2.4 IRB Configuration and Packet Walk

Binding VLANs to IRB Interfaces: Step-by-Step Configuration

Configuring inter-VLAN routing on a Junos ELS switch involves three distinct configuration steps:

Step 1: Define the Layer 2 VLANs

Create the VLAN broadcast domains and assign their unique 802.1Q VLAN IDs:

[edit]
user@EX4400# set vlans SALES vlan-id 10
user@EX4400# set vlans ENGINEERING vlan-id 20

Step 2: Configure the Layer 3 IRB Logical Units

Configure the logical units under interfaces irb, assigning the IPv4 default gateway address and subnet mask for each workgroup:

[edit]
user@EX4400# set interfaces irb unit 10 description "Gateway for Sales (VLAN 10)"
user@EX4400# set interfaces irb unit 10 family inet address 192.168.10.1/24

user@EX4400# set interfaces irb unit 20 description "Gateway for Engineering (VLAN 20)"
user@EX4400# set interfaces irb unit 20 family inet address 192.168.20.1/24

Step 3: Bind the IRB Interfaces to Their Respective VLANs

Link the Layer 2 broadcast domain to its Layer 3 gateway using the l3-interface statement under vlans:

[edit]
user@EX4400# set vlans SALES l3-interface irb.10
user@EX4400# set vlans ENGINEERING l3-interface irb.20

Critical Exam Rule: While Junos technically permits assigning arbitrary logical unit numbers (for instance, binding irb.1 to vlan-id 10), standard operational best practice requires matching the unit number directly to the VLAN ID (irb.10 for VLAN 10). More importantly, if you omit the l3-interface irb.<unit> statement under vlans, the IRB interface remains completely disconnected from the broadcast domain. The switch will not listen for or reply to host ARP requests, and inter-VLAN routing will fail completely.

---

MTU and Addressing Considerations on IRB Interfaces

When routing between VLANs, network engineers must manage Maximum Transmission Unit (MTU) boundaries across Layer 2 and Layer 3 interfaces:

Physical MTU vs. Protocol MTU

• Physical Layer 2 MTU: Configured under interfaces ge-0/0/0 mtu <bytes>. By default, standard Ethernet interfaces have an MTU of 1514 bytes (1500-byte IP payload + 14-byte Ethernet header). When 802.1Q tags are added, the frame expands to 1518 bytes. Junos automatically accounts for 802.1Q tag overhead on physical ports.
• Protocol Layer 3 MTU: Configured under interfaces irb unit 10 family inet mtu <bytes>. This dictates the maximum IP packet size permitted without fragmentation. By default, family inet mtu is 1500 bytes.
• Jumbo Frame Environments: In storage (iSCSI/NFS) or high-performance compute VLANs where jumbo frames are enabled, the physical interface MTU must be increased (e.g., set interfaces ge-0/0/0 mtu 9216). To allow unfragmented Layer 3 routing of jumbo packets, the IRB interface MTU must be scaled concurrently (set interfaces irb unit 10 family inet mtu 9000). If the physical MTU is 9216 but the IRB MTU is left at 1500, the switch will fragment outgoing packets larger than 1500 bytes or drop them if the "Don't Fragment" (DF) bit is set.

Secondary IP Addresses on IRB Interfaces

An IRB interface can host multiple IP subnets concurrently using secondary addresses. This is invaluable when migrating an existing subnet or accommodating address exhaustion without provisioning a new VLAN:

[edit interfaces irb unit 10 family inet]
user@EX4400# set address 192.168.10.1/24
user@EX4400# set address 10.10.10.1/24

Do not infer source-address selection from entry order. Junos provides explicit primary and preferred address options; otherwise default selection depends on the address set and destination. Configure these options deliberately during subnet migrations and verify locally sourced traffic.

---

The Inter-VLAN Packet Walk: Step-by-Step Anatomy

To master inter-VLAN routing for the JNCIS-ENT exam, trace the exact end-to-end packet journey between two hosts on different VLANs connected to a multilayer Junos switch:

• Host A: IP 192.168.10.50, MAC AA:AA:AA:11:11:11, Default Gateway 192.168.10.1 (VLAN 10, Port ge-0/0/1).
• Switch IRB Gateway: MAC 00:05:86:71:00:01 (assigned to both irb.10 and irb.20).
• Host B: IP 192.168.20.75, MAC B8:BB:BB:22:22:22, Default Gateway 192.168.20.1 (VLAN 20, Port ge-0/0/2).

Step-by-Step Forwarding Breakdown

1. Subnet Comparison: Host A intends to transmit an IP packet to Host B (192.168.20.75). Host A applies its local subnet mask (255.255.255.0) to both its own IP and Host B's IP. Recognizing that Host B resides on a different network, Host A determines it must send the packet to its default gateway (192.168.10.1).
2. Gateway ARP Resolution: Host A inspects its local ARP cache for 192.168.10.1. If no entry exists, Host A broadcasts an ARP Request into VLAN 10: "Who has 192.168.10.1? Tell 192.168.10.50."
3. Switch ARP Reply: The switch receives the broadcast frame on ge-0/0/1 in VLAN 10. The irb.10 interface intercepts the ARP request and replies with its virtual MAC address: "192.168.10.1 is at 00:05:86:71:00:01."
4. Host A Frame Transmission: Host A encapsulates the IP packet into an Ethernet frame and transmits it out its NIC:
   • Source MAC: AA:AA:AA:11:11:11 (Host A)
   • Destination MAC: 00:05:86:71:00:01 (Switch IRB Gateway)
   • Source IP: 192.168.10.50 (Host A)
   • Destination IP: 192.168.20.75 (Host B)
5. Ingress Processing on Switch: Port ge-0/0/1 ingresses the frame and maps it to VLAN 10. The PFE inspects the Destination MAC address. Because the DMAC matches the switch's local IRB MAC address, the frame is not bridged at Layer 2. The PFE strips the Layer 2 header and passes the IP packet to the Layer 3 route engine in hardware.
6. FIB Route Lookup: The PFE queries the hardware forwarding table derived from the active routes in inet.0. The destination IP 192.168.20.75 matches the directly connected route 192.168.20.0/24, pointing out interface irb.20.
7. TTL Decrement & Checksum Recalculation: The switch decrements the IPv4 Time-to-Live (TTL) field from 64 to 63. Because the IP header has changed, the switch recomputes the IPv4 Header Checksum. (If TTL reached 0, the packet would be dropped and an ICMP Time Exceeded message returned to Host A).
8. Egress ARP Resolution: The switch checks its ARP table for 192.168.20.75 on irb.20. If unlearned, the switch generates an ARP Request out all member ports of VLAN 20. Host B replies, allowing the switch to populate its ARP table with B8:BB:BB:22:22:22.
9. Layer 2 Header Rewrite: The switch encapsulates the IP packet into a completely new Layer 2 Ethernet header:
   • Source MAC: 00:05:86:71:00:01 (Switch IRB Gateway on egress VLAN)
   • Destination MAC: B8:BB:BB:22:22:22 (Host B MAC)
   • Source IP: 192.168.10.50 (Unchanged!)
   • Destination IP: 192.168.20.75 (Unchanged!)
10. Egress Transmission: The frame is forwarded out access port ge-0/0/2 toward Host B as standard untagged Ethernet. Host B receives the frame, verifies its own Destination MAC, and delivers the payload to its application layer.