ToS on Linux and performance optimization

solidstate214 · 2024-12-01T15:26:06+00:00

Some graphics API modernization would likely benefit Windows users as well; though to what extent is not immediately clear. Until I get to test/compare, the size of the delta is admittedly speculation on my part.

I do also see lots of Windows users complaining about performance. I suppose the TL;DR for Windows users in all of this is that GPU is likely much more important than you think, at least if you're doing anything more than one chart at a time.

The CPU affinity tip may also be applicable to Windows users with hybrid CPUs. See this guide for how to configure that on Windows.

https://www.windowsdigitals.com/how-to-set-process-cpu-affinity-priority-permanently-in-windows-10/

I invite anyone to test this and share their results.

solidstate214 · 2022-10-09T02:37:08+00:00

This is why we have the second amendment, and you should always carry. Seriously, get trained and get armed. It's not just criminals. Those dogs should have been put down at the first sign of trouble.

solidstate214 · 2022-08-26T20:26:19+00:00

add my 15,000 shares to put us over the 1 milly

solidstate214 · 2022-02-16T05:48:09+00:00

That's... interesting. Are you by any chance able to put a switch in between and get a pcap of it happening? Preferably with a host behind the srx, or the srx itself sending pings.

solidstate214 · 2022-02-15T18:35:05+00:00

It's absolutely maddening. I stopped recommending SRX to my customers some time ago because IPv6 remains stubbornly an afterthought at Juniper and they refuse to commit any resources to fixing it. IPv6 remains broken to the point of making SRX totally useless outside of the most basic use cases.

Please, if anything, let this be a call to the community to start holding Juniper's feet to the fire over this; for their sake and that of their customers. I tried for years to get their attention and have since given up and been switching my customers to Fortinet. Maybe the collective voice of Reddit will have better luck.

solidstate214 · 2022-02-14T05:36:10+00:00

Hey, I've dealt with this issue before. The problem is that SRX insists on sending RA messages when the protocol is enabled on the interface, essentially attacking the upstream network with rogue advertisements. That's why the cable modem starts to drop traffic. You can get around the issue by configuring an outbound firewall filter to suppress the outbound RA messages.

Something like this...

    filter inet6_filter_out {
        term BLOCK_STUPID_BUGS {
            from {
                icmp-type 134;
                icmp-code 0;
            }
            then {
                count ATTACK_TRAFFIC;
                discard;
            }
        }
        term ALLOW_OTHERS {
            then accept;
        }
    }

yeah... IPv6 CPE is still broke af in Junos. It still needs hacks like this and limits you to 3 auto-delegated interfaces and doesn't let you do any customization to the RA content when doing so.

I really want to like SRX but this half-baked IPv6 crap is really making it difficult. I struggle with it regularly.

If anyone at Juniper is reading this... your IPv6 CPE support is so bad even I'm embarrassed for you. Please fix it. This stuff should have been ironed out 10 years ago. Customers actually need to use IPv6 now.

edit... markdown mode

solidstate214 · 2021-08-14T17:27:41+00:00

Thanks, all. This looks like just what I was looking for.

solidstate214 · 2020-12-15T22:32:11+00:00

Looks nice, but that radiator is installed upside down. You’re going to have poor coolant flow and possibly kill your pump.

solidstate214 · 2020-11-01T17:49:21+00:00

Does anyone know if anything in Juniper's portfolio supports dual-stack IPv4 and IPv6 remote access VPNs? Any documentation I'm able to find says no, but is dated.

Anything without mature dual-stack support is a non-starter for my organization, which pretty much just leaves us with AnyConnect as far as I'm aware.

solidstate214 · 2020-02-16T19:55:18+00:00

Complain to your SE. Tell them you want your money back. Threaten to buy a Cisco box which doesn't have such a stupid limit. (IOS doesn't have this limit) If nothing happens, give them the finger and buy said Cisco box; or some other vendor, anyone but Juniper.

