# Junos Network Interface Configuration

> Chapter 7 of the Courseiva JUNIPER-JNCIA-JUNOS curriculum — https://courseiva.com/learn/juniper-jncia-junos/junos-network-interface-configuration

**Official objective:** 3.1 — Configure and verify physical and logical interfaces (including Ethernet, aggregated, and loopback).

## Introduction

How do you tell a router which cable is for the internet, which is for the office printer, and which is for the backup link? In JNCIA-JUNOS, you configure physical and logical interfaces to make those decisions, and this chapter shows you exactly how to set up Ethernet ports, combine several cables into one super-fast link, and create a loopback interface that never goes down.

## The Letterbox with Multiple Slots Analogy

The letterbox at the front of an office building is a single physical object, but it has multiple slots on the inside that separate mail for different departments. This single letterbox serves as the one point where the postal worker delivers all letters, but each letter is sorted into its own compartment based on the department name written on the envelope. The physical letterbox is the hardware interface, and each slot is a logical unit — a separate address for a different purpose.

The building manager decides how many slots the letterbox has and which slot belongs to which department. If the manager wants more departments to receive mail, they can install a bigger letterbox with more slots, or they can combine several letterboxes into a single larger sorting system. The slots can be labelled with department codes, and the manager can configure rules about who can put mail into each slot or how often the slots are emptied.

Just like the building manager configures the letterbox to suit the needs of the office, a network engineer configures the physical and logical interfaces on a Juniper device to control how data enters and leaves the network. The physical port on the router is the letterbox hole, and the logical interface — like the loopback or an aggregated link — is the individual sorting slot that directs traffic to the correct virtual destination.

## Core explanation

A network interface is the point where a device connects to a network — it is the doorway through which data enters or leaves a router, switch, or firewall. On a Juniper device running Junos OS, every interface has two parts: a physical layer (the actual hardware port you can touch, like an RJ45 socket or an SFP cage) and a logical layer (the software configuration that gives that port an identity, an IP address, and rules for handling traffic).

Physical interfaces are the actual ports on the hardware. They are named using a convention that tells you exactly where the port is located on the device. On most Juniper devices, the interface name looks like `ge-0/0/0`, where `ge` means Gigabit Ethernet (the speed and type), the first number (`0`) is the Flexible PIC Concentrator (FPC) slot — basically a card inside the chassis — the second number (`0`) is the Physical Interface Card (PIC) slot on that card, and the third number (`0`) is the actual port number on that card. For example, `ge-0/0/3` is the fourth Gigabit Ethernet port on the first card in the first slot. Other common interface prefixes include:

- `ge-` for Gigabit Ethernet (1 Gbps)
- `xe-` for 10 Gigabit Ethernet (10 Gbps)
- `et-` for 100 Gigabit Ethernet (100 Gbps)
- `lo0` for the loopback interface (a virtual interface with no physical port)
- `ae` for aggregated Ethernet (a bundle of multiple physical ports acting as one link)

Logical interfaces are a way to use a single physical port for multiple purposes. A physical interface can have multiple logical units, each with its own IP address, VLAN tag, and firewall filter. These logical units are called sub-interfaces and are numbered with a unit number. For example, `ge-0/0/0.10` means logical unit 10 on the physical port `ge-0/0/0`. You might use unit 10 for the finance department and unit 20 for the HR department, even though both share the same physical cable. The Junos OS separates traffic at the logical level using VLAN tags (802.1Q), which are like labels stuck on each data packet that tell the router which logical interface should handle it.

The loopback interface (`lo0`) is a special logical interface that exists only in software — it has no physical cable. It is always up as long as the device is running, which makes it perfect for management and routing protocols (like OSPF or BGP) that need a stable, always-available IP address to communicate with other routers. Routers use loopback IPs as their router ID, which is like a fixed phone number that never changes even if physical cables are disconnected.

