3

I have a Juniper EX switch, which receives 3 subnets (192.168.1~3.0/24) from a untagged port of upstream switch (I don't have access to that switch). Is it possible to configure the EX switch to put different subnets onto different VLANs ?

I have hosts on my side on all 3 subnets under my switch, they are all connected to access port of VLAN 10. (And the upstream port is also configured as access port VLAN 10)

I would like to have, for instance, VLAN 11 that contains only 192.168.1.0/24 traffic, VLAN 12 that contains only 192.168.2.0/24 traffic, etc. I guess this requires the switch to act as a gateway? I'm not sure how to configure it.

ps. My EX switch is not the gateway of these 3 subnets.

  • Please give some more information on what you are trying to achieve ? Do you have hosts on your side in the subnets ? Are you the L3 GW for the subnet's ? – Pieter Jul 16 '15 at 7:58
  • Updated the question, hope this is clear. – user16626 Jul 16 '15 at 8:57
  • What is your reason for doing this? What are you trying to accomplish?b – Ron Trunk Jul 16 '15 at 12:40
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 3:33
3

It sounds like you're in a bad situation there, and trying to make it worse. Heck, I'm game - the following should get you halfway there:

firewall {
    family ethernet-switching {
        filter SUBNET-TRAFFIC {
            term SUBNET-11 {
                from {
                    source-address {
                        192.168.1.0/24;
                    }
                }
                then vlan v11-NET11;
            }
            term SUBNET-12 {
                from {
                    source-address {
                        192.168.2.0/24;
                    }
                }
                then vlan v12-NET12;
            }
            term SUBNET-13 {
                from {
                    source-address {
                        192.168.3.0/24;
                    }
                }
                then vlan v13-NET13;
            }
        }
    }
}
interfaces {
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                filter {
                    input SUBNET-TRAFFIC;
                }
            }
        }
    }
}

Assuming your uplink interface is ge-0/0/1, the above firewall filter should catch ingress traffic and send it to the correct VLAN (remember to move all your attached devices into their correct VLANs).

As for egress traffic, that won't be so easy. Junos won't allow you to pop tags for multiple VLANs on a single egress interface (which makes sense since you'd have no idea which VLAN to send ingress traffic).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.