Layer 2 Networking | Junos OS (2024)

Layer 2, also known as the Data Link Layer, is the secondlevel in the seven-layer OSI reference model for network protocoldesign. Layer 2 is equivalent to the link layer (the lowest layer)in the TCP/IP network model. Layer2 is the network layer used to transferdata between adjacent network nodes in a wide area network or betweennodes on the same local area network.

A frame is a protocol data unit, the smallestunit of bits on a Layer 2 network. Frames are transmitted to and receivedfrom devices on the same local area network (LAN). Unilke bits, frameshave a defined structure and can be used for error detection, controlplane activities and so forth. Not all frames carry user data. Thenetwork uses some frames to control the data link itself..

At Layer 2, unicast refers to sending framesfrom one node to a single other node, whereas multicast denotes sending traffic from one node to multiple nodes, and broadcasting refers to the transmission of frames to allnodes in a network. A broadcast domain is a logicaldivision of a network in which all nodes of that network can be reachedat Layer 2 by a broadcast.

Segments of a LAN can be linked at the frame level using bridges. Bridging creates separate broadcast domains onthe LAN, creating VLANs, which are independent logical networks thatgroup together related devices into separate network segments. Thegrouping of devices on a VLAN is independent of where the devicesare physically located in the LAN. Without bridging and VLANs, alldevices on the Ethernet LAN are in a single broadcast domain, andall the devices detect all the packets on the LAN.

Forwarding is the relaying of packets fromone network segment to another by nodes in the network. On a VLAN,a frame whose origin and destination are in the same VLAN are forwardedonly within the local VLAN. A network segment is a portion of a computernetwork wherein every device communicates using the same physicallayer.

Layer 2 contains two sublayers:

• Logical link control (LLC) sublayer, which is responsiblefor managing communications links and handling frame traffic.

• Media access control (MAC) sublayer, which governs protocolaccess to the physical network medium. By using the MAC addressesthat are assigned to all ports on a switch, multiple devices on thesame physical link can uniquely identify one another.

  The ports, or interfaces, on a switch operate in eitheraccess mode, tagged-access, or trunk mode:

  • Access mode ports connect to a networkdevice such as a desktop computer, an IP telephone, a printer, a fileserver, or a security camera. The port itself belongs to a singleVLAN. The frames transmitted over an access interface are normal Ethernetframes. By default, all ports on a switch are in access mode.

  • Tagged-Access mode ports connectto a network device such as a desktop computer, an IP telephone, aprinter, a file server, or a security camera. The port itself belongsto a single VLAN. The frames transmitted over an access interfaceare normal Ethernet frames. By default, all ports on a switch arein access mode. Tagged-access mode accommodates cloud computing, specificallyscenarios including virtual machines or virtual computers. Becauseseveral virtual computers can be included on one physical server,the packets generated by one server can contain an aggregation ofVLAN packets from different virtual machines on that server. To accommodatethis situation, tagged-access mode reflects packets back to the physicalserver on the same downstream port when the destination address ofthe packet was learned on that downstream port. Packets are also reflectedback to the physical server on the downstream port when the destinationhas not yet been learned. Therefore, the third interface mode, taggedaccess, has some characteristics of access mode and some characteristicsof trunk mode:

  • Trunk mode ports handle traffic formultiple VLANs, multiplexing the traffic for all those VLANs overthe same physical connection. Trunk interfaces are generally usedto interconnect switches to other devices or switches.

    With native VLAN configured, frames that do not carry VLAN tagsare sent over the trunk interface. If you have a situation where packetspass from a device to a switch in access mode, and you want to thensend those packets from the switch over a trunk port, use native VLANmode. Configure the single VLAN on the switch’s port (whichis in access mode) as a native VLAN. The switch’s trunk portwill then treat those frames differently than the other tagged packets.For example, if a trunk port has three VLANs, 10, 20, and 30, assignedto it with VLAN 10 being the native VLAN, frames on VLAN 10 that leavethe trunk port on the other end have no 802.1Q header (tag). Thereis another native VLAN option. You can have the switch add and removetags for untagged packets. To do this, you first configure the singleVLAN as a native VLAN on a port attached to a device on the edge.Then, assign a VLAN ID tag to the single native VLAN on the port connectedto a device. Last, add the VLAN ID to the trunk port. Now, when theswitch receives the untagged packet, it adds the ID you specifiedand sends and receives the tagged packets on the trunk port configuredto accept that VLAN.

