2

I've been doing some work on the Juniper SRX210 firewalls/routers, and I have been making progress in learning the ins and outs of the OS, but I am having a bit of an issue with BGP.

I currently have the two SRXs connected via ge-0/0/0, both configured for inet on the 10.0.0.0/24 subnet. I also created a static route (unnecessary here), just in case. I can ping in both directions. I also created some loopback addresses on one of the SRXs (lets call it SRX2). I want to export those addresses via BGP to the other SRX (SRX1).

To avoid confusion, I created my security zones and policy settings with basically an all allow setup because I don't want to introduce security yet.

My issue is that I am stuck in the BGP connect state (occasionally goes into active), and I can't seem to get it established. I am wondering if there is some security setting that I left in there that would block me?

version 11.4R5.5;
system {
    host-name SRX210Bottom;
    root-authentication {
        encrypted-password "$1$P1EoZ8l8$kDeaHpuxfNAhza8Z.5jsz/"; ## SECRET-DATA
    }
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0;
    }
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 10.0.0.2/24;
            }
        }
    }
    fe-0/0/2 {
        unit 0 {
            family ethernet-switching;
        }
    }
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/3 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/4 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/5 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/6 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/7 {
        unit 0 {
            family ethernet-switching;
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 20.0.0.2/24;
                address 30.0.0.1/24;
            }
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 10.0.0.1;
    }
    aggregate {
        route 30.0.0.0/16;
    }
    router-id 10.0.0.2;
    autonomous-system 65503;
}
protocols {
    bgp {
        group external-peers {
            type external;
            local-address 10.0.0.2;
            import bgp-import-all;
            export bgp-export-local;
            peer-as 65501;
            local-as 65503;
            neighbor 10.0.0.1;
        }
    }
}
policy-options {
    policy-statement bgp-export-local {
        term 1 {
            from {
                route-filter 20.0.0.0/24 exact;
            }
            then accept;
        }
        term 2 {
            from protocol aggregate;
            then accept;
        }
    }
    policy-statement bgp-import-all {
        term 1 {
            from {
                protocol bgp;
                route-filter 0.0.0.0/0 orlonger;
            }
            then accept;
        }
    }
}
security {
    policies {
        from-zone internal to-zone internal {
            policy allow-all {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone internal {
            address-book {
                address network_mine 10.0.0.0/24;
                address network_loopback 20.0.0.0/24;
            }
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ssh;
                            all;
                        }
                    }
                }
                lo0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ssh;
                            all;
                        }
                    }
                }
            }
        }
    }
}

version 10.4R3.4;
system {
    host-name SRX210Top;
    root-authentication {
        encrypted-password "$1$P1EoZ8l8$kDeaHpuxfNAhza8Z.5jsz/"; ## SECRET-DATA
    }
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0;
    }
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 10.0.0.1/24;
            }
        }
    }
    fe-0/0/2 {
        unit 0 {
            family ethernet-switching;
        }
    }
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/3 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/4 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/5 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/6 {
        unit 0 {
            family ethernet-switching;
        }
    }
    fe-0/0/7 {
        unit 0 {
            family ethernet-switching;
        }
    }
}
routing-options {
    static {
        route 20.0.0.0/24 next-hop 10.0.0.2;
    }
    router-id 10.0.0.1;
    autonomous-system 65501;
}
protocols {
    bgp {
        group external-peers {
            type external;
            local-address 10.0.0.1;
            import bgp-import-all;
            export bgp-export-all;
            peer-as 65503;
            local-as 65501;
            neighbor 10.0.0.2;
        }
    }
}
policy-options {
    policy-statement bgp-export-all {
        term 1 {
            from {
                route-filter 0.0.0.0/0 orlonger;
            }
            then accept;
        }
        term 2 {
            then accept;
        }
    }
    policy-statement bgp-import-all {
        term 1 {
            from {
                protocol bgp;
                route-filter 0.0.0.0/0 orlonger;
            }
            then accept;
        }
    }
}
security {
    zones {
        security-zone internal {
            address-book {
                address network_mine 10.0.0.0/24;
                address network_loopback 20.0.0.0/24;
            }
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ssh;
                            all;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone internal to-zone internal {
            policy allow-all {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}
  • Removed the off-topic request for resources. You also need to edit your question to include your configurations. – Ron Maupin Feb 12 '17 at 17:35
  • Will do. Unfortunately I am in the office and away from my devices, but will add it as soon as possible. Just in the meantime if anyone has any suggestions... – Dmitriy Feb 12 '17 at 17:43
  • Configs added. Thanks in advance to anyone with any ideas. – Dmitriy Feb 12 '17 at 22:54
  • Hi Dimitry, config is only from one device. Could you please turn on bgp debug and provide output. – Datagram.Network Feb 13 '17 at 0:36
2

A couple of things - your major issue is that you aren't allowing bgp under your host-inbound-traffic - think of this is like an ACL directly to your interface IP addresses.

Fix this with:

set security zones security-zone internal host-inbound-traffic protocols bgp

A couple of other things I spot:

  • your loopback address should be a /32, not a /24 - it doesn't provide access to other hosts in that subnet.
  • there is no need for the BGP import policy - the default behaviour for EBGP is to accept all BGP routes

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.