounts {
  53. full-name "Service Accounts";
  54. uid 2003;
  55. class service-accounts;
  56. }
  57. message "\n########################################################################\n# THIS SYSTEM IS RESTRICTED TO AUTHORIZED USAGE! #\n# #\n# Unauthorized usage will be subject to criminal penalties, fines, #\n# damages and/or disciplinary action. If you are not authorized to use #\n# this system, you must exit immediately. If you are authorized to #\n# use this system, you must do so in compliance with all laws, #\n# regulations, conduct rules, and company security policies applicable #\n# to this system. This system, including any hardware components, #\n# software, workstations, and storage spaces is subject to monitoring #\n# and search without advanced notice. Users should have no expectation #\n# of privacy in their use of any aspect of this system. #\n########################################################################\n\n";
  58. }
  59. services {
  60. inactive: netconf {
  61. ssh;
  62. rfc-compliant;
  63. yang-compliant;
  64. }
  65. ssh {
  66. root-login deny;
  67. protocol-version v2;
  68. max-sessions-per-connection 2;
  69. sftp-server;
  70. connection-limit 10;
  71. }
  72. telnet {
  73. connection-limit 2;
  74. }
  75. inactive: web-management {
  76. https {
  77. local-certificate MDC-Management;
  78. }
  79. }
  80. }
  81. auto-snapshot;
  82. domain-name mgmt.mdc.com;
  83. domain-search [ mgmt.mdc.com wlc.mdc.com ad.mdc.com mdc.com ];
  84. time-zone America/Chicago;
  85. management-instance;
  86. authentication-order radius;
  87. name-server {
  88. 10.20.11.1;
  89. 10.20.11.2;
  90. }
  91. radius-server {
  92. 10.20.11.1 {
  93. secret ""; ## SECRET-DATA
  94. timeout 2;
  95. }
  96. 10.20.11.2 {
  97. secret ""; ## SECRET-DATA
  98. timeout 2;
  99. }
  100. }
  101. accounting {
  102. events [ login change-log interactive-commands ];
  103. destination {
  104. radius {
  105. server {
  106. 10.20.11.1 secret ""; ## SECRET-DATA
  107. }
  108. }
  109. }
  110. }
  111. syslog {
  112. archive {
  113. size 100k;
  114. files 3;
  115. }
  116. user * {
  117. any emergency;
  118. }
  119. host 10.20.10.9 {
  120. any info;
  121. match "!(identification string from 10.20.10.1|identification string from 10.20.10.2|exited, status 255|tvp_drv_syspld_read|MAIL)";
  122. }
  123. host 10.20.10.4 {
  124. firewall any;
  125. }
  126. file alert {
  127. any alert;
  128. }
  129. inactive: file auth-log {
  130. authorization any;
  131. change-log any;
  132. match "!(identification string from 10.20.10.1|identification string from 10.20.10.2)";
  133. }
  134. file commands {
  135. any info;
  136. match UI_CMDLINE_READ_LINE;
  137. archive {
  138. size 1m;
  139. files 1;
  140. }
  141. }
  142. file critical {
  143. any critical;
  144. }
  145. file default-log-message {
  146. any any;
  147. match "!(identification string from 10.20.10.1|identification string from 10.20.10.2)";
  148. }
  149. file emergency {
  150. any emergency;
  151. }
  152. file error {
  153. any error;
  154. }
  155. inactive: file filter {
  156. any any;
  157. match PFE_FW_SYSLOG_IP;
  158. archive {
  159. size 1m;
  160. files 1;
  161. }
  162. }
  163. file info {
  164. any info;
  165. match "!(max power 30000 poe mode 2|identification string from 10.20.10.1|identification string from 10.20.10.2|exited, status 255|MAIL)";