Including the sublayers, Layer 2 on the QFX Series supportsthe following functionality:

• Unicast, multicast, and broadcast traffic.

• Bridging.

• VLAN 802.1Q—Also known as VLAN tagging, this protocol allows multiple bridged networks to transparentlyshare the same physical network link by adding VLAN tags to an Ethernetframe.

• Extension of Layer 2 VLANs across multiple switches usingSpanning Tree Protocol (STP) prevents looping across the network.

• MAC learning, including per-VLANMAC learning and Layer 2 learning suppression–This process obtainsthe MAC addresses of all the nodes on a network

• Link aggregation—This process groups of Ethernetinterfaces at the physical layer to form a single link layer interface,also known as a link aggregation group (LAG) orLAG bundle

  Note:

  Link aggregation is not supported on NFX150 devices.

• Storm control on the physical port for unicast, multicast,and broadcast

  Note:

  Storm control is not supported on NFX150 devices.

• STP support, including 802.1d, RSTP, MSTP, and Root Guard

See Also

A VLAN (virtual LAN) is a collection of network nodes grouped together to form separate broadcast domains. On an Ethernet network that is a single LAN, all traffic is forwarded to all nodes on the LAN. On VLANs, frames whose origin and destination are in the same VLAN are forwarded only within the local VLAN. Frames that are not destined for the local VLAN are the only ones forwarded to other broadcast domains. VLANs thus limit the amount of traffic flowing across the entire LAN, reducing the possible number of collisions and packet retransmissions within a VLAN and on the whole LAN.

On an Ethernet LAN, all network nodes must be physically connected to the same network. On VLANs, the physical location of the nodes is not important; therefore, you can group network devices in any way that makes sense for your organization, such as by department or business function, by types of network nodes, or by physical location. Each VLAN is identified by a single IP subnetwork and by standardized IEEE 802.1Q encapsulation.

To identify which VLAN the traffic belongs to, all frames on an Ethernet VLAN are identified by a tag, as defined in the IEEE 802.1Q standard. These frames are tagged and are encapsulated with 802.1Q tags.

For a simple network that has only a single VLAN, all traffic has the same 802.1Q tag. When an Ethernet LAN is divided into VLANs, each VLAN is identified by a unique 802.1Q tag. The tag is applied to all frames so that the network nodes receiving the frames know to which VLAN a frame belongs. Trunk ports, which multiplex traffic among a number of VLANs, use the tag to determine the origin of frames and where to forward them.

See Also

Layer2 transparent mode provides the ability to deploy the firewall withoutmaking changes to the existing routing infrastructure. The firewallis deployed as a Layer 2 switch with multiple VLAN segments and providessecurity services within VLAN segments. Secure wire is a special versionof Layer 2 transparent mode that allows bump-in-wire deployment.

A device operates in transparent mode when there are interfacesdefined as Layer 2 interfaces. The device operates in route mode (thedefault mode) if there are no physical interfaces configured as Layer2 interfaces.

For SRX Series Firewalls, transparent mode provides full securityservices for Layer 2 switching capabilities. On these SRX Series Firewalls,you can configure one or more VLANs to perform Layer 2 switching.A VLAN is a set of logical interfaces that share the same floodingor broadcast characteristics. Like a virtual LAN (VLAN), a VLAN spansone or more ports of multiple devices. Thus, the SRX Series Firewallcan function as a Layer 2 switch with multiple VLANs that participatein the same Layer 2 network.

In transparent mode, the SRX Series Firewall filterspackets that traverse the device without modifying any of the sourceor destination information in the IP packet headers. Transparent modeis useful for protecting servers that mainly receive traffic fromuntrusted sources because there is no need to reconfigure the IP settingsof routers or protected servers.

In transparent mode, all physical ports on the device are assignedto Layer 2 interfaces. Do not route Layer 3 traffic through the device.Layer 2 zones can be configured to host Layer 2 interfaces, and securitypolicies can be defined between Layer 2 zones. When packets travelbetween Layer 2 zones, security policies can be enforced on thesepackets.

