chrono-it.net

A System Engineers Blog

Juniper Troubleshooting – Light Levels

When looking at your overall setup it’s important to look at light levels of your optics as they can be a sign of fiber/optic/distance issues with your setup.

show interface diagnostic optic et-0/0/1 | match dbm$ | except thresh

This allows you to easily see what your current light levels are without the noise.

MacOS in VMware Workstation

I recently decided to virtualize macOS on my Windows workstation in order to create an environment for testing software installations within a snapshot-capable setup. VMware Workstation does not support this functionality by default; however, as is often the case, the open-source community has provided a solution through a tool called Unlocker.

https://github.com/paolo-projects/auto-unlocker

The key point to remember about this product is that it must be uninstalled using the same executable file before performing a software upgrade, as failing to do so can lead to problematic issues. Once the software has been updated, the tool can be run again to restore the unlocked functionality.

Encrypted DNS

I recently began looking into encrypting dns traffic for general security reasons. Thankfully I wasn’t the first person to look into this and there is a very robust ecosystem already in place.

https://github.com/paulmillr/encrypted-dns

I chose to use the cloudflare resolvers but Paul has put together a great list of other providers that provide access to both general as well resolvers who provider dns filtering to protect against known malicious sites.

Cloudflare talks about the different methodologies in detail but it falls into 3 categories:

DNS over TLS (DoT): https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls

DNS over HTTPS (DoH): https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/

Oblivious DNS over HTTPS: https://developers.cloudflare.com/1.1.1.1/encryption/oblivious-dns-over-https/

I personally would recommend DoH as it provides both security and slightly obscured network traffic while not requiring additional third party services.

VMware – Using PowerCLI to generate install isos from patch packages

pwsh
Import-Module VMware.PowerCLI
Add-EsxSoftwareDepot -DepotUrl /Users/chronoit/Downloads/staging/8_0/VMware-ESXi-8.0a-20842819-depot.zip
PS /Users/chronoit/Downloads/staging/8_0> Get-ESXimageProfile 

Name                           Vendor          Last Modified   Acceptance Level
----                           ------          -------------   ----------------
ESXi-8.0a-20842819-no-tools    VMware, Inc.    11/24/2022 5:4… PartnerSupported
ESXi-8.0a-20842819-standard    VMware, Inc.    12/8/2022 12:0… PartnerSupported
Export-EsxImageProfile -ImageProfile "ESXi-8.0a-20842819-standard" -ExportToIso -FilePath '/Users/chronoit/Downloads/staging/8_0/ESXi-8.0a-20842819-standard.iso'
Sorting in powershell for large software depots

Get-ESXimageProfile | Sort-Object -Descending -Property @{Expression={$_.Name.Substring(0,10)}},@{Expression={$_.CreationTime.Date}},Name | Select -first 5 | FT -AutoSize

VMware – Installing Powershell for Intel Macos

As a system engineer who uses a mac I often run into problems with software that wasn’t really designed or documented properly for macos users. This guide will get you up and running with a basic PowerCLI environment.

Recommended Software Versions

macos Ventura 13.6.4
macos Python 3.9.6
PowerCLI Recommended Python3.7.X (no longer available in brew) 

Install brew

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Install prerequisites

brew install xz
brew install pyenv
brew install openssl@1.1
pyenv install 3.7.17
/Users/<youruser>/.pyenv/versions/3.7.17/bin/python3 -m pip install six psutil lxml pyopenssl

Since Python 3.7 has been removed from brew (fully deprecated) we will want to move to pyenv to manage your python installs (which you should probably do anyway). You need to install openssl@1.1 as this is a requirement for powercli and is a package that brew held back as it's used by multiple packages so it's still installable separately from brew python. 

Install Powershell

brew install powershell/tap/powershell

Install PowerCli

 pwsh
 Install-Module VMware.PowerCLI -Scope CurrentUser

Configure PowerCLI

Set-PowerCLIConfiguration -PythonPath /Users/<youruser>/.pyenv/versions/3.7.17/bin/python3  -Scope User

You now have a functional Powershell environment.