Aggregated Ethernet (`ae`) interfaces allow you to combine up to 16 physical Ethernet ports into one single logical link. This provides two benefits: more total bandwidth (1 Gbps + 1 Gbps = 2 Gbps, effectively) and redundancy — if one physical cable fails, traffic automatically uses the remaining cables without disruption. The Junos OS uses the Link Aggregation Control Protocol (LACP) to negotiate the bundle between the two devices at each end of the link. LACP sends control messages between the switches to ensure both sides agree on which ports belong to the bundle.

To configure an interface, you enter configuration mode in Junos (the CLI) and edit the `interfaces` hierarchy. For a basic physical interface, you set the unit number, the family (usually `inet` for IPv4 or `inet6` for IPv6), and the IP address. For an aggregated interface, you first create the `ae` interface with the same family and IP, then assign physical member ports to it by setting their `ether-options` to use the `ae` bundle. For a loopback, you simply configure an IP address on `lo0.0` (usually with a /32 mask, meaning just that single IP address).

Why does all this matter? Without interface configuration, the router has no way to know which data belongs to which network. Every data packet arrives at a physical port, but the router uses the logical interface to decide where to send it next. By organising interfaces logically, you can separate different types of traffic (voice, video, data), apply different security policies to each, and keep your network running even when a single cable breaks.

## Real-world context

You are a junior network engineer at a small e-commerce company that runs its website and support tools from a single office. The company has two internet connections from different providers for redundancy, plus a dozen office PCs, a few servers, and a printer. The boss wants the website to always stay online, even if a cable gets cut, and wants the finance team’s traffic kept separate from the guest Wi-Fi because of data privacy rules.

First, you identify the physical interfaces on the Juniper SRX firewall. Port ge-0/0/0 connects to ISP A, ge-0/0/1 connects to ISP B, and ge-0/0/2 connects to the office switch. You configure each physical interface with the correct speed and duplex settings (auto-negotiation usually works, but sometimes you set them manually if the device at the other end is old). On each interface, you create logical units. For example, on ge-0/0/2 (the office switch link), you create multiple logical units:

- Unit 10 for the finance VLAN (tag 10) with IP 192.168.10.1/24
- Unit 20 for the general office VLAN (tag 20) with IP 192.168.20.1/24
- Unit 30 for guest Wi-Fi (tag 30) with IP 192.168.30.1/24

Next, you decide to use aggregated Ethernet for the link between the firewall and the core switch. You have two cables linking them — ge-0/0/2 and ge-0/0/3. You create an `ae0` interface with IP 10.0.0.1/30, and then set both ge-0/0/2 and ge-0/0/3 as member links of ae0 by configuring `ether-options 802.3ad ae0` on each. You also enable LACP on both devices so they automatically negotiate the bundle. Now if one cable fails, traffic flows through the other without any interruption — the finance team won’t even notice.

Finally, you configure the loopback interface lo0.0 with IP 10.255.255.1/32. You use this IP as the router ID for OSPF routing protocol, so if one internet link goes down, the router can still communicate with the ISP’s backup router using the loopback address. You also use the loopback IP to reach the firewall for management (SSH access) because even if all physical interfaces lose connectivity momentarily, the loopback stays up and the management session doesn’t drop.

When you verify the configuration, you use commands like `show interfaces terse` to list all interfaces and their statuses, `show interfaces ge-0/0/0 extensive` for detailed error counters, and `show lacp interfaces` to confirm the aggregated link is working. If something is wrong — say, a cable is unplugged — the interface shows `down` in the output. If the VLAN tag on the switch doesn’t match the unit on the firewall, traffic for that VLAN will simply disappear, and you troubleshoot by checking the unit configuration and the VLAN tags.

## Exam focus

The JNCIA-JUNOS exam loves to test the structure of interface naming and the difference between physical and logical interfaces. Expect at least 4 to 6 questions directly on this topic. The exam is very literal — it expects you to know the exact command syntax and the precise meaning of each parameter. Any configuration you see in a multiple-choice scenario will be deliberately mangled with a common mistake (like forgetting the unit number or using the wrong address family).