Table 1 lists the securityfeatures that are supported and are not supported in transparent modefor Layer 2 switching.

In addition, the SRX Series Firewalls do not support the followingLayer 2 features in Layer 2 transparent mode:

• Spanning Tree Protocol (STP), RSTP, or MSTP—It isthe user’s responsibility to ensure that no flooding loops existin the network topology.

• Internet Group Management Protocol (IGMP) snooping—Host-to-routersignaling protocol for IPv4 used to report their multicast group membershipsto neighboring routers and determine whether group members are presentduring IP multicasting.

• Double-tagged VLANs or IEEE 802.1Q VLAN identifiers encapsulatedwithin 802.1Q packets (also called “Q in Q” VLAN tagging)—Onlyuntagged or single-tagged VLAN identifiers are supported on SRX Series Firewalls.

• Nonqualified VLAN learning, where only the MAC addressis used for learning within the VLAN—VLAN learning on SRX Series Firewalls is qualified; that is, both the VLAN identifier and MAC addressare used.

Also, on SRX100, SRX110, SRX210, SRX220, SRX240, SRX300, SRX320,SRX340, SRX345, SRX550, or SRX650 devices, some features are not supported.(Platform support depends on the Junos OS release in your installation.)The following features are not supported for Layer 2 transparent modeon the mentioned devices:

• G-ARP on the Layer 2 interface

• IP address monitoring on any interface

• Transit traffic through IRB

• IRB interface in a routing instance

• IRB interface handling of Layer 3 traffic

  Note:

  The IRB interface is a pseudointerface and does not belongto the reth interface and redundancy group.

• Layer 2 Transparent Mode on the SRX5000 Line Module Port Concentrator
• Understanding IPv6 Flows in Transparent Mode on Security Devices
• Understanding Layer 2 Transparent Mode Chassis Clusters onSecurity Devices
• Configuring Out-of-Band Management on SRX Series Firewalls
• Ethernet Switching
• Layer 2 Switching Exceptions on SRX Series Devices

See Also

Unicasting is the act of sendingdata from one node of the network to another. In contrast, multicasttransmissions send traffic from one data node to multiple other datanodes.

Unknown unicast traffic consists of unicastframes with unknown destination MAC addresses. By default, the switchfloods these unicast frames that are traveling in a VLAN to all interfacesthat are members of the VLAN. Forwarding this type of traffic to interfaceson the switch can trigger a security issue. The LAN is suddenly floodedwith packets, creating unnecessary traffic that leads to poor networkperformance or even a complete loss of network service. This is knownas a traffic storm.

To prevent a storm, you can disable the flooding of unknownunicast packets to all interfaces by configuring one VLAN or all VLANsto forward any unknown unicast traffic to a specific trunk interface.(This channels the unknown unicast traffic to a single interface.)

See Also

In a Layer 2 network, broadcasting refers to sending traffic to all nodes on a network.

Layer 2 broadcast traffic stays within a local area network(LAN) boundary; known as the broadcast domain. Layer 2 broadcast traffic is sent to the broadcast domain usinga MAC address of FF:FF:FF:FF:FF:FF. Every device in the broadcastdomain recognizes this MAC address and passes the broadcast trafficon to other devices in the broadcast domain, if applicable. Broadcastingcan be compared to unicasting (sending traffic to a single node) ormulticasting (delivering traffic to a group of nodes simultaneously).

Layer 3 broadcast traffic, however, is sent to all devices ina network using a broadcast network address. For example, if yournetwork address is 10.0.0.0, the broadcast network address is 10.255.255.255.In this case, only devices that belong to the 10.0.0.0 network receivethe Layer 3 broadcast traffic. Devices that do not belong to thisnetwork drop the traffic.

Broadcasting is used in the following situations:

• Address Resolution Protocol (ARP) uses broadcasting tomap MAC addresses to IP addresses. ARP dynamically binds the IP address(the logical address) to the correct MAC address. Before IP unicastpackets can be sent, ARP discovers the MAC address used by the Ethernetinterface where the IP address is configured.

• Dynamic Host Configuration Protocol (DHCP) uses broadcastingto dynamically assign IP addresses to hosts on a network segment orsubnet.