Other Useful commands

Listing all available versions of powercli
Find-Module -AllVersions VMware.PowerClI

Discover your currently installed version of modules
Get-Module -Name VMware.* | Select-Object -Property Name,Version

Reset your Powershell environment
Get-InstalledModule | Uninstall-Module -Force

Juniper Tips [EX/QFX/MX]: How to utilize wildcard, interface-range, and apply-groups to mass manage port configs

There are many ways to apply config changes to large numbers of interfaces. Below are three methodologies I’ve used over the years.

Wildcard Changes

One of my personal preferences is to add individual configurations for each port so that when I look at a port configuration I’m seeing it’s entire configuration easily. This can make making mass changes difficult if it weren’t for Junipers built in wildcard functionality.

In the example below we are making changes to a two member virtual chassis cluster (member 0 and 1) on ports 0-47 of PIC 0

wildcard range set interfaces xe-[0,1]/0/[0-47].0 family ethernet-switching vlan members vl999

This changes something that would 96 standard set statements into a convenient one liner. There are many variations of this based on your use cases.

Original Reference: https://www.juniper.net/documentation/us/en/software/junos/cli/topics/topic-map/modifying-configuration.html

Interface ranges

Some device types and circumstances could lead to large configurations that increase commit time and cause problems for backup config parsers. In that case you may want to switch to utilizing interface ranges to control groups of ports.

set interfaces interface-range vmware-servers member-range xe-0/0/47 to xe-1/0/47
set interfaces interface-range vmware-servers mtu 9216
set interfaces interface-range vmware-servers unit 0 family ethernet-switching interface-mode trunk
set interfaces interface-range vmware-servers unit 0 family ethernet-switching vlan members [ vl998 vl999 ]

Note: aggregated ethernet interfaces are not supported in interface-ranges

Original Reference: https://www.juniper.net/documentation/us/en/software/junos/interfaces-ethernet-switches/topics/topic-map/switches-interface-range.html

apply-groups

Apply groups is the most feature complete way of applying configs en-masse .

set groups vmware-servers interfaces xe-[0,1]/0/[0-47] mtu 9216
set groups vmware-servers interfaces xe-[0,1]/0/[0-47] unit 0 family ethernet-switching interface-mode trunk
set groups vmware-servers interfaces xe-[0,1]/0/[0-47] unit 0 family ethernet-switching vlan members vl999
set groups vmware-servers interfaces xe-[0,1]/0/[0-47] unit 0 family ethernet-switching vlan members vl998

set interfaces apply-groups vmware-servers

admin@homelab01# show interfaces | display inheritance 
ge-0/0/0 {
    unit 0 {
        family inet {
            dhcp;
        }
    }
}
xe-0/0/0 {
    ##
    ## '9192' was inherited from group 'vmware-servers'
    ##
    mtu 9192;
    unit 0 {
        ##
        ## 'ethernet-switching' was inherited from group 'vmware-servers'
        ##
        family ethernet-switching {
            ##
            ## 'trunk' was inherited from group 'vmware-servers'
            ##
            interface-mode trunk;
            ##
            ## 'vlan' was inherited from group 'vmware-servers'
            ##
            vlan {
                ##
                ## 'vl999' was inherited from group 'vmware-servers'
                ## 'vl998' was inherited from group 'vmware-servers'
                ## 'vl1000' was inherited from group 'vmware-servers'
                ##
                members [ vl999 vl998 vl1000 ];
            }
        }
    }
}

Note: Interfaces must already exist in the config to have configs applied to them. Just use “set interfaces ge-0/0/0.0 for each interface you want created.”
Note: aggregated ethernet interfaces are supported using apply-groups.

Original Reference: https://www.juniper.net/documentation/us/en/software/junos/cli/topics/topic-map/configuration-groups-usage.html

© 2026 chrono-it.net

Theme by Anders NorenUp ↑