Book Image

JUNOS Automation Cookbook

By : Adam Chappell
Book Image

JUNOS Automation Cookbook

By: Adam Chappell

Overview of this book

The JUNOS Automation Cookbook is a companion guide for the complex field of automating tasks on JUNOS devices. With a foundation in industry-standrd XML, JUNOS provides an ideal environment for programmatic interation, allowing you to build upon the capabilities provided by Juniper, with your own original code. You will begin by learning about, and setting up, the industry-standard NETCONF remote procedure call mechanisms on your device. After initial setup, you'll walk through SLAX - Juniper's foundation scripting language - for manipulating XML representations of JUNOS concepts and elements. You'll learn how to write your own SLAX scripts to customise the operating environment, and also how to write proactive event handlers that deal with situations as they happen. You'll then delve into PyEZ - Juniper's bridging framework to make automation accessible to Python code - allowing you to build automation applications in the popular scripting language. You'll witness some examples of how to write applications that can monitor configuration changes, implement BGP security policies and implement ad-hoc routing protocols, for those really tricky situations. You'll also leaarn how asynchronous I/O frameworks like Node.js can be used to implement automation applications that present an acceptable web interface. Along with way, you'll explore how to make use of the latest RESTful APIs that JUNOS provides, how to visualize aspects of your JUNOS network, and how to integrate your automation capabilities with enterprise-wide orchestration systems like Ansible. By the end of the book, you'll be able to tackle JUNOS automation challenges with confidence and understanding, and without hassle.
Table of Contents (10 chapters)

Applying anti-spoofing filters

In this recipe, we'll create an automation assistant to help us deploy anti-spoofing filters in our network. Anti-spoofing filters are packet filters that validate the source addresses of packets received from an interface to make sure that they are consistent with routing information in the reverse direction. They are important because they defeat one of the most significant vectors of distributed denial-of-service (DDOS) attacks: traffic seemingly originating from false source addresses. To implement source address filtering, the router's receiving interface is configured to perform a Reverse Path Forwarding (RPF) check: a lookup of the source address in the routing table to see if the same interface would be used for outgoing traffic if the source was a destination.

The IETF and internet community blessed RFC 2827—a recommendation...