• Routing protocols use broadcasting to advertise routes.

Excessive broadcast traffic can sometimes create a broadcaststorm. A broadcast storm occurs when messages are broadcast on a networkand each message prompts a receiving node to respond by broadcastingits own messages on the network. This, in turn, prompts further responsesthat create a snowball effect. The LAN is suddenly flooded with packets,creating unnecessary traffic that leads to poor network performanceor even a complete loss of network service.

See Also

Enhanced Layer 2 Software (ELS) provides a uniformCLI for configuring and monitoring Layer 2 features on QFX Seriesswitches, EX Series switches, and other Juniper Networks devices,such as MX Series routers. With ELS, you configure Layer 2 featuresin the same way on all these Juniper Networks devices.

This topic explains how to know if your platform is runningELS. It also explains how to perform some common tasks using the ELSstyle of configuration.

Understanding Which Devices Support ELS

Understanding How to Configure Layer 2 Features Using ELS

• Configuring a VLAN
• Configuring the Native VLAN Identifier
• Configuring Layer 2 Interfaces
• Configuring Layer 3 Interfaces
• Configuring an IRB Interface
• Configuring an Aggregated Ethernet Interface and ConfiguringLACP on That Interface

Understanding ELS Configuration Statement and Command Changes

• Changes to the ethernet-switching-options Hierarchy Level
• Changes to the Port Mirroring Hierarchy Level
• Changes to the Layer 2 Control Protocol Hierarchy Level
• Changes to the dot1q-tunneling Statement
• Changes to the L2 Learning Protocol
• Changes to Nonstop Bridging
• Changes to Port Security and DHCP Snooping
• Changes to Configuring VLANs
• Changes to Storm Control Profiles
• Changes to the Interfaces Hierarchy
• Changes to IGMP Snooping

ethernet-switching-options { authentication-whitelist { ... }}

switch-options { ... authentication-whitelist { ... }}

ethernet-switching-options { interfaces interface-name { no-mac-learning; ... }}

switch-options { interfaces interface-name { no-mac-learning; ... }}

ethernet-switching-options { unknown-unicast-forwarding { (...) }}

switch-options { unknown-unicast-forwarding { (...) }}

ethernet-switching-options { voip { interface (all | [interface-name | access-ports]) { forwarding-class (assured-forwarding | best-effort | expedited-forwarding | network-control); vlan vlan-name; ... } }}

switch-options { voip { interface (all | [interface-name | access-ports]) { forwarding-class (assured-forwarding | best-effort | expedited-forwarding | network-control); vlan vlan-name; ... } }}

ethernet-switching-options { redundant-trunk-group { group name { description; interface interface-name { primary; } preempt-cutover-timer seconds; ... } }}

switch-options { redundant-trunk-group { group name { description; interface interface-name { primary; } preempt-cutover-timer seconds; ... } }}

ethernet-switching-options { mac-notification { notification-interval seconds; ... }}

ethernet-switching-options { traceoptions { file filename <files number> <no-stamp> <replace> <size size> <world-readable | no-world-readable>; flag flag <disable>; ... }}

ethernet-switching-options { port-error-disable { disable-timeout timeout; ... }}

interfaces interface-name family ethernet-switching { recovery-timeout seconds;}

ethernet-switching-options { analyzer   { name { ... } }}

forwarding-options { analyzer   { name { ... } }}

ethernet-switching-options { bpdu-block { ... }}

protocols { layer2-control { bpdu-block { ... } }}

ethernet-switching-options { dot1q-tunneling { ether-type (0x8100 | 0x88a8 | 0x9100); ... }}

interfaces interface-name { ether-options { ethernet-switch-profile { tag-protocol-id [tpids]; } }}

interfaces interface-name { aggregated-ether-options { ethernet-switch-profile { tag-protocol-id [tpids]; } }}