  166. }
  167. file interactive-commands {
  168. interactive-commands any;
  169. archive {
  170. size 2m;
  171. files 5;
  172. }
  173. }
  174. file login {
  175. any info;
  176. match "(UI_AUTH_EVENT|UI_LOGIN_EVENT|SSHD_LOGIN_FAILED|UI_DBASE_LOGIN_EVENT)";
  177. archive {
  178. size 1m;
  179. files 1;
  180. }
  181. }
  182. file messages {
  183. any critical;
  184. authorization any;
  185. match "!(identification string from 10.20.10.1|identification string from 10.20.10.2)";
  186. archive {
  187. size 2m;
  188. files 5;
  189. }
  190. explicit-priority;
  191. }
  192. file notice {
  193. any notice;
  194. match "!exited, status 255";
  195. }
  196. file snapshot {
  197. archive {
  198. size 2m;
  199. files 1;
  200. }
  201. }
  202. file syslog-event-daemon-info {
  203. daemon info;
  204. match "!exited, status 255";
  205. }
  206. time-format year millisecond;
  207. }
  208. processes {
  209. dhcp-service {
  210. inactive: traceoptions {
  211. file dhcp_logfile size 10m;
  212. level all;
  213. flag packet;
  214. }
  215. }
  216. }
  217. ntp {
  218. server 132.163.96.1;
  219. server 132.163.96.2;
  220. }
  221. inactive: phone-home {
  222. server https://redirect.juniper.net;
  223. rfc-compliant;
  224. }
  225. }
  226. chassis {
  227. config-button no-clear;
  228. redundancy {
  229. graceful-switchover;
  230. }
  231. aggregated-devices {
  232. ethernet {
  233. device-count 4;
  234. }
  235. }
  236. alarm {
  237. management-ethernet {
  238. link-down ignore;
  239. }
  240. }
  241. inactive: auto-image-upgrade;
  242. }
  243. security {
  244. certificates {
  245. local {
  246. MDC-Management {
  247. ""; ## SECRET-DATA
  248. }
  249. }
  250. }
  251. }
  252. interfaces {
  253. ge-0/0/0 {
  254. description 013-3416;
  255. unit 0 {
  256. family ethernet-switching {
  257. interface-mode access;
  258. vlan {
  259. members VLAN3416;
  260. }
  261. storm-control default;
  262. }
  263. }
  264. }
  265. ge-0/0/1 {
  266. description 113-160;
  267. unit 0 {
  268. family ethernet-switching {
  269. interface-mode access;
  270. vlan {
  271. members VLAN160;
  272. }
  273. storm-control default;
  274. }
  275. }
  276. }
  277. ge-0/0/2 {
  278. description "014-MDCBR-0-0 INT-Infra-User";
  279. unit 0 {
  280. family ethernet-switching {
  281. interface-mode trunk;
  282. vlan {
  283. members [ VLAN1001 VLAN1682 VLAN1684 ];
  284. }
  285. storm-control default;
  286. }
  287. }
  288. }
  289. ge-0/0/3 {
  290. description "114-MDCBR-0-1 EXT-User";
  291. unit 0 {
  292. family ethernet-switching {
  293. interface-mode trunk;
  294. vlan {
  295. members [ VLAN1681 VLAN1683 ];
  296. }
  297. storm-control default;
  298. }
  299. }
  300. }
  301. ge-0/0/4 {
  302. description "015-MDCBR-1-0 INT-Infra-User";
  303. unit 0 {
  304. family ethernet-switching {
  305. interface-mode trunk;
  306. vlan {
  307. members [ VLAN1001 VLAN1682 VLAN1684 ];
  308. }
  309. storm-control default;
  310. }
  311. }
  312. }
  313. ge-0/0/5 {
  314. description "115-MDCBR-1-1 EXT-User";
  315. native-vlan-id 998;
  316. unit 0 {
  317. family ethernet-switching {
  318. interface-mode trunk;
  319. vlan {
  320. members [ VLAN1681 VLAN1683 ];
  321. }
  322. storm-control default;
  323. }
  324. }
  325. }
  326. ge-0/0/6 {
  327. description 016-MDCAP01;
