I have a Cisco Nexus that has a few vlans on it - total network size is split into /24 vlans - each using the third octet as the vlan ID. It's IP is 172.26.x.254 on each vlan as the default gateway.

I have a Juniper SRX cluster, with one of the reth interfaces connected on, with interface subnet of /20.

On the Juniper, i have also configured a static route of which points at the Nexus as next hop.

From the SRX, i can ping the Nexus on it's addresses of the .64 range.

However, i cannot ping anything on the .66.x range, or .67.x range, and nothing can ping the SRX UNLESS it is on the .64.x vlan.

My question is this...

I removed the following route from the SRX:

set routing-options static route next-hop

and replaced it with:

set routing-options static route next-hop set routing-options static route next-hop set routing-options static route next-hop set routing-options ....

That now works - e.g. from a host on 172.26.66.x network, i can ping the SRX on and vice versa.

Why? is this a defect\bug in JUNOS?

For note - The Juniper version is 15.1X49-D30.3

  • so if you revert back the issue still occurs right? can you share the rt during that instance. also share the config or routing-options with pipe display-inheritance to make sure nothing is being carried from a group config
    – DRP
    Commented Feb 15, 2018 at 19:18
  • Yes, correct - reverting it back shows the issue. Tried it a few times with continuous ping. There is no group config - it's a fresh build\config. I cant get the routing table currently, however it is as simple as above. Commented Feb 15, 2018 at 20:14
  • Have you tried changing the subnet on your reth interface to a /24?
    – A-A-Ron
    Commented Feb 15, 2018 at 20:40
  • No, but that's it! All hosts on any vlan are set as /24, and the SRX should be no different in this case. I will give it a go if I can when I'm back at that network. Then, if it needs to get to the other vlans the Nexus will accommodate it. Cheers! Commented Feb 15, 2018 at 21:29
  • @A-A-Ron another great comment you should convert to an answer. :-)
    – user36472
    Commented Feb 16, 2018 at 10:20

1 Answer 1


Change the subnet mask on your reth interface from a /20 to a /24.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.