4

i am replacing a Juniper SSG5 with Screenos against a SRX100 with Junos (12.1X44-D35.5).

I am replacing a virtual router configuration that Looks like this:

                                     +--------------------+
    192.168.0.1/24 --------(fe-0/0/2)| trust-vr           |
(Trust zone network)                 | routing-instance   | 
                                     +--------------------+
                                               |
                                               |
                                               |
                                               |
                                     +---------------------+
   pppoe dynamic ip--------(fe-0/0/0)| untrust-vr          |
(Untrust zone network)               | routing-instance    |
                                     +---------------------+ 

I found a Juniper KB that explains exactly this at http://kb.juniper.net/InfoCenter/index?page=content&id=KB22053

In ScreenOS it is possible to Point static routes inside a VR to another VR (In this example: Inside trust-vr - Target 0.0.0.0/0 - next hop - untrust vr)

According to the Juniper KB with Junos they configure a Frame realy (virtual Interface) on both Virtual Routers.

This Approach has 2 downsides in my opinion:

I Need to configure IP Adresses for the Virtual Routers (okay i could live with that) but more important: The configuration is three times larger (more lines) than with ScreenOS and thus also more complex to troubleshoot.

Is there no "easy way" to just set a Virtual Router as a next-hop in JunOS as it was possible in ScreenOS?

1
  • Gareth answered your question directly, but let me encourage you to consider the lt- interface. Yes, the config is more lines, but IMO that's a false optimization. JunOS configs are almost always going to be longer than ScreenOS ones just due to the nature of JunOS's config language and syntax. Personally, I think having the virtual link on the lt-'s easier to troubleshoot, because its more natural routing behavior and more completely encapsulates the separation between the routing-instances. Reasonable people can differ in their opinions, of course. Nov 21, 2014 at 15:25

1 Answer 1

4

In Junos you can add a route to point at your next routing table. EG If you wanted to route 0.0.0.0/0 to your routing instance called untrust you would use this syntax

set routing-options 0.0.0.0/0 next-table untrust.inet.0

The untrust routing instance is configured using

set routing-instances untrust instance-type virtual-router
set routing-instances untrust interface x.0
set routing-instances routing-options static route 0.0.0.0/0 next-hop x.x.x.x

Then if you did a show route 1.1.1.1 you should see something like this

>show route 1.1.1.1

inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0           *[Static/5] 1d 22:15:55
                      to table untrust.inet.0

untrust.inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0           *[Static/5] 1d 22:14:42
                    > to x.x.x.x via ge-0/0/0.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.