Managing configuration
>configure exclusive – Ngăn người khác sửa đổi trong khi ở chế độ cấu hình
#status – Hiển thị người dùng hiện đang đăng nhập
#compare (filename | rollback n)
#commit | display detail – debug commit
#commit check
#commit comment
#commit confirmed
#commit at [tt:mm | yyyy-mm-dd hh:mm | reboot], to cancel:
>clear system [commit | reboot ]
>show system commit
>show configuration
#load {set} {merge | replace | override } {relative} [terminal | file] – paste – Ctrl+D to end
# show | # compare (filename | rollback n)
# show | display set
# show | display changed
# show | display detail
# show | display omit statement
Configuration modification commands:
#annotate “xxxxx” – Chú thích cấu hình
#activate/deactivate
#copy / delete / rename – works with wildcards, e.g. delete fe*
#rename – string in configuration
#replace pattern
#protect / unprotect a statement
#exit configuration-mode
#quit
>show system rollback 10
>show system rollback compare 10 12
>show system commit
System
>show version {detail}
>request system reboot | power-off
>file [copy | list | delete | show | rename ]
>show system storage
>show chassis hardware detail
>show chassis alarms
>show chassis environment
>show chassis craft-interface – show router LED alarms
>show configuration | display detail
>show system users – ai đã đăng nhập vào hệ thống
>request system logout use username – forcefully logout a user
>request message all message “log out now”
>show system boot-messages – boot log
Interfaces/Hardware:
Hiển thị thông tin về bộ nhớ, nhiệt độ CPU, tải và thời gian hoạt động:
>show chassis routing engine
Để xem phần cứng và SFP
Tổng quan về phần cứng
>
show chassis hardware
fpc nào đang sử dụng
>
show chassis fpc
Để hiển thị những chi tiết pic được lắp đặt trong một slot:
>
show chassis pic pic-slot 0 fpc-slot 0
Xem công suất của fibre interface:
>
show interfaces diagnostics optics
Logging
#set system syslog file messages any info à để lưu tất cả các logs vào tập tin
>show log messages | match LOGIN | match “Mar 16”
>file list detail /var/log = ls –al (to see permitions, etc.)
>clear log messages – Để xoá nội dung tập tin Logs
>monitor start messages à Giám sát trực tiếp
>monitor list
>monitor stop à Stop giám sát
For more detailed information about a process, under the process level:
#set traceoptions file filenamefil world-readable
#set traceoptions flag all
>help syslog à Hiển thị thông tin logs hệ thống
Security Policies
View security policy:
>
show security policies from-zone Proxy-DMZ to-zone Inside details
To check if traffic will pass through the security policies
(useful when not able to generate traffic):
> show security match-policies from-zone Outside to-zone Inside
protocol xxx source-ip xxx source-port xxx destination-ip xxx
destination-port xxxx
General Monitoring and troubleshooting
>monitor traffic interface ge-0/0/0
>monitor interface ge-0/0/0
>monitor traffic interface ge-0/2/3 matching “proto 89” write-file ospf.cap – matches proto 89 and writes it in ospf.cap
>show security flow session … options
>show system statistics – all packet types statistics for a device
>test policy
Routing
>show route
>show
route terse – nice concise output with the following
information: A-active, Destination, P-protocol, Prf-preference, Metric1,2
Next-hop, AS Patch)
>show
route protocol [static|direct|ospf]
>show route forwarding-table to see active routes in the
forwarding table
Troubleshoot OSPF
>show route forwarding-table à to see active routes in the forwarding table
>show route protocol ospf
>show ospf overview
>show ospf interaces
>show ospf neighbor
>show ospf dataset detail
>show
ospf neighbor [extensive]
>clear ospf neighbor [192.168.254.225]
>show ospf statistics
>show ospf interface [extensive]
>show ospf route [abr|asbr|extern]
>show route protocol ospf
>show ospf database [summary|brief]
>show ospf database [router|network|netsummary|asbrsummary|extern|nssa]
>show ospf database router advertising-router 10.0.3.3 detail
>show ospf database router area 0 extensive
>show ospf database area 0 lsa-id extensive
>clear ospf database purge
>show ospf log
Troubleshoot NAT
+ Source
>show security nat source summary
>show security nat source rule
>show security nat source pool
+ Static
>show security nat static rule
+ Destination
>show security nat destination summary
>show security nat destination pool
>show security nat destination rule
>show security flow session
Firewall
>show
firewall
>show firewall log
>clear firewall [all|filter-name|counter-name]
>show interfaces filters
>show interfaces policers
>show policer
******
Set Firewall Filter to count packets through the SRX:
# show interfaces ge-0/0/0
ge-0/0/0 {
unit 0 {
family inet {
filter {
input icmp-filter;
}
address 1.1.1.1/30; ## This address was already set on the interface
}
}
}
# show firewall family inet filter icmp-filter
icmp-filter {
term 1 { ## This is the main term which will count the packets.
from {
source-address 3.3.3.3;
destination-address 1.1.1.1;
protocol icmp;
}
then {
count icmp-counter; ## The icmp-counter will show the bytes/packets incrementing
accept; ## This will accept the packets if you don’t want them to be dropped. You can use – “drop” or “reject” and/or “log” here.
}
}