  328. unit 0 {
  329. family ethernet-switching {
  330. interface-mode access;
  331. vlan {
  332. members VLAN1020;
  333. }
  334. storm-control default;
  335. }
  336. }
  337. }
  338. ge-0/0/7 {
  339. description 116-MDCMONAP;
  340. unit 0 {
  341. family ethernet-switching {
  342. interface-mode access;
  343. vlan {
  344. members VLAN1020;
  345. }
  346. storm-control default;
  347. }
  348. }
  349. }
  350. ge-0/0/8 {
  351. description 017-LabBR-AE3-8;
  352. ether-options {
  353. 802.3ad ae3;
  354. }
  355. }
  356. ge-0/0/9 {
  357. description 117-LabBR-AE3-9;
  358. ether-options {
  359. 802.3ad ae3;
  360. }
  361. }
  362. ge-0/0/10 {
  363. description 018-WLC1-AE2-10;
  364. ether-options {
  365. 802.3ad ae2;
  366. }
  367. }
  368. ge-0/0/11 {
  369. description 118-WLC1-AE2-11;
  370. ether-options {
  371. 802.3ad ae2;
  372. }
  373. }
  374. ge-0/0/12 {
  375. description 019-WLC1-AE2-12;
  376. ether-options {
  377. 802.3ad ae2;
  378. }
  379. }
  380. ge-0/0/13 {
  381. description 119-WLC1-AE2-13;
  382. ether-options {
  383. 802.3ad ae2;
  384. }
  385. }
  386. ge-0/0/14 {
  387. description 020-WLC1-AE2-14;
  388. ether-options {
  389. 802.3ad ae2;
  390. }
  391. }
  392. ge-0/0/15 {
  393. description 120-MDCR1UPS;
  394. unit 0 {
  395. family ethernet-switching {
  396. interface-mode access;
  397. vlan {
  398. members VLAN1015;
  399. }
  400. storm-control default;
  401. }
  402. }
  403. }
  404. ge-0/0/16 {
  405. description 021-MDCMS8101;
  406. native-vlan-id 2011;
  407. unit 0 {
  408. family ethernet-switching {
  409. interface-mode trunk;
  410. vlan {
  411. members [ VLAN2010 VLAN2011 VLAN2538 ];
  412. }
  413. storm-control default;
  414. }
  415. }
  416. }
  417. ge-0/0/17 {
  418. description 121-MDCMS8100;
  419. native-vlan-id 2011;
  420. unit 0 {
  421. family ethernet-switching {
  422. interface-mode trunk;
  423. vlan {
  424. members [ VLAN1010 VLAN1200 VLAN2010 VLAN2011 VLAN2538 ];
  425. }
  426. storm-control default;
  427. }
  428. }
  429. }
  430. ge-0/0/18 {
  431. description "022-MDCBR-0-2 IO-Trunk";
  432. native-vlan-id 998;
  433. unit 0 {
  434. family ethernet-switching {
  435. interface-mode trunk;
  436. vlan {
  437. members [ VLAN201 VLAN998 ];
  438. }
  439. storm-control default;
  440. }
  441. }
  442. }
  443. ge-0/0/19 {
  444. description "122-MDCBR-1-2 IO-Trunk";
  445. native-vlan-id 998;
  446. unit 0 {
  447. family ethernet-switching {
  448. interface-mode trunk;
  449. vlan {
  450. members [ VLAN201 VLAN998 ];
  451. }
  452. storm-control default;
  453. }
  454. }
  455. }
  456. ge-0/0/20 {
  457. description 023-WLC1-MGT;
  458. unit 0 {
  459. family ethernet-switching {
  460. interface-mode access;
  461. vlan {
  462. members VLAN1010;
  463. }
  464. storm-control default;
  465. }
  466. }
  467. }
  468. ge-0/0/21 {
  469. description 123-MDCINT0-MGT;
  470. unit 0 {
  471. family ethernet-switching {
  472. interface-mode access;
  473. vlan {
  474. members VLAN1010;
  475. }
  476. storm-control default;
  477. }
  478. }
  479. }
  480. ge-0/0/22 {
  481. description 024-MDCBR2-MGT;
  482. unit 0 {
  483. family ethernet-switching {
  484. interface-mode access;
  485. vlan {
  486. members VLAN1010;
  487. }
  488. storm-control default;
  489. }
  490. }
  491. }
  492. ge-0/0/23 {
  493. description 124-MDCBR1-MGT;