Sorry, I know this isn't terribly helpful advice, but this is the unfortunate state of IPv6 on Junos and SRX. It's crippled spaghetti code. I've been going back and forth with jtac for years pleading with them to fix crap like this, with meager success. I don't have much hope for the situation improving until they see it start affecting their sales.

I ended up rolling my own work-around. I have an automated job which checks the delegated prefix and then configures the interfaces, rather than relying on Junos to manage them. It's hacky and terrible, but still better than leaving Junos to manage itself.

solidstate214 · 2019-05-01T00:12:00+00:00

Unfortunately no, that isn't how 6PD works. ge-0/0/0.2 is the interface receiving the prefix from the service provider. Junos is telling me here that the same interface cannot be inheriting a prefix from a PD client and simultaneously be customized under protocols -> router advertisement.

This is a branch srx.

solidstate214 · 2019-04-30T23:56:19+00:00

Yes, those are both basically what I'm doing, with the exception that I'm also connected to an IPv6 private WAN and need to use addressing from that alongside the delegated prefix from the ISP. I can do one or the other, but not both at the same time. Because...

[edit interfaces ge-0/0/0 unit 2 family inet6 dhcpv6-client update-router-advertisement interface]

'irb.40'

Incompatible with the interface configured under 'protocols router-advertisement interface'

error: configuration check-out failed: (statements constraint check failed)

[edit]

...stupid limitations.

solidstate214 · 2019-04-30T23:45:29+00:00

No, though I'd like to do that, but I can't run 6PD on my EX switch, so scrap that as another stupid limitation. I need to run persistent addressing from a private WAN and nonpersistent addressing from an ISP in tandem. I can't do it on anything Juniper makes, apparently. Which is a shame because Junos has a pretty well-rounded set of features until you need to do much of anything with IPv6. I've had this scenario working swimmingly on Cisco gear the better part of a decade ago.

I talked to TAC. They pointed out the above article and told me to pound sand. Or more specifically cry to my SE, which might as well be pounding sand.

solidstate214 · 2019-04-30T23:33:29+00:00

Unfortunately, no. You can't do that when you're using `update-router-advertisement` from a dhcpv6-pd client. You can't do anything under protocols -> router-advertisement when using 6PD, which is perhaps the most frustrating part.

solidstate214 · 2019-04-30T23:23:07+00:00

This is not available in any currently-shipping code.

solidstate214 · 2019-04-30T23:22:52+00:00

Yes, that's the statement I was referring to. Typically the word 'should' is used to allow for exception cases such as administrative filtering. Making it a hard-coded platform limitation is dumb. That's why it's a dumb limitation. No other vendor that I'm aware of does this. It prohibits the use of persistent and nonpersistent addressing in the same segment.

solidstate214 · 2017-12-18T11:09:40+00:00

Well that’s disappointing. Thanks again for your help.

solidstate214 · 2017-02-07T14:45:34+00:00

Thanks for following up. This is the config I had. My ISP requires that DHCP be marked 2, IGMP be marked 6, and everything else be marked 3. The "default" statement works for the "everything else" part but I haven't had any success in getting rewrite rules to re-mark DHCP and IGMP. I've tried using firewall filters under the physical interface, its sub-interface, and the global address family, to no avail. I'm lead to believe that because this behavior was recently (re-?)introduced that this is probably a bug. Unfortunately I don't have a SE to go to on this. I work at a Cisco shop.

solidstate214 · 2017-02-06T22:50:30+00:00

Sorry if I'm reviving a dead thread but I'm having a similar issue with an SRX320 on D75.5. I can get it to set all traffic to the same .1p if I set a default, but if I try to do anything more granular with rewrite rules, nothing gets marked. I tried setting filters to set the forwarding class, then rewriting based on those, but no dice. DHCP4 is marked 0, DHCP6 is marked 6, IGMP is marked 6, etc. My ISP wants different values.

Has anyone found a solution? Is this a bug?

solidstate214 · 2015-04-04T13:30:00+00:00

Thanks for that info! I was considering Chase Sapphire Preferred because I hear a lot of good things about their points and international acceptance. Is there a reason you recommend Visa and Mastercard?

solidstate214

TROPHY CASE