Key concepts the exam tests heavily:

- Interface naming convention: You must know that `ge-0/0/1` refers to Gigabit Ethernet, FPC 0, PIC 0, Port 1. The exam may give you a name like `xe-2/1/4` and ask which slot the card is in (answer: FPC 2).
- The difference between the physical interface (`ge-0/0/0`) and the logical interface (`ge-0/0/0.0`): the exam will show a configuration that omits the `.0` unit and ask what is missing.
- The loopback interface is always `lo0`, and it must have a unit (usually `.0`) and an IP address with a /32 mask. The exam might test that loopback interfaces never go down as long as the router is on.
- Aggregated Ethernet: you must know that you create the `ae` interface first, then assign physical interfaces as members using `ether-options 802.3ad aeX`. The exam loves to test the order of operations — you cannot assign a member port before the ae interface exists.

Trap patterns the exam sets:
- They give you a scenario with an aggregated interface but show the physical member ports configured with an IP address (which they should not have — only the ae interface gets an IP).
- They list an interface as `lo0/0/0` (wrong format — loopback has no FPC/PIC/port).
- They show `set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.1/24` but accidentally set the unit number to 0 when it should be 0 (that is actually correct, but they might change the unit number to 10 without a VLAN tag, which would be valid but confusing).
- They test the show commands: `show interfaces terse` gives all interfaces, `show interfaces ge-0/0/0 extensive` gives detailed counters and errors, `show ethernet-switching interfaces` is only for switch interfaces.

Key definitions to memorise exactly:
- Physical interface: the hardware port (e.g., `ge-0/0/0`)
- Logical interface: the unit under the physical interface (e.g., `ge-0/0/0.10`)
- Family: the type of addresses the interface handles (e.g., `inet`, `inet6`, `iso`)
- Unit: the logical subinterface number (0 to 16385)
- Aggregated Ethernet: a bundle of physical links (`ae0`, `ae1`, etc.)
- LACP: the protocol that negotiates the aggregated bundle
- Loopback: a virtual interface (`lo0`) with no hardware dependencies

## Step by step

1. **Identify the physical interface** — Determine which hardware port you need to configure by looking at the device's front panel or using 'show interfaces terse' to list all available ports. Note the interface type (ge, xe, et) and its FPC/PIC/port numbers because you will use these exactly in the configuration.
2. **Enter configuration mode and create the interface hierarchy** — Enter 'configure' in the Junos CLI, then navigate to 'edit interfaces interface-name'. This puts you in a sub-hierarchy where you will add the logical unit, family, and address. For example, 'edit interfaces ge-0/0/0' prepares you to edit that specific physical port.
3. **Specify the logical unit and address family** — Create a unit number (like 'unit 0' or 'unit 10') and set the family to 'inet' for IPv4. Under the unit, assign the IP address with the correct subnet mask in CIDR notation (e.g., 'address 192.168.1.1/24'). This step defines the logical identity of the interface.
4. **Configure aggregated Ethernet (if needed)** — If you want to bundle multiple physical ports, first create the ae interface (e.g., 'set interfaces ae0 unit 0 family inet address 10.0.0.1/30'). Then, on each member physical interface (ge-0/0/1, ge-0/0/2), set 'ether-options 802.3ad ae0' to bind them to the bundle. Do not assign IP addresses to the member ports.
5. **Set the loopback interface** — Edit 'interfaces lo0' and add unit 0 with an IP address using a /32 mask (e.g., 'address 10.255.255.1/32'). The loopback interface typically does not use VLAN tags. This IP becomes a stable identifier for the router.
6. **Commit the configuration and verify** — Type 'commit' to apply the configuration. Then use 'show interfaces terse' to confirm all interfaces are present and 'show interfaces interface-name extensive' to check for errors. Verify that the loopback is reachable with 'ping 10.255.255.1' from the router itself.