  494. unit 0 {
  495. family ethernet-switching {
  496. interface-mode access;
  497. vlan {
  498. members VLAN1010;
  499. }
  500. storm-control default;
  501. }
  502. }
  503. }
  504. ge-0/2/0 {
  505. disable;
  506. }
  507. xe-0/2/0 {
  508. description MDCBR1-AE0-0;
  509. ether-options {
  510. 802.3ad ae0;
  511. }
  512. }
  513. ge-0/2/1 {
  514. disable;
  515. }
  516. xe-0/2/1 {
  517. description MDCBR1-AE0-1;
  518. ether-options {
  519. 802.3ad ae0;
  520. }
  521. }
  522. ge-0/2/2 {
  523. disable;
  524. }
  525. xe-0/2/2 {
  526. description MDCBR1-IO-Trunk;
  527. native-vlan-id 998;
  528. unit 0 {
  529. family ethernet-switching {
  530. interface-mode trunk;
  531. vlan {
  532. members [ VLAN201 VLAN998 ];
  533. }
  534. storm-control default;
  535. }
  536. }
  537. }
  538. ge-0/2/3 {
  539. disable;
  540. }
  541. xe-0/2/3 {
  542. description Internet-Lumen;
  543. native-vlan-id 998;
  544. unit 0 {
  545. family ethernet-switching {
  546. interface-mode trunk;
  547. vlan {
  548. members [ VLAN201 VLAN998 ];
  549. }
  550. storm-control default;
  551. }
  552. }
  553. }
  554. ae0 {
  555. description MDCBR1-Uplink;
  556. native-vlan-id 999;
  557. aggregated-ether-options {
  558. lacp {
  559. passive;
  560. periodic fast;
  561. }
  562. }
  563. unit 0 {
  564. family ethernet-switching {
  565. interface-mode trunk;
  566. vlan {
  567. members [ VLAN160 VLAN161 VLAN999 VLAN1000 VLAN1001 VLAN1010 VLAN1015 VLAN1016 VLAN1020 VLAN1200 VLAN2010 VLAN2011 VLAN2020 VLAN2021 VLAN2022 VLAN2023 VLAN2116 VLAN2117 VLAN2316 VLAN2328 VLAN2329 VLAN2531 VLAN2538 VLAN3400 VLAN3410 VLAN3416 VLAN3424 VLAN3700 VLAN3710 VLAN3716 VLAN3724 VLAN3732 ];
  568. }
  569. storm-control default;
  570. }
  571. }
  572. }
  573. inactive: ae1 {
  574. description MDCBR2-Uplink;
  575. native-vlan-id 999;
  576. aggregated-ether-options {
  577. lacp {
  578. passive;
  579. periodic fast;
  580. }
  581. }
  582. unit 0 {
  583. family ethernet-switching {
  584. interface-mode trunk;
  585. vlan {
  586. members [ VLAN160 VLAN161 VLAN999 VLAN1000 VLAN1001 VLAN1010 VLAN1015 VLAN1016 VLAN1020 VLAN1200 VLAN2010 VLAN2011 VLAN2020 VLAN2021 VLAN2022 VLAN2023 VLAN2116 VLAN2117 VLAN2316 VLAN2328 VLAN2329 VLAN2531 VLAN2538 VLAN3400 VLAN3410 VLAN3416 VLAN3424 VLAN3700 VLAN3710 VLAN3716 VLAN3724 VLAN3732 ];
  587. }
  588. storm-control default;
  589. }
  590. }
  591. }
  592. ae2 {
  593. description WLC1-Uplink;
  594. native-vlan-id 999;
  595. unit 0 {
  596. family ethernet-switching {
  597. interface-mode trunk;
  598. vlan {
  599. members [ VLAN161 VLAN999 VLAN1020 VLAN2021 VLAN2023 VLAN2117 VLAN2329 VLAN3700 VLAN3710 VLAN3716 VLAN3724 VLAN3732 VLAN1681 VLAN1682 ];
  600. }
  601. storm-control default;
  602. }
  603. }
  604. }
  605. ae3 {
  606. description LabBR-Uplink;
  607. native-vlan-id 999;
  608. aggregated-ether-options {
  609. lacp {
  610. passive;
  611. periodic fast;
  612. }
  613. }
  614. unit 0 {
  615. family ethernet-switching {
  616. interface-mode trunk;
  617. vlan {
  618. members [ VLAN999 VLAN1000 ];
  619. }
  620. storm-control default;
  621. }
  622. }
  623. }
  624. irb {
  625. inactive: unit 0 {
  626. family inet {
  627. dhcp {
  628. vendor-id Juniper-ex3400-24p-;
  629. }
  630. }
  631. family inet6 {
  632. dhcpv6-client {
  633. client-type stateful;
  634. client-ia-type ia-na;