ethernet-switching-options { mac-table-aging-time seconds; ...}

protocols { l2-learning { global-mac-table-aging-time seconds; ... }}

ethernet-switching-options { nonstop-bridging;}

protocols { layer2-control { nonstop-bridging { } }}

 ethernet-switching-options { secure-access-port { interface (all | interface-name) { (dhcp-trusted | no-dhcp-trusted ); static-ip  ip-address { mac mac-address; vlan  vlan-name; } } vlan (all | vlan-name) { (arp-inspection | no-arp-inspection ); dhcp-option82 { disable; circuit-id { prefix hostname; use-interface-description; use-vlan-id; } remote-id { prefix (hostname | mac | none); use-interface-description; use-string string; } vendor-id [string]; } (examine-dhcp | no-examine-dhcp); } (ip-source-guard | no-ip-source-guard); } }

vlans vlan-name forwarding-options{ dhcp-security { arp-inspection;  group group-name { interfaceiinterface-name { static-ip ip-address { mac mac-address; } } overrides { no-option82; trusted; } } ip-source-guard; no-dhcp-snooping; option-82 { circuit-id { prefix { host-name; routing-instance-name; } use-interface-description (device | logical); use-vlan-id; } remote-id { host-name; use-interface-description (device | logical); use-string string; } vendor-id { use-string string; } } }

 ethernet-switching-options { secure-access-port { dhcp-snooping-file { location local_pathname | remote_URL; timeout seconds; write-interval seconds; }

system [ processes [ dhcp-service dhcp-snooping-file local_pathname | remote_URL; write-interval interval; } }

 ethernet-switching-options { secure-access-port vlan (all | vlan-name{ mac-move-limit }

vlans vlan-name  switch-options { mac-move-limit}

ethernet-switching-options { static { vlan vlan-id { mac mac-address next-hop interface-name; ... } }}

vlans { vlan-name { switch-options { interface interface-name { static-mac mac-address; ... } } }}

vlans { vlan-name { interface interface-name { egress; ingress; mapping (native (push | swap) | policy | tag (push | swap)); pvlan-trunk; ... } }}

vlans { vlan-name { isolation-id id-number; ... }}

vlans { vlan-name { interface vlan.logical-interface-number; ... }}

vlans { vlan-name { interface irb.logical-interface-number; ... }}

vlans { vlan-name { l3-interface-ingress-counting layer-3-interface-name; ... }}

vlans { vlan-name { no-local-switching; ... }}

vlans { vlan-name { no-mac-learning; ... }}

vlans { vlan-name { switch-options { no-mac-learning limit ... } }}

vlans { vlan-name { primary-vlan vlan-name; ... }}

vlans { vlan-name { vlan-prune; ... }}

vlans { vlan-name { vlan-range vlan-id-low-vlan-id-high; ... }}

vlans { vlan-name { vlan-id-list [vlan-id-numbers]; ... }}

vlans { vlan-name { l3-interface vlan.logical-interface-number; ... }}

vlans { vlan-name { interface irb.logical-interface-number; ... }}

vlans { vlan-name { dot1q-tunneling { customer-vlans (id | native | range); layer2-protocol-tunneling all | protocol-name { drop-threshold number; shutdown-threshold number; ... } } }}

interface interface-name { encapsulation extended-vlan-bridge; flexible-vlan-tagging; native-vlan-id number; unit logical-unit-number { input-vlan-map action; output-vlan-map action; vlan-id number; vlan-id-list [vlan-id vlan-id–vlan-id]; }}

protocols { layer2-control { mac-rewrite { interface interface-name { protocol { ... } } } }}

vlans { vlan-name { filter{ input  filter-name output  filter-name; ... } }}

vlans { vlan-name { forwarding-options { filter{ input  filter-name output  filter-name; ... } } }}

vlans { vlan-name { mac-limit limit action action; ... }}

vlans { vlan-name { switch-options { interface-mac-limit limit { packet-action action; ... } } }}

vlans { vlan-name { switch-options { interface interface-name { interface-mac-limit limit { packet-action action; ... } } } }}

vlans { vlan-name { mac-table-aging-time seconds; ... }}

protocols { l2-learning { global-mac-table-aging-time seconds; ... }}

ethernet-switching-options { storm-control { (...) }}

forwarding-options { storm-control-profiles profile-name { (...) } }

interfaces interface-name unit number family ethernet-switching { storm-control storm-control-profile;}

interfaces interface-name { ether-options { link-mode mode; speed (auto-negotiation | speed) }}

interfaces interface-name { link-mode mode; speed speed)}

interfaces interface-name { unit logical-unit-number { family ethernet-switching { native-vlan-id vlan-id } }}

