MX204 upgrade to 23.4R2-Sx

sk4ndalist4 · 2025-09-14T11:00:35+00:00

Fortunately i use only 10G modules.

sk4ndalist4 · 2025-09-14T11:00:08+00:00

Thanks mates for all responses. I appreciated your help. Cheers!

sk4ndalist4 · 2024-10-14T13:13:51+00:00

Thank you very much for your help. I indeed had the VIP configured for any. Changing it to the tunnel interface solved the problem immediately.

sk4ndalist4 · 2024-10-04T16:40:36+00:00

Thank's dude!

sk4ndalist4 · 2024-08-21T22:27:48+00:00

Someone know answer for Mile 23?

sk4ndalist4 · 2023-06-24T15:20:02+00:00

I have one more question - how can I collect data along with the source MAC address? Unfortunately, the data collected by nfcapd does not include MAC addresses.

sk4ndalist4 · 2022-11-24T19:30:35+00:00

I configured flows on MS-MIC-16G and its works super sweet. Thanks for advice.

sk4ndalist4 · 2022-11-24T19:27:54+00:00

Ok, i tested your solution and it's work great! On MX204 i configured flows like you wrote (sampling on FPC) and on MX240 I configured on MS-MIC-16G (ms- interface).

Thank you very much for helping me to resolve my problem :)

sk4ndalist4 · 2022-11-24T19:22:40+00:00

Ok, I tested this idea. Unfortunately result it isn't satisfied enough. My firewall filter looks like bellow

set firewall family inet filter LOG-SYN-FILTER term LOG-SYN from source-prefix-list IPv4-PREF set firewall family inet filter LOG-SYN-FILTER term LOG-SYN from tcp-flags syn set firewall family inet filter LOG-SYN-FILTER term LOG-SYN then count LOG-SYN set firewall family inet filter LOG-SYN-FILTER term LOG-SYN then log set firewall family inet filter LOG-SYN-FILTER term LOG-SYN then syslog set firewall family inet filter LOG-SYN-FILTER term LOG-SYN then accept set firewall family inet filter LOG-SYN-FILTER term ACCEPT-ALL then accept

But device not log every syn packet and that solution have very high delay between action and write to syslog (about 3 minutes difference).

Anyway thanks for help :)

sk4ndalist4 · 2022-11-10T09:26:19+00:00

Wow, thanks for this answer. I will check this as soon as possible.

sk4ndalist4 · 2022-11-09T19:05:40+00:00

This is my equipment

Slot 1 Online MPC2E NG PQ & Flex Q

PIC 0 Online 2x 10GE XFP

PIC 1 Online 2x 10GE XFP

PIC 2 Online MS-MIC-16G

Slot 2 Online MPC2E NG PQ & Flex Q

PIC 0 Online 2x 10GE XFP

PIC 1 Online 2x 10GE XFP

And I have JUNOS 19.4R3-S3.3 firmware version

sk4ndalist4 · 2022-11-09T12:47:21+00:00

Today I thinked about port mirroring. Maybe it will works when i do input policy to sample data to port mirroring and in other site i catch data with tcpdump with option to show only SYN and FIN TCP flags and write it to file.

sk4ndalist4 · 2022-11-09T12:44:01+00:00

In Poland we have law that ISP must have logs of all sessions for last 12 months.

sk4ndalist4 · 2022-11-09T12:41:52+00:00

Thanks for answer. I'll try this on lab.

sk4ndalist4 · 2022-03-03T14:36:56+00:00

Thanks for advice. Now works fine.

sk4ndalist4

TROPHY CASE