I've been doing some work on the Juniper SRX210 firewalls/routers, and I have been making progress in learning the ins and outs of the OS, but I am having a bit of an issue with BGP.
I currently have the two SRXs connected via ge-0/0/0, both configured for inet on the 10.0.0.0/24 subnet. I also created a static route (unnecessary here), just in case. I can ping in both directions. I also created some loopback addresses on one of the SRXs (lets call it SRX2). I want to export those addresses via BGP to the other SRX (SRX1).
To avoid confusion, I created my security zones and policy settings with basically an all allow setup because I don't want to introduce security yet.
My issue is that I am stuck in the BGP connect state (occasionally goes into active), and I can't seem to get it established. I am wondering if there is some security setting that I left in there that would block me?
version 11.4R5.5;
system {
host-name SRX210Bottom;
root-authentication {
encrypted-password "$1$P1EoZ8l8$kDeaHpuxfNAhza8Z.5jsz/"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http {
interface vlan.0;
}
https {
system-generated-certificate;
interface vlan.0;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
interfaces {
ge-0/0/0 {
unit 0;
}
ge-0/0/1 {
unit 0 {
family inet {
address 10.0.0.2/24;
}
}
}
fe-0/0/2 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/2 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/3 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/4 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/5 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/6 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/7 {
unit 0 {
family ethernet-switching;
}
}
lo0 {
unit 0 {
family inet {
address 20.0.0.2/24;
address 30.0.0.1/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 10.0.0.1;
}
aggregate {
route 30.0.0.0/16;
}
router-id 10.0.0.2;
autonomous-system 65503;
}
protocols {
bgp {
group external-peers {
type external;
local-address 10.0.0.2;
import bgp-import-all;
export bgp-export-local;
peer-as 65501;
local-as 65503;
neighbor 10.0.0.1;
}
}
}
policy-options {
policy-statement bgp-export-local {
term 1 {
from {
route-filter 20.0.0.0/24 exact;
}
then accept;
}
term 2 {
from protocol aggregate;
then accept;
}
}
policy-statement bgp-import-all {
term 1 {
from {
protocol bgp;
route-filter 0.0.0.0/0 orlonger;
}
then accept;
}
}
}
security {
policies {
from-zone internal to-zone internal {
policy allow-all {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
zones {
security-zone internal {
address-book {
address network_mine 10.0.0.0/24;
address network_loopback 20.0.0.0/24;
}
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
ssh;
all;
}
}
}
lo0.0 {
host-inbound-traffic {
system-services {
ping;
ssh;
all;
}
}
}
}
}
}
}
version 10.4R3.4;
system {
host-name SRX210Top;
root-authentication {
encrypted-password "$1$P1EoZ8l8$kDeaHpuxfNAhza8Z.5jsz/"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http {
interface vlan.0;
}
https {
system-generated-certificate;
interface vlan.0;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
interfaces {
ge-0/0/0 {
unit 0;
}
ge-0/0/1 {
unit 0 {
family inet {
address 10.0.0.1/24;
}
}
}
fe-0/0/2 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/2 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/3 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/4 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/5 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/6 {
unit 0 {
family ethernet-switching;
}
}
fe-0/0/7 {
unit 0 {
family ethernet-switching;
}
}
}
routing-options {
static {
route 20.0.0.0/24 next-hop 10.0.0.2;
}
router-id 10.0.0.1;
autonomous-system 65501;
}
protocols {
bgp {
group external-peers {
type external;
local-address 10.0.0.1;
import bgp-import-all;
export bgp-export-all;
peer-as 65503;
local-as 65501;
neighbor 10.0.0.2;
}
}
}
policy-options {
policy-statement bgp-export-all {
term 1 {
from {
route-filter 0.0.0.0/0 orlonger;
}
then accept;
}
term 2 {
then accept;
}
}
policy-statement bgp-import-all {
term 1 {
from {
protocol bgp;
route-filter 0.0.0.0/0 orlonger;
}
then accept;
}
}
}
security {
zones {
security-zone internal {
address-book {
address network_mine 10.0.0.0/24;
address network_loopback 20.0.0.0/24;
}
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
ssh;
all;
}
}
}
}
}
}
policies {
from-zone internal to-zone internal {
policy allow-all {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
}