interfaces interface-name { native-vlan-id vlan-id}

interfaces interface-name { unit logical-unit-number { family ethernet-switching { port-mode mode } }}

interfaces interface-name { unit logical-unit-number { family ethernet-switching { interface-mode mode } }}

interfaces vlan

interfaces irb

protocols { igmp-snooping { traceoptions  { file filename <filesnumber> <no-stamp> <replace> <sizemaximum-file-size> <world-readable| no-world-readable>; flag flag <flag-modifier> <disable>; } vlan (all| vlan-identifier) { disable; data-forwarding { receiver { install; source-vlans vlan-name; } source { groups ip-address; } } immediate-leave; interface (all| interface-name) { multicast-router-interface; static { group multicast-ip-address; } } proxy { source-address ip-address; } robust-count number; } }}

protocols { igmp-snooping { vlan vlan-name { data-forwarding { receiver { install; source-list vlan-name; translate; } source { groups ip-address; } } immediate-leave; interface (all | interface-name) { group-limit <1..65535> host-only-interface multicast-router-interface; immediate-leave; static { group multicast-ip-address { source <> } } } } l2-querier { source-address ip-address; } proxy { source-address ip-address; } query-interval number; query-last-member-interval number; query-response-interval number; robust-count number; traceoptions  { file filename <filesnumber> <no-stamp> <replace> <sizemaximum-file-size> <world-readable| no-world-readable>; flag flag <flag-modifier>; } } }}

Starting in JunosOS Release 15.1X49-D10 and Junos OS Release 17.3R1, some Layer 2 CLIconfiguration statements are enhanced, and some commands are changed. Table 18 and Table 19 provide lists ofexisting commands that have been moved to new hierarchies or changedon SRX Series Firewalls as part of this CLI enhancement effort. Thetables are provided as a high-level reference only. For detailed informationabout these commands, see CLI Explorer.

bridge-domains bridge-domain--name { ... }}

vlans vlans-name { ... }}

bridge-domains bridge-domain--name { vlan-id-list [vlan-id] ;}

vlans vlans-name { vlan members [vlan-id] ;}

bridge-options { interface interface-name { encapsulation-type; ignore-encapsulation-mismatch; pseudowire-status-tlv; static-mac mac-address { vlan-id vlan-id; } } mac-table-aging-time seconds; mac-table-size { number; packet-action drop; }}

switch-options { interface interface-name { encapsulation-type; ignore-encapsulation-mismatch; pseudowire-status-tlv; static-mac mac-address { vlan-id vlan-id; } } mac-table-aging-time seconds; mac-table-size { number; packet-action drop; }}

bridge { block-non-ip-all; bpdu-vlan-flooding; bypass-non-ip-unicast; no-packet-flooding { no-trace-route; }}

ethernet-switching { block-non-ip-all; bpdu-vlan-flooding; bypass-non-ip-unicast; no-packet-flooding { no-trace-route; }}

family { bridge { bridge-domain-type (svlan| bvlan); ...

family { ethernet-switching { ...

...routing-interface  irb.0;...

...l3-interface irb.0;...

See Also

The Layer 2 Next Generation mode, also called Enhanced Layer 2 Software (ELS), is supported on ACX5048, ACX5096, and ACX5448 routers for configuring Layer 2 features. The Layer 2 CLI configurations and show commands for ACX5048, ACX5096, ACX5448, ACX710, ACX7100, ACX7024, and ACX7509 routers differ from those for other ACX Series routers (ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, and ACX4000) and MX Series routers.

Table 20 shows the differencesin CLI hierarchy for configuring Layer 2 features in Layer 2 nextgeneration mode.

Table 21 shows the differencesin show commands for Layer 2 features in Layer 2 next generationmode.

See Also

Release

Description

15.1X49-D40

Starting in JunosOS Release 15.1X49-D40, use the set protocols l2-learning global-mode(transparent-bridge| switching) command to switch between the Layer 2 transparentbridge mode and Ethernet switching mode.

15.1X49-D10

Starting in JunosOS Release 15.1X49-D10 and Junos OS Release 17.3R1, some Layer 2 CLIconfiguration statements are enhanced, and some commands are changed.