  635. client-identifier duid-type duid-ll;
  636. vendor-id Juniper:ex3400-24p:;
  637. }
  638. }
  639. }
  640. unit 1016 {
  641. description Infra-Network-Core;
  642. family inet {
  643. address 10.10.16.253/24;
  644. }
  645. }
  646. }
  647. lo0 {
  648. unit 0 {
  649. family inet {
  650. filter {
  651. input Protect-RE;
  652. }
  653. address 127.0.0.1/32;
  654. }
  655. }
  656. }
  657. vme {
  658. unit 0 {
  659. family inet {
  660. inactive: dhcp {
  661. vendor-id Juniper-ex3400-24p-;
  662. }
  663. address 10.10.10.252/24;
  664. }
  665. family inet6 {
  666. inactive: dhcpv6-client {
  667. client-type stateful;
  668. client-ia-type ia-na;
  669. client-identifier duid-type duid-ll;
  670. vendor-id Juniper:ex3400-24p:;
  671. }
  672. }
  673. }
  674. }
  675. }
  676. snmp {
  677. description "MDC Core Router";
  678. location "";
  679. contact "";
  680. filter-duplicates;
  681. community "" {
  682. authorization read-only;
  683. clients {
  684. 10.20.10.0/30;
  685. }
  686. }
  687. community "" {
  688. authorization read-write;
  689. clients {
  690. 10.20.10.0/30;
  691. }
  692. }
  693. trap-group PRTG {
  694. version v2;
  695. categories {
  696. authentication;
  697. chassis;
  698. link;
  699. remote-operations;
  700. routing;
  701. startup;
  702. rmon-alarm;
  703. vrrp-events;
  704. configuration;
  705. }
  706. targets {
  707. 10.20.10.1;
  708. 10.20.10.2;
  709. }
  710. }
  711. health-monitor {
  712. interval 30;
  713. rising-threshold 80;
  714. falling-threshold 20;
  715. }
  716. }
  717. forwarding-options {
  718. storm-control-profiles default {
  719. all;
  720. }
  721. }
  722. class-of-service {
  723. classifiers {
  724. dscp CLASSIFIER-DSCP {
  725. forwarding-class FC-AF {
  726. loss-priority low code-points 100010;
  727. }
  728. forwarding-class FC-BE {
  729. loss-priority low code-points [ 000000 000001 000010 000011 000100 000101 000110 000111 001000 001001 001010 001011 001100 001101 001110 001111 010000 010001 010010 010011 010100 010101 010110 010111 011000 011001 011010 011011 011100 011101 011110 011111 100000 100001 100011 100100 100101 100110 100111 101000 101001 101010 101011 101100 101101 101111 110001 110010 110011 110100 110101 110110 110111 111000 111001 111010 111011 111100 111101 111110 111111 ];
  730. }
  731. forwarding-class FC-EF {
  732. loss-priority low code-points 101110;
  733. }
  734. forwarding-class FC-NC {
  735. loss-priority low code-points 110000;
  736. }
  737. }
  738. }
  739. forwarding-classes {
  740. class FC-AF queue-num 1;
  741. class FC-BE queue-num 0;
  742. class FC-EF queue-num 3;
  743. class FC-NC queue-num 2;
  744. }
  745. interfaces {
  746. ge-* {
  747. scheduler-map SCHEDMAP-ALL;
  748. unit 0 {
  749. classifiers {
  750. dscp CLASSIFIER-DSCP;
  751. }
  752. rewrite-rules {
  753. dscp RWR-ALL;
  754. }
  755. }
  756. }
  757. xe-* {
  758. scheduler-map SCHEDMAP-ALL;
  759. unit 0 {
  760. classifiers {
  761. dscp CLASSIFIER-DSCP;
  762. }
  763. rewrite-rules {
  764. dscp RWR-ALL;
  765. }
  766. }
  767. }
  768. ae* {
  769. scheduler-map SCHEDMAP-ALL;
  770. unit 0 {
  771. classifiers {
  772. dscp CLASSIFIER-DSCP;
  773. }
  774. rewrite-rules {
  775. dscp RWR-ALL;
  776. }
  777. }
  778. }
  779. }
  780. rewrite-rules {
  781. dscp RWR-ALL {
  782. forwarding-class FC-AF {
