2

Do you need configure lo0 unit 0 with

set security zones security-zone trust interface lo0.0
set security zones security-zone host-inbound-interfaces system-services ping

Do you have to do this for any security zone interface to accept ANY kind of service (not just pings but routing protocols too)?

Improve this question
2

In the Junos running in flow mode which is the default case, you need to assign the interface to security zone to be functional that inlclude the lo0 interface And for protocols you need to enable the protocols :

Ex: set security zone security-zone trust interface lo0 host-inbound-interfaces protocols ospf
Improve this answer
6
  • Hey, so would it be safe to say, I should just enable EVERYthing for EVERY interface I am planning on using? – JoshGarmon47 Oct 13 '17 at 0:06
  • Basically, Juniper has you configure things that Cisco is already allowing right out of the box? – JoshGarmon47 Oct 13 '17 at 0:07
  • You can enable the protocols either for incoming connections eother on zone level or interface level ...if the interface not assigned to zone you can't even send traffic out of it – Mr.lock Oct 13 '17 at 6:56
  • @JoshGarmon47 this is only relevant to the SRX line which is a security device. You have to remember that on any Juniper box, the loopback is also the logical interface that represents direct connectivity to the routing-engine/control-plane of the box, so filtering all traffic by default is a perfectly sane default setting. – Benjamin Dale Oct 14 '17 at 12:06
  • The problem I'm seeing is my J2320 routers have "SRX Like" attributes to them. I couldn't even get DIRECTLY connected routers to even PING each other until I configured that security zone stuff and allowed ping. – JoshGarmon47 Oct 14 '17 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.