Juniper MX — Dist MX IDC (Multitenant eBGP Distribution)

Dokumen Informasi (INFO) hasil konversi current-configuration Juniper MX (show configuration, rConfig) di sisi IDC. Host-name: dist-mx-idc, JUNOS 22.2R3.15, commit terakhir 2026-09-17 oleh fathir. Peran: router distribusi/edge berbasis logical-systems — satu perangkat fisik melayani banyak tenant/customer dengan routing table dan BGP AS sendiri.

Konsep Logical Systems

Setiap logical system memisahkan routing dari sistem utama. Daftar logical system pada perangkat ini: BRD-APJII-IIX (AS 64585), BRD-DIGIT (154505), BRD-MAP (142219), BRD-MNA (64594, router-id 10.1.1.1), LS-BRD-SG (142373), LS-DIST-AMN (154430), LS-DIST-CUST (64589), LS-DIST-MUSUBI (142145), LS-DIST-OSM (153618), LS-DIST-SELARAS (154494).

logical-systems {
    BRD-APJII-IIX {
        routing-options {
            autonomous-system 64585;
        }
    }
    BRD-MNA {
        routing-options {
            router-id 10.1.1.1;
            autonomous-system 64594;
        }
    }
}

Login Ter-scope per Logical System

Akses admin dibatasi per logical system via login class: contoh class admin-ls-musubi {(logical-system LS-DIST-MUSUBI; permissions all)}, adminmap → BRD-MAP, adminosm → LS-DIST-OSM. Admin khusus logical system hanya bisa masuk ke tenant tersebut.

system {
    login {
        class admin-ls-musubi {
            logical-system LS-DIST-MUSUBI;
            permissions all;
        }
        class adminmap {
            logical-system BRD-MAP;
            permissions all;
        }
    }
}

Implementasi (Fisik)

Interface et-0/0/0 (BRD-MNA), et-0/0/1 (LS-CUS.VIA-SW-SP dengan hierarchical-scheduler max 2 level), et-0/0/2 (LS-DIST-SELARAS), et-0/0/3 flexible-vlan-tagging dengan unit 8 (MGMT.SW.DACEN.MNI, 10.11.9.57/29 & 10.10.9.129/30). Link agregasi ae0/ae2/ae3 dan manajemen fxp0 tersedia.

interfaces {
    et-0/0/0 {
        description BRD-MNA;
        vlan-tagging;
    }
    et-0/0/3 {
        description BB-MX-MASTER;
        flexible-vlan-tagging;
        unit 8 {
            description MGMT.SW.DACEN.MNI;
            vlan-id 8;
            family inet {
                address 10.11.9.57/29;
                address 10.10.9.129/30;
            }
        }
    }
}

Routing Global (Default Instance)

Instance utama memakai AS 64581 dengan static route. Protokol global: BGP grup UPSTREAM (type external, import IN-UPSTREAM / export OUT-UPSTREAM) dengan neighbor 10.11.9.157 (BRD.IIX) dan 10.11.9.161 (BRD.INT) peer-as 64555, plus neighbor IPv6 2401:c7a0:fffa::46 dengan policy IN-IPV6/OUT-IPV6. Ada router-advertisement di fxp0.

protocols {
    bgp {
        family inet {
            any;
        }
        group UPSTREAM {
            type external;
            import IN-UPSTREAM;
            export OUT-UPSTREAM;
            neighbor 10.11.9.157 {
                description BRD.IIX;
                peer-as 64555;
            }
            neighbor 2401:c7a0:fffa::46 {
                description BRD.INT;
                import IN-IPV6;
                export OUT-IPV6;
                peer-as 64555;
            }
        }
    }
}

Policy, Filter & Forwarding

Policy-options mendefinisikan route-policy per-tujuan, firewall memuat filter interface/kelas layanan, dan forwarding-options set hash-key untuk load-balancing flow yang konsisten (mis. untuk session NAT/CPE).

policy-options { ... }
firewall { ... }
forwarding-options {
    hash-key { ... }
}

Related SOP