Setup of Connection

I am looking to use my provider Ethernet Connection between our HQ and Branch to do Layer 2 and Layer 3. The Ip addresses I hope to use for the remote are those being advertised to the ISP using BGP. This will help with Internet access. On the other hand, I want the Trust SVR1 and the HQ SVR1 etc to be able to talk to each other. My major problem is "Do I use private IPs, OSPF and VLAN to connect the remote to the HQ over the SP Ethernet (Q-in-Q is allowed)and then route from there. I see this to be a problem since I have to still setup Zoning on the Branch FW. Zones here would include Internet, trust, DMZ. I will also do NAT for the remote and DMZ servers. I am looking for guidance, i can get the commands to implement any suggestions.

  • Unless you have a compelling need to have the broadcast domain extend between the sites, just forget about extending layer-2 between the sites. Having layer-2 between sites can be a lot of trouble with no gain. Today, very little needs this; it has become a layer-3 world. It used to be, "Switch where you can, route where you must," but that is now reversed.
    – Ron Maupin
    Sep 19, 2015 at 21:58
  • Thanks so much Ron. I will have this in mind and minimize L2 as suggested.
    – Bohr
    Sep 22, 2015 at 15:46
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 18:17

1 Answer 1


You've tagged this post Juniper, so I'm assuming those two Firewalls are SRXs of some variety, in which case - just create Zones for each interface as follows:

Internet Zone
HQ Server Zone

Trust/Branch Server Zone
DMZ Zone

Then just write explicit policies (meaning reference Server IPs) to allow traffic between zones. You do not want to extend/tunnel L2 across your Wide-Area Network except in very specific use cases.

Having said all that, the SRX is quite capable of supporting tunnelled L2 as either point-to-point (via L2Circuit-over-MPLS-over-GRE), or multipoint (via VPLS-over-MPLS-over-GRE).

Juniper VPLS example below (uses IPSEC, but this will work fine with GRE once you sort MTU issues):


  • Thanks so much Benjamin for your answer to my question. Yes, these are Juniper SRXs. I will try to minimize l2 broadcast over the wan as you and Ron have commented. My biggest challenge is where to use public IP, HQFW or BranchFW and where to use private. I want to NAT some of the servers on the BranchFW and also have users use the same block of IPs advertised via BGP on the HQCore to have access to the internet. Some servers in the Brach trust zone will talk to some servers in the HQ trust zone but not to the internet.
    – Bohr
    Sep 22, 2015 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.