3ca Router

[Lacy Tortelli]

Itsupported on EVE-NG/PNETLAB. Now just waiting somebody from Juniper staff create the template like vJunos-Switch and vJunos-EVO. As i remember the previous template also create by Juniper Internal.

Thanks for your action. My issue was vjunos-router can be spin up. and i'm just tweak template from vjunos-switch. But after finish loading then after 2-3 minutes it will hung. So i think it related to template in EVE-NG not exactly correct. I will wait the correct template from u.

i assume then since i 've used the below options in the template for my AMD machine to boot the vJunosSwitch (not impressed as it's slow in my VM EVE-NG equipment instead of recommended bare metal ), the same options can be applied for the EVE-NG template for vJunosRouter for AMD equipment:

Now on vJunos-Router and vJunos-Switch pending on startup-config script feature. Like vMX-VCP and vQFX-RE it have startup-config script. Hopefully someone expert in .yml can do for vJunos-Router and vJunos-Switch.

A router is in charge of connecting incoming requests to the services that can handle them.In the process, routers may use pieces of middleware to update the request,or act before forwarding the request to the service.

Rules are a set of matchers configured with values, that determine if a particular request matches specific criteria.If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service.

To avoid path overlap, routes are sorted, by default, in descending order using rules length.The priority is directly equal to the length of the rule, and so the longest length has the highest priority.

In Traefik v3 a new rule syntax has been introduced (migration guide).ruleSyntax option allows to configure the rule syntax to be used for parsing the rule on a per-router basis.This allows to have heterogeneous router configurations and ease migration.

The default value of the ruleSyntax option is inherited from the defaultRuleSyntax option in the static configuration.By default, the defaultRuleSyntax static option is v3, meaning that the default rule syntax is also v3.

When a TLS section is specified, it instructs Traefik that the current router is dedicated to HTTPS requests only(and that the router should ignore HTTP (non TLS) requests).Traefik will terminate the SSL connections (meaning that it will send decrypted data to the services).

Even though one might get the impression that a TLS options reference is mapped to a router, or a router rule,one should realize that it is actually mapped only to the host name found in the Host part of the rule.Of course, there could also be several Host parts in a rule, in which case the TLS options reference would be mapped to as many host names.

Another thing to keep in mind is:the TLS option is picked from the mapping mentioned above and based on the server name provided during the TLS handshake,and it all happens before routing actually occurs.

Since a TLS options reference is mapped to a host name,if a configuration introduces a situation where the same host name (from a Host rule) gets matched with two TLS options references,a conflict occurs, such as in the example below:

Most likely the root domain should receive a certificate too, so it needs to be specified as SAN and 2 DNS-01 challenges are executed.In this case the generated DNS TXT record for both domains is the same.Even though this behavior is DNS RFC compliant,it can lead to problems as all DNS providers keep DNS records cached for a given time (TTL) and this TTL can be greater than the challenge timeout making the DNS-01 challenge fail.

The Traefik ACME client library lego supports some but not all DNS providers to work around this issue.The supported provider table indicates if they allow generating certificates for a wildcard domain and its root domain.

If both HTTP routers and TCP routers listen to the same EntryPoint, the TCP routers will apply before the HTTP routers.If no matching route is found for the TCP routers, then the HTTP routers will take over.

For protocols where the server is expected to send first, such as SMTP, if no specific setup is in place,we could end up in a situation where both sides are waiting for data and the connection appears to have hanged.

The only way that Traefik can deal with such a case, is to make sure that on the concerned entry point,there is no TLS router whatsoever (neither TCP nor HTTP),and there is at least one non-TLS TCP router that leads to the server in question.

Rules are a set of matchers configured with values, that determine if a particular connection matches specific criteria.If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service.

It is important to note that the Server Name Indication is an extension of the TLS protocol.Hence, only TLS routers will be able to specify a domain name with that rule.However, there is one special use case for HostSNI with non-TLS routers:when one wants a non-TLS router that matches all (non-TLS) requests,one should use the specific HostSNI(`*`) syntax.

3a8082e126