  783. loss-priority low code-point 100010;
  784. }
  785. forwarding-class FC-BE {
  786. loss-priority low code-point 000000;
  787. }
  788. forwarding-class FC-EF {
  789. loss-priority low code-point 101110;
  790. }
  791. forwarding-class FC-NC {
  792. loss-priority low code-point 110000;
  793. }
  794. }
  795. }
  796. scheduler-maps {
  797. SCHEDMAP-ALL {
  798. forwarding-class FC-AF scheduler SCHED-AF;
  799. forwarding-class FC-BE scheduler SCHED-BE;
  800. forwarding-class FC-EF scheduler SCHED-EF;
  801. forwarding-class FC-NC scheduler SCHED-NC;
  802. }
  803. }
  804. schedulers {
  805. SCHED-AF {
  806. transmit-rate percent 30;
  807. buffer-size percent 30;
  808. priority low;
  809. }
  810. SCHED-BE {
  811. transmit-rate {
  812. remainder;
  813. }
  814. buffer-size {
  815. remainder;
  816. }
  817. priority low;
  818. }
  819. SCHED-EF {
  820. shaping-rate percent 10;
  821. buffer-size percent 10;
  822. priority strict-high;
  823. }
  824. SCHED-NC {
  825. transmit-rate percent 5;
  826. buffer-size percent 5;
  827. priority low;
  828. }
  829. }
  830. }
  831. firewall {
  832. family inet {
  833. filter Protect-RE {
  834. term Permit-Loopback-All {
  835. from {
  836. source-address {
  837. 127.0.0.1/32;
  838. }
  839. }
  840. then accept;
  841. }
  842. term Permit-SSH {
  843. from {
  844. source-address {
  845. 10.10.10.0/24;
  846. 10.10.16.0/24;
  847. 10.20.10.0/24;
  848. 10.20.11.0/30;
  849. 10.34.16.0/23;
  850. 10.37.16.0/23;
  851. }
  852. protocol tcp;
  853. destination-port 22;
  854. }
  855. then accept;
  856. }
  857. term Permit-Telnet {
  858. from {
  859. source-address {
  860. 10.20.10.3/32;
  861. }
  862. protocol tcp;
  863. destination-port 23;
  864. }
  865. then {
  866. count TELNET-COUNTER;
  867. log;
  868. syslog;
  869. accept;
  870. }
  871. }
  872. term Permit-HTTPS {
  873. from {
  874. source-address {
  875. 10.20.10.0/24;
  876. 10.20.11.0/30;
  877. 10.34.16.0/23;
  878. 10.37.16.0/23;
  879. }
  880. protocol tcp;
  881. destination-port 443;
  882. }
  883. then accept;
  884. }
  885. term Permit-RADIUS {
  886. from {
  887. source-address {
  888. 10.20.11.0/30;
  889. }
  890. protocol udp;
  891. source-port [ 1812 1813 ];
  892. }
  893. then accept;
  894. }
  895. term Permit-SNMP {
  896. from {
  897. source-address {
  898. 10.20.10.0/30;
  899. }
  900. protocol udp;
  901. destination-port [ 161 162 ];
  902. }
  903. then accept;
  904. }
  905. term Permit-NTP {
  906. from {
  907. source-address {
  908. 10.20.11.0/30;
  909. 132.163.96.0/30;
  910. }
  911. protocol udp;
  912. destination-port 123;
  913. }
  914. then accept;
  915. }
  916. term Permit-DNS {
  917. from {
  918. source-address {
  919. 10.20.11.0/30;
  920. }
  921. protocol udp;
  922. source-port 53;
  923. }
  924. then accept;
  925. }
  926. term Permit-ICMP-Ping {
  927. from {
  928. source-address {
  929. 10.10.10.0/24;
  930. 10.10.16.0/24;
  931. 10.20.10.0/24;
  932. 10.20.11.0/30;
  933. 10.34.16.0/23;
  934. 10.37.16.0/23;
  935. }
  936. protocol icmp;
  937. icmp-type [ echo-reply echo-request ];
  938. }
  939. then accept;
  940. }
  941. term Permit-Syslog {
  942. from {
  943. source-address {
  944. 10.20.10.4/32;
  945. 10.20.10.9/32;
  946. }
  947. protocol udp;
  948. destination-port 514;
  949. }
  950. then accept;
  951. }
  952. term Silent-Deny-LNCB {
