4

i am replacing a Juniper SSG5 with Screenos against a SRX100 with Junos (12.1X44-D35.5).

I am replacing a virtual router configuration that Looks like this:

                                     +--------------------+
    192.168.0.1/24 --------(fe-0/0/2)| trust-vr           |
(Trust zone network)                 | routing-instance   | 
                                     +--------------------+
                                               |
                                               |
                                               |
                                               |
                                     +---------------------+
   pppoe dynamic ip--------(fe-0/0/0)| untrust-vr          |
(Untrust zone network)               | routing-instance    |
                                     +---------------------+

I found a Juniper KB that explains exactly this at http://kb.juniper.net/InfoCenter/index?page=content&id=KB22053

In ScreenOS it is possible to Point static routes inside a VR to another VR (In this example: Inside trust-vr - Target 0.0.0.0/0 - next hop - untrust vr)

According to the Juniper KB with Junos they configure a Frame realy (virtual Interface) on both Virtual Routers.

This Approach has 2 downsides in my opinion:

I Need to configure IP Adresses for the Virtual Routers (okay i could live with that) but more important: The configuration is three times larger (more lines) than with ScreenOS and thus also more complex to troubleshoot.

Is there no "easy way" to just set a Virtual Router as a next-hop in JunOS as it was possible in ScreenOS?

Improve this question
1
  • Gareth answered your question directly, but let me encourage you to consider the lt- interface. Yes, the config is more lines, but IMO that's a false optimization. JunOS configs are almost always going to be longer than ScreenOS ones just due to the nature of JunOS's config language and syntax. Personally, I think having the virtual link on the lt-'s easier to troubleshoot, because its more natural routing behavior and more completely encapsulates the separation between the routing-instances. Reasonable people can differ in their opinions, of course.
    – Jeff McAdams
    Nov 21 '14 at 15:25
4

In Junos you can add a route to point at your next routing table. EG If you wanted to route 0.0.0.0/0 to your routing instance called untrust you would use this syntax

set routing-options 0.0.0.0/0 next-table untrust.inet.0

The untrust routing instance is configured using

set routing-instances untrust instance-type virtual-router
set routing-instances untrust interface x.0
set routing-instances routing-options static route 0.0.0.0/0 next-hop x.x.x.x

Then if you did a show route 1.1.1.1 you should see something like this

>show route 1.1.1.1

inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0           *[Static/5] 1d 22:15:55
                      to table untrust.inet.0

untrust.inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0           *[Static/5] 1d 22:14:42
                    > to x.x.x.x via ge-0/0/0.0
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.