## Comparisons

### Physical Interface vs Logical Interface

**Physical Interface:**
- Represents the hardware port you can plug a cable into
- Cannot have an IP address directly attached
- Named like ge-0/0/0 without a unit suffix

**Logical Interface:**
- Is a software-defined sub-interface under a physical port
- Always has an IP address and unit number
- Named like ge-0/0/0.10 with a unit suffix

### Aggregated Ethernet (ae) vs Single Physical Interface

**Aggregated Ethernet (ae):**
- Combines multiple physical ports into one logical link
- Provides redundancy if one cable fails
- Requires LACP to negotiate the bundle

**Single Physical Interface:**
- Uses one cable only
- Single point of failure if cable is cut
- No negotiation protocol needed for speed

### Loopback Interface (lo0) vs Physical Interface (e.g., ge-0/0/0)

**Loopback Interface (lo0):**
- Virtual interface with no hardware dependency
- Always up as long as the router is powered
- Typically configured with a /32 mask

**Physical Interface (e.g., ge-0/0/0):**
- Tied to a physical port and cable
- Goes down if cable is unplugged or device at the other end fails
- Uses a network mask like /24 or /30

### ge- (Gigabit Ethernet) vs xe- (10 Gigabit Ethernet)

**ge- (Gigabit Ethernet):**
- Supports speeds up to 1 Gbps
- Uses cheaper copper or fibre optics
- More common in smaller networks

**xe- (10 Gigabit Ethernet):**
- Supports speeds up to 10 Gbps
- Typically requires fibre optic connections
- Used for high-bandwidth backbones

## Diagram

_This diagram shows how physical interfaces connect to logical units, how aggregated Ethernet bundles multiple ports, and how the loopback interface stands alone._

```mermaid
flowchart TD
    A[Physical Interface ge-0/0/0] --> B[Logical Unit ge-0/0/0.10]
    A --> C[Logical Unit ge-0/0/0.20]
    B --> D[VLAN 10 - Finance]
    C --> E[VLAN 20 - HR]
    F[Physical Interface ge-0/0/1] --> G[Member of ae0]
    H[Physical Interface ge-0/0/2] --> G
    G --> I[Aggregated Ethernet ae0 - 2Gbps]
    J[Loopback lo0] --> K[Unit lo0.0 - 10.255.255.1/32]
```

## Common misconceptions

- **Misconception:** Physical interfaces and logical interfaces are independent and you configure them separately without any relationship. **Reality:** A logical interface always belongs to a physical interface. You cannot have a logical unit without a parent physical port, except for loopback and other virtual interfaces. (Beginners see the unit number as a separate entity, but in Junos the logical unit is a child of the physical interface; the full interface name always includes the physical prefix.)
- **Misconception:** You can assign an IP address directly to a physical interface (like ge-0/0/0) without creating a logical unit. **Reality:** In Junos, IP addresses are always assigned to logical units (e.g., ge-0/0/0.0), never to the bare physical interface. The physical interface has no IP configuration of its own. (Other operating systems (like Cisco IOS) sometimes allow IP on the physical interface directly, so newcomers assume Junos works the same way.)
- **Misconception:** Aggregated Ethernet interfaces need all member ports to have the same IP address configured. **Reality:** Only the aggregated interface (e.g., ae0) gets an IP address. The member physical ports (e.g., ge-0/0/1) do not have IP addresses — they act as a single logical link. (It feels intuitive to think each cable should have its own address, but aggregated Ethernet treats the bundle as one logical cable.)
- **Misconception:** The loopback interface is just like any other interface and will go down if the router loses power. **Reality:** The loopback interface stays up as long as the device has power and Junos is running. It does not depend on any physical cable being connected. (The name 'loopback' sounds like a looped-back cable, so beginners think it requires a physical connection.)
- **Misconception:** You can change the interface type by renaming ge-0/0/0 to xe-0/0/0 in the configuration. **Reality:** Interface types are determined by the hardware port. You cannot change a Gigabit Ethernet port to a 10 Gigabit port in software — you must use the correct physical port. (Beginners think interface naming is just a label that can be edited, not realising it reflects the actual physical hardware capabilities.)
- **Misconception:** The unit number must always be 0 and you cannot use unit numbers greater than 10. **Reality:** Unit numbers range from 0 to 16385. You can use any number in that range, though best practice is to use small, memorable numbers like 0, 10, 20, 100. (Most lab examples use unit 0, so beginners assume that is the only valid choice.)

