1

This must be insanely simple, but I get errors every time.

I have a very basic setup.

SRX 300

ge-0/0/0 = untrust

ge-0/0/1 though ge-0/0/5 = trust

ge-0/0/0 and 0/0/4 are in use.

I have an access point that can host several SSIDs with a VLAN assigned to each SSID.

I would like to create a VLAN with an assigned DHCP server for unsecured guest Internet only access.

Ideally, this VLAN can be assigned to ge-0/0/4.

I have rolled back all of my changes thus far.

I've tried to include as much relevant information as I could.

root@HSRX300# show interfaces
        ge-0/0/0 {
            unit 0 {
                family inet {
                    address xxx.xxx.xxx.xxx/xx;
                    address xxx.xxx.xxx.xxx/xx;
                }
            }
        }
        ge-0/0/1 {
            unit 0 {
                family inet {
                    address 192.168.1.1/24;
                }
            }
        }
        ge-0/0/2 {
            unit 0 {
                family inet {
                    address 192.168.2.1/24;
                }
            }
        }
        ge-0/0/3 {
            unit 0 {
                family inet {
                    address 192.168.3.1/24;
                }
            }
        }
        ge-0/0/4 {
            unit 0 {
                family inet {
                    address 192.168.4.1/24;
                }
            }
        }
        ge-0/0/5 {
            unit 0 {
                family inet {
                    address 192.168.5.1/24;
                }
            }
        }
        ge-0/0/6 {
            unit 0;
        }
        ge-0/0/7 {
            unit 0;
        }
        st0 {
            unit 1 {
                family inet {
                    mtu 1436;
                    address xxx.xxx.xxx.xxx/xx;
                }
            }
            unit 2 {
                family inet {
                    mtu 1436;
                    address xxx.xxx.xxx.xxx/xx;
                }
            }
        }


        root@HSRX300# show protocols
        l2-learning {
            global-mode switching;
        }

    root@HSRX300# show security zones
    security-zone trust {
        address-book {
            address Some-Server xxx.xxx.xxx.xxx/xx;
            address Some-Server-II xxx.xxx.xxx.xxx/xx;
        }
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
                bgp;
            }
        }
        interfaces {
            ge-0/0/1.0;
            ge-0/0/2.0;
            ge-0/0/3.0;
            ge-0/0/4.0;
            ge-0/0/5.0;
            st0.1;
            st0.2;
        }
    }
    security-zone untrust {
        screen untrust-screen;
        host-inbound-traffic {
            system-services {
                ike;
            }
        }
        interfaces {
            ge-0/0/0.0 {
                host-inbound-traffic {
                    system-services {
                        dhcp;
                        tftp;
                    }
                }
            }
        }
    }
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 5:40
1

Okay, from the top:

  1. I would highly recommend you upgrade code to 15.1X49-D60.7 before you get started.

  2. You'll need to enable switching mode globally on the box (this will require a restart but save it until you've added all the config):

set protocols l2-learning global-mode switching

  1. Next, create your VLAN - let's assume VLAN-ID 4 and a matching irb (routed) interface to go with it. We'll also put the irb interface into the trust security zone so that the host-inbound configuration applies to it:

set vlans WLAN-HOME vlan-id 4

set vlans WLAN-HOME l3-interface irb.4

set interfaces irb unit 4 family inet address 192.168.4.1/24

set security zones security-zone trust interface irb.4

  1. Now, delete your current interface ge-0/0/4, remove it from the trust security zone and re-create it as a switching interface in the new VLAN. NOTE: This assumes that your AP is expecting VLAN 4 to be tagged towards it - you may lose access to the management interface unless you also add a native-vlan-id to this port, which will require another separate VLAN:

delete interfaces ge-0/0/4

delete security zones security-zone trust interface ge-0/0/4.0

set interfaces ge-0/0/4 unit 0 family ethernet-switching interface-mode trunk

set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members WLAN-HOME

  1. Set up a DHCP scope for your new subnet and configure it to serve addresses on irb.4:

set system services dhcp-local-server group jdhcp-group interface irb.4

set access address-assignment pool WLAN-HOME-POOL family inet network 192.168.4.0/24

set access address-assignment pool WLAN-HOME-POOL family inet range junosRange low 192.168.4.10

set access address-assignment pool WLAN-HOME-POOL family inet range junosRange high 192.168.4.80

set access address-assignment pool WLAN-HOME-POOL family inet dhcp-attributes router 192.168.4.1

set access address-assignment pool WLAN-HOME-POOL family inet dhcp-attributes maximum-lease-time 3600

set access address-assignment pool WLAN-HOME-POOL family inet dhcp-attributes name-server 192.168.1.10

  1. Done.
5
  • WHY OH WHY COULD JUNIPER NOT BE THIS THOROUGH AND HELPFUL! I opened a support ticket with them and received nothing as useful as your post. I'll give this a whirl this evening. Nov 30 '16 at 16:15
  • Tested on unused port, changed everything in your code from 4 to 5 (find/replace). Copy and past of your commands to the juniper. root@HSRX300# commit check [edit access address-assignment pool junosDHCPPool1 family] 'inet' Missing mandatory statement: 'network' error: configuration check-out failed: (missing mandatory statements) I had multiple errors prior to deleting the prior dhcp service. Is there a difference between system services dhcp and system services dhcp-local-server? Thanks Nov 30 '16 at 20:43
  • My bad - the last two lines in step 5 were incorrect - edited to fix. And yes - sorry - there are actually two DHCP servers available on the SRX. DHCPD (system services dhcp) and JDHCPD (system services dhcp-local-server). As you have probably gathered, they are mutually exclusive. DHCPD is being phased out, so probably best to stick with the config I've got above for future compatibility. Dec 1 '16 at 10:19
  • @BenjaminDale does propagate-settings irb.4 or propagate-settings ge-0/0/4 need to be added ?
    – enjoy
    Oct 10 '20 at 20:10
  • propagate-settings is only required if you have a DHCP client configured on one of your interfaces (say ge-0/0/0 in your untrust zone) and you want to pass on attributes you receive from the server on that interface to clients of the local DHCP server. An example would be - your ISP gives you a DHCP on your Untrust side, and you want to pass the ISP DHCP server onwards to clients on your LAN side. Oct 12 '20 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.