  953. from {
  954. destination-address {
  955. 224.0.0.0/24;
  956. }
  957. }
  958. then {
  959. discard;
  960. }
  961. }
  962. term Default-Deny {
  963. then {
  964. count DEFAULT-DENY-COUNTER;
  965. log;
  966. syslog;
  967. discard;
  968. }
  969. }
  970. }
  971. }
  972. }
  973. routing-instances {
  974. mgmt_junos {
  975. routing-options {
  976. static {
  977. route 0.0.0.0/0 next-hop 10.10.10.254;
  978. }
  979. }
  980. description MGT-VRF;
  981. }
  982. }
  983. routing-options {
  984. static {
  985. route 0.0.0.0/0 next-hop 10.10.16.254;
  986. }
  987. }
  988. protocols {
  989. inactive: router-advertisement {
  990. interface vme.0 {
  991. managed-configuration;
  992. }
  993. interface irb.0 {
  994. managed-configuration;
  995. }
  996. }
  997. lldp {
  998. interface all;
  999. interface xe-0/2/3 {
  1000. disable;
  1001. }
  1002. }
  1003. lldp-med {
  1004. interface all;
  1005. interface xe-0/2/3 {
  1006. disable;
  1007. }
  1008. }
  1009. inactive: igmp-snooping {
  1010. vlan all;
  1011. }
  1012. rstp {
  1013. bridge-priority 4k;
  1014. interface ge-0/0/0 {
  1015. edge;
  1016. }
  1017. interface ge-0/0/1 {
  1018. edge;
  1019. }
  1020. interface ge-0/0/2;
  1021. interface ge-0/0/3;
  1022. interface ge-0/0/4;
  1023. interface ge-0/0/5;
  1024. interface ge-0/0/6 {
  1025. edge;
  1026. }
  1027. interface ge-0/0/7 {
  1028. edge;
  1029. }
  1030. interface ge-0/0/15 {
  1031. edge;
  1032. }
  1033. interface ge-0/0/18;
  1034. interface ge-0/0/19;
  1035. interface ge-0/0/20 {
  1036. edge;
  1037. }
  1038. interface ge-0/0/21 {
  1039. edge;
  1040. }
  1041. interface ge-0/0/22 {
  1042. edge;
  1043. }
  1044. interface ge-0/0/23 {
  1045. edge;
  1046. }
  1047. interface all;
  1048. bpdu-block-on-edge;
  1049. }
  1050. vstp {
  1051. interface all;
  1052. }
  1053. }
  1054. switch-options {
  1055. voip {
  1056. interface access-ports {
  1057. vlan VLAN2316;
  1058. }
  1059. }
  1060. }
  1061. poe {
  1062. interface all;
  1063. interface ge-0/0/8 {
  1064. disable;
  1065. }
  1066. interface ge-0/0/9 {
  1067. disable;
  1068. }
  1069. interface ge-0/0/10 {
  1070. disable;
  1071. }
  1072. interface ge-0/0/11 {
  1073. disable;
  1074. }
  1075. interface ge-0/0/12 {
  1076. disable;
  1077. }
  1078. interface ge-0/0/13 {
  1079. disable;
  1080. }
  1081. interface ge-0/0/14 {
  1082. disable;
  1083. }
  1084. interface ge-0/0/15 {
  1085. disable;
  1086. }
  1087. interface ge-0/0/16 {
  1088. disable;
  1089. }
  1090. interface ge-0/0/17 {
  1091. disable;
  1092. }
  1093. interface ge-0/0/18 {
  1094. disable;
  1095. }
  1096. interface ge-0/0/19 {
  1097. disable;
  1098. }
  1099. interface ge-0/0/20 {
  1100. disable;
  1101. }
  1102. interface ge-0/0/21 {
  1103. disable;
  1104. }
  1105. interface ge-0/0/22 {
  1106. disable;
  1107. }
  1108. interface ge-0/0/23 {
  1109. disable;
  1110. }
  1111. interface ge-0/0/6 {
  1112. priority high;
  1113. }
  1114. interface ge-0/0/3 {
  1115. disable;
  1116. }
  1117. interface ge-0/0/4 {
  1118. disable;
  1119. }
  1120. interface ge-0/0/5 {
  1121. disable;
  1122. }
  1123. interface ge-0/0/2 {
  1124. disable;
  1125. }
  1126. }
  1127. vlans {
  1128. VLAN1000 {
  1129. description WAN-Lab;
  1130. vlan-id 1000;
  1131. }
  1132. VLAN1001 {
  1133. description WAN-Production;
