i would like to know how i can configure juniper "SRX100" switch such that there i can connect two LAN's for inbound traffic and one outbound traffic.
1 Answer
The basic process is as follows:
Configure your VLANs
set vlans v100-INTERNAL1 vlan-id 100 set vlans v101-INTERNAL2 vlan-id 101 set vlans v102-EXTERNAL vlan-id 102
Attach VLANs to switch ports
set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan-members v100-INTERNAL1 set interfaces fe-0/0/1 unit 0 family ethernet-switching vlan-members v101-INTERNAL2 set interfaces fe-0/0/2 unit 0 family ethernet-switching vlan-members v102-EXTERNAL
Configure IP Interfaces
set interfaces vlan unit 100 family inet address 192.168.100.1/24 set interfaces vlan unit 101 family inet address 192.168.101.1/24 set interfaces vlan unit 102 family inet address 192.168.102.1/24
Attach IP interfaces to VLANs
set vlans v100-INTERNAL1 l3-interface vlan.100 set vlans v101-INTERNAL2 l3-interface vlan.101 set vlans v102-EXTERNAL l3-interface vlan.102
Configure a default route
set routing-options static route 0.0.0.0/0 next-hop 192.168.102.254
Create Security Zones
set security zones security-zone INTERNAL host-inbound-traffic system-services all set security zones security-zone EXTERNAL host-inbound-traffic ping
Attach IP Interfaces to Security Zones
set security zones security-zone EXTERNAL interfaces vlan.102 set security zones security-zone INTERNAL interfaces vlan.100 set security zones security-zone INTERNAL interfaces vlan.101
Create security policies
set security policies from-zone INTERNAL to-zone EXTERNAL policy PERMIT-OUTBOUND match source-address any destination-address any application any set security policies from-zone INTERNAL to-zone EXTERNAL policy PERMIT-OUTBOUND then permit set security policies from-zone INTERNAL to-zone INTERNAL policy PERMIT-INTERNAL match source-address any destination-address any application any set security policies from-zone INTERNAL to-zone INTERNAL policy PERMIT-INTERNAL then permit
Hopefully the topology is fairly self-explanatory - just substitute the IP Addresses you wish to use.
If you are connecting to the Internet on the EXTERNAL network, I would recommend tightening up the security policies to only allow specific subnets out, and specific applications
-
does this code works for two inbound coupled together for one output as WAN ?? Jul 3, 2015 at 14:16
-
Yes, with the addition of a security policy from EXTERNAL to INTERNAL, you could easily use this configuration for a WAN connected site. Jul 4, 2015 at 0:41