2

i would like to know how i can configure juniper "SRX100" switch such that there i can connect two LAN's for inbound traffic and one outbound traffic.

1 Answer 1

3

The basic process is as follows:

  1. Configure your VLANs

    set vlans v100-INTERNAL1 vlan-id 100
    set vlans v101-INTERNAL2 vlan-id 101
    set vlans v102-EXTERNAL vlan-id 102
    
  2. Attach VLANs to switch ports

    set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan-members v100-INTERNAL1
    set interfaces fe-0/0/1 unit 0 family ethernet-switching vlan-members v101-INTERNAL2
    set interfaces fe-0/0/2 unit 0 family ethernet-switching vlan-members v102-EXTERNAL
    
  3. Configure IP Interfaces

    set interfaces vlan unit 100 family inet address 192.168.100.1/24
    set interfaces vlan unit 101 family inet address 192.168.101.1/24
    set interfaces vlan unit 102 family inet address 192.168.102.1/24
    
  4. Attach IP interfaces to VLANs

    set vlans v100-INTERNAL1 l3-interface vlan.100
    set vlans v101-INTERNAL2 l3-interface vlan.101
    set vlans v102-EXTERNAL l3-interface vlan.102
    
  5. Configure a default route

    set routing-options static route 0.0.0.0/0 next-hop 192.168.102.254
    
  6. Create Security Zones

    set security zones security-zone INTERNAL host-inbound-traffic system-services all
    set security zones security-zone EXTERNAL host-inbound-traffic ping
    
  7. Attach IP Interfaces to Security Zones

    set security zones security-zone EXTERNAL interfaces vlan.102
    set security zones security-zone INTERNAL interfaces vlan.100
    set security zones security-zone INTERNAL interfaces vlan.101
    
  8. Create security policies

    set security policies from-zone INTERNAL to-zone EXTERNAL policy PERMIT-OUTBOUND match source-address any destination-address any application any
    set security policies from-zone INTERNAL to-zone EXTERNAL policy PERMIT-OUTBOUND then permit
    set security policies from-zone INTERNAL to-zone INTERNAL policy PERMIT-INTERNAL match source-address any destination-address any application any
    set security policies from-zone INTERNAL to-zone INTERNAL policy PERMIT-INTERNAL then permit
    

Hopefully the topology is fairly self-explanatory - just substitute the IP Addresses you wish to use.

If you are connecting to the Internet on the EXTERNAL network, I would recommend tightening up the security policies to only allow specific subnets out, and specific applications

2
  • does this code works for two inbound coupled together for one output as WAN ?? Jul 3, 2015 at 14:16
  • Yes, with the addition of a security policy from EXTERNAL to INTERNAL, you could easily use this configuration for a WAN connected site. Jul 4, 2015 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.