## Key takeaways

- A physical interface is the hardware port; a logical interface is the configuration unit where you assign an IP address and VLAN tag.
- Every Junos interface name follows the pattern type-fpc/pic/port.unit, like ge-0/0/0.10.
- The loopback interface lo0 is always up and has no physical cable, making it ideal for router IDs and management IPs.
- Aggregated Ethernet (ae) combines multiple physical ports into one logical link for more bandwidth and redundancy.
- LACP is the protocol that devices use to negotiate and maintain an aggregated Ethernet bundle.
- You can configure multiple logical units on one physical port to separate traffic by VLAN, each with its own IP address.
- Show commands like 'show interfaces terse' and 'show interfaces ge-0/0/0 extensive' are essential for verifying configuration and troubleshooting.
- An interface must be in the 'up' state (both administrative and operational) for traffic to flow; 'down' or 'disabled' means no data passes.

## FAQ

**What is the difference between a physical interface and a logical interface in Junos?**

A physical interface is the actual hardware port (like ge-0/0/0), while a logical interface is a sub-interface under that port (like ge-0/0/0.10) where you assign IP addresses, VLAN tags, and firewall filters.

**Can I assign an IP address directly to ge-0/0/0 without adding .0?**

No. In Junos, IP addresses must be configured under a logical unit (e.g., ge-0/0/0.0). The bare physical interface does not accept IP address configuration.

**How do I combine two physical ports into one faster link on a Juniper router?**

Create an aggregated Ethernet interface (ae0), assign it an IP address, then configure each physical member port with 'ether-options 802.3ad ae0'. Use LACP to ensure both ends agree on the bundle.

**What is the loopback interface used for?**

The loopback interface (lo0) provides a stable IP address that never goes down, used for router ID, management access, and routing protocol peering.

**What does 'show interfaces terse' tell me?**

It shows a quick overview of all interfaces on the device, including their status (up/down), protocol family, and IP address. It is the first command to run when troubleshooting connectivity.

**Why does my interface show 'down' even though the cable is plugged in?**

The interface may be administratively disabled (configured with 'disable'), the cable might be faulty, the device at the other end might be powered off, or the speed/duplex settings could be mismatched. Check 'show interfaces ge-0/0/0 extensive' for error counts.

## Check your understanding

1. **What command would you use to see a list of all interfaces on a Juniper device including their IP addresses and status?**

   Answer: You use 'show interfaces terse' in operational mode.

2. **What does the interface name xe-0/1/2 tell you about the hardware?**

   Answer: It is a 10 Gigabit Ethernet interface (xe) on FPC 0, PIC 1, and port 2.

3. **What is the purpose of the loopback interface and why is it used as the router ID?**

   Answer: The loopback interface (lo0) is a virtual interface that never goes down, so it provides a stable IP address for router ID and routing protocol peering, unaffected by physical link failures.

4. **How do you configure aggregated Ethernet on a Juniper router?**

   Answer: First create the ae interface with an IP address (e.g., 'set interfaces ae0 unit 0 family inet address 10.0.0.1/30'), then on each member physical port configure 'set interfaces ge-0/0/1 ether-options 802.3ad ae0'.

5. **What is the difference between the physical interface status and the logical interface status when a cable is unplugged?**

   Answer: Both the physical and logical unit statuses show as 'down' because the logical unit depends on the physical interface being up. The physical interface shows 'down' for both admin and operational status.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/juniper-jncia-junos/junos-network-interface-configuration