  1134. vlan-id 1001;
  1135. }
  1136. VLAN1010 {
  1137. description Infra-Network-OOBM;
  1138. vlan-id 1010;
  1139. }
  1140. VLAN1015 {
  1141. description Infra-Network-Power;
  1142. vlan-id 1015;
  1143. }
  1144. VLAN1016 {
  1145. description Infra-Network-Core;
  1146. vlan-id 1016;
  1147. l3-interface irb.1016;
  1148. }
  1149. VLAN1020 {
  1150. description Infra-Network-Wireless;
  1151. vlan-id 1020;
  1152. }
  1153. VLAN1200 {
  1154. description Infra-Server-OOBM;
  1155. vlan-id 1200;
  1156. }
  1157. VLAN160 {
  1158. description MDC-EXT;
  1159. vlan-id 160;
  1160. }
  1161. VLAN161 {
  1162. description MDC-EXT-WLAN;
  1163. vlan-id 161;
  1164. }
  1165. VLAN1681 {
  1166. description MDC-EXT-TEST-WLAN;
  1167. vlan-id 1681;
  1168. }
  1169. VLAN1682 {
  1170. description MDC-INT-TEST-WLAN;
  1171. vlan-id 1682;
  1172. }
  1173. VLAN1683 {
  1174. description MDC-EXT-TEST;
  1175. vlan-id 1683;
  1176. }
  1177. VLAN1684 {
  1178. description MDC-INT-TEST;
  1179. vlan-id 1684;
  1180. }
  1181. VLAN201 {
  1182. description Internet-Lumen;
  1183. vlan-id 201;
  1184. }
  1185. VLAN2010 {
  1186. description Infra-Server-VMs;
  1187. vlan-id 2010;
  1188. }
  1189. VLAN2011 {
  1190. description Infra-Server-Core;
  1191. vlan-id 2011;
  1192. }
  1193. VLAN2020 {
  1194. description INT-IoT-Security;
  1195. vlan-id 2020;
  1196. }
  1197. VLAN2021 {
  1198. description INT-IoT-Security-WLAN;
  1199. vlan-id 2021;
  1200. }
  1201. VLAN2022 {
  1202. description INT-IoT-Facilities;
  1203. vlan-id 2022;
  1204. }
  1205. VLAN2023 {
  1206. description INT-IoT-Facilities-WLAN;
  1207. vlan-id 2023;
  1208. }
  1209. VLAN2116 {
  1210. description INT-IoT-Printers;
  1211. vlan-id 2116;
  1212. }
  1213. VLAN2117 {
  1214. description INT-IoT-Printers;
  1215. vlan-id 2117;
  1216. }
  1217. VLAN2316 {
  1218. description INT-IoT-Telecom;
  1219. vlan-id 2316;
  1220. }
  1221. VLAN2328 {
  1222. description EXT-IoT;
  1223. vlan-id 2328;
  1224. }
  1225. VLAN2329 {
  1226. description EXT-IoT-WLAN;
  1227. vlan-id 2329;
  1228. }
  1229. VLAN2531 {
  1230. description DMZ-Network;
  1231. vlan-id 2531;
  1232. }
  1233. VLAN2538 {
  1234. description DMZ-Server;
  1235. vlan-id 2538;
  1236. }
  1237. VLAN3400 {
  1238. description EXT-User-Untrust;
  1239. vlan-id 3400;
  1240. }
  1241. VLAN3410 {
  1242. description INT-User-Trust;
  1243. vlan-id 3410;
  1244. }
  1245. VLAN3416 {
  1246. description INT-User-IT-Admins;
  1247. vlan-id 3416;
  1248. }
  1249. VLAN3424 {
  1250. description INT-User-IT-Staff;
  1251. vlan-id 3424;
  1252. }
  1253. VLAN3700 {
  1254. description EXT-User-Untrust-WLAN;
  1255. vlan-id 3700;
  1256. }
  1257. VLAN3710 {
  1258. description INT-User-Trust-WLAN;
  1259. vlan-id 3710;
  1260. }
  1261. VLAN3716 {
  1262. description INT-User-IT-Admins-WLAN;
  1263. vlan-id 3716;
  1264. }
  1265. VLAN3724 {
  1266. description INT-User-IT-Staff-WLAN;
  1267. vlan-id 3724;
  1268. }
  1269. VLAN3732 {
  1270. description EXT-User-Untrust-RLAN;
  1271. vlan-id 3732;
  1272. }
  1273. VLAN998 {
  1274. description DMZ-Network-WAN;
  1275. vlan-id 998;
  1276. }
  1277. VLAN999 {
  1278. description Native;
  1279. vlan-id 999;
  1280. }
  1281. inactive: default {
  1282. vlan-id 1;
  1283. l3-interface irb.0;
  1284. }
  1285. }
  1286.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!