Data Center LAN Migration Guide - Juniper Networks
Data Center LAN Migration Guide - Juniper Networks
Data Center LAN Migration Guide - Juniper Networks
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Data</strong> <strong>Center</strong> <strong>LAN</strong> <strong>Migration</strong> <strong>Guide</strong><br />
OSI Layer 4-7: Transport to Application Troubleshooting<br />
This type of problem is most likely to occur on firewalls or on routers secured with firewall filters. Below are some<br />
important things to remember when troubleshooting Layer 4-7 issues:<br />
• Standard troubleshooting tools such as ping and traceroute may not work. Generally, ping and traceroute are not<br />
enabled through a firewall except in specific circumstances.<br />
• Firewalls are routers too, In addition to enforcing stateful policies on traffic, firewalls also have the responsibility of<br />
routing packets to their next hop. To do this, firewalls must have a working and complete routing table statically or<br />
dynamically defined. If the table is incomplete or incorrect, the firewall will not be able to forward traffic correctly.<br />
• Firewalls are stateful and build state for every session that has passed through the firewall. If a non-SYN packet<br />
comes to the firewall and the firewall does not have a session open for that packet, it is considered an “out of state”<br />
packet. This can be the sign of an attack or an application that is dormant beyond the firewall session timeout<br />
duration attempting to send traffic.<br />
• By definition, stateful firewalls enforce traffic though their policy based on the network and transport layers of the<br />
OSI model. In addition, firewalls may also do protocol anomaly checks and signature matches on the application<br />
layer for selected protocols.<br />
• This function is implemented by ALGs. ALGs recognize application-specific sequences, change the application layer<br />
to make protocols compatible with Port Address Translation (PAT) attempting to send traffic and Network Address<br />
Translation (NAT), and deliver higher layer content to deep inspection (DI), antivirus, URL filter, and spam filter<br />
features, if enabled.<br />
• If you experience a problem that involves the passing or blocking of traffic, the very first place to look is the firewall<br />
logs. Often the log messages will give strong hints about the problem.<br />
Tools<br />
Junos OS has embedded script tools to simplify and automate some tasks for network engineers. Commit scripts,<br />
operation (op) scripts, and event scripts provide self monitoring, self diagnosing, and self healing capabilities to the<br />
network. The apply-macro command feeds a commit script to extend and customize the router configuration based<br />
on user-defined data and templates. Together, these tools offer an almost infinite number of applications to reduce<br />
downtime, minimize human error, accelerate service deployment, and reduce overall operational costs. For more<br />
information, refer to: www.juniper.net/us/en/community/junos/script-automation.<br />
Troubleshooting Summary<br />
Presenting an exhaustive and complete troubleshooting guide falls outside the scope of this <strong>Data</strong> <strong>Center</strong> <strong>LAN</strong><br />
<strong>Migration</strong> <strong>Guide</strong>. Presented in this section is a methodology to understand the factors contributing to a problem and a<br />
logical approach to the diagnostics needed to investigate root causes. This method relies on the fact that IP networks<br />
are modeled around multiple layered architectures. Each layer depends on the services of the underlying layers. From<br />
the physical network topology comprised of access, aggregation, and core tiers to the model of IP communication<br />
founded on the 7 OSI layers, matching symptoms to the root cause layer is a critical step in the troubleshooting<br />
methodology. <strong>Juniper</strong> platforms have also implemented a layered architecture by integrating separate control and<br />
forwarding planes. Once the root cause layer is correctly identified, the next steps are to isolate the problem and to<br />
take the needed corrective action at that specific layer.<br />
For more details on platform specifics, please refer to the <strong>Juniper</strong> technical documentation that can be found at:<br />
www.juniper.net/techpubs.<br />
62 Copyright © 2012, <strong>Juniper</strong> <strong>Networks</strong>, Inc.