3

I am working with a Juniper SRX 240 as an aggregation routing device, it connects a Desktop (Workstation) environment over an access switch port to several (4) server environments behind Cisco Layer 2 switches which are connected via trunk ports to the Juniper SRX. Hence

Laptop <-- access port --> Juniper SRX 240 <-- trunk port --> Cisco Layer 2 <-- trunk port --> Brocade Switch <-- access port --> Servers

I have configured the necessary RVIs for the VLANs, static routes for the VLANs and security policies and host-inbound-traffic etc. I can ping from the laptop to the RVIs only, on the Juniper CLI I can ping the laptop and can also ping the server gateways on the Brocade switch (Via the Trunk port over the Cisco switch).

My problem is this, I cannot ping from the laptop to the Servers hanging off the brocade switch. I am unsure what is causing this, do I need another security policy for the different VLANs residing on the Brocade switch?

    version 12.1X45.5;
system {
    root-authentication {
        encrypted-password "encrypted-password"; ## SECRET-DATA
    }
    name-server {
        8.8.8.8;
        8.8.8.8;
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
        dhcp {
            router {
                192.168.1.1;
            }
            pool 192.168.1.0/24 {
                address-range low 192.168.1.2 high 192.168.1.254;
            }
            propagate-settings ge-0/0/0.0;
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0;
    }
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members LAPTOPS;
                }
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ vlan-trust AREA0 ];
                }
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ vlan-trust AREA1 ];
                }
            }
        }
    }
    ge-0/0/4 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ vlan-trust AREA2 ];
                }
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ vlan-trust AREA3 ];
                }
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/8 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/9 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/10 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/11 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/12 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/13 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/14 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/15 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
        unit 32 {
            family inet {
                address 192.168.32.1/24;
            }
        }
        unit 33 {
            family inet {
                address 192.168.33.1/24;
            }
        }
        unit 34 {
            family inet {
                address 192.168.34.1/24;
            }
        }
        unit 35 {
            family inet {
                address 192.168.35.1/24;
            }
        }
        unit 36 {
            family inet {
                address 192.168.36.1/24;
            }
        }
    }
}
routing-options {
    static {
        route 192.168.33.0/24 next-hop 192.168.33.2;
        route 192.168.208.0/24 next-hop 192.168.33.2;
    }
}
protocols {
    stp;
}
security {
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone Area to-zone Area {
            policy Area-to-Area {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            tftp;
                        }
                    }
                }
            }
        }
        security-zone Area {
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
            interfaces {
                vlan.32;
                vlan.33;
                vlan.34;
                vlan.35;
                vlan.36;
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
                ge-0/0/2.0;
                ge-0/0/3.0;
                ge-0/0/4.0;
                ge-0/0/5.0;
            }
        }
    }
}
vlans {
    AREA0 {
        vlan-id 33;
        l3-interface vlan.33;
    }
    AREA1 {
        vlan-id 34;
        l3-interface vlan.34;
    }
    AREA2 {
        vlan-id 35;
        l3-interface vlan.35;
    }
    AREA3 {
        vlan-id 36;
        l3-interface vlan.36;
    }
    LAPTOPS {
        vlan-id 32;
        l3-interface vlan.32;
    }
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}
  • Can you post configuration? – Benjamin Dale May 2 '18 at 11:48
  • @BenjaminDale Config attached. My Desktop environment is called LAPTOPS and the Server environment called AREA(0,1,2,3).docs.google.com/document/d/… – Ragna May 2 '18 at 12:44
  • Post the configuration here please, so this question remains relevant after the document is removed from the linked website. – Teun Vink May 2 '18 at 12:52
  • @TeunVink I initially tried this, and it stated I was over the limit by 8000+ characters. I am open to suggestions how to be able to paste the whole config here as requested. – Ragna May 2 '18 at 15:00
  • 1
    I was able to paste the configuration without any errors. – Teun Vink May 2 '18 at 15:11
1

So I see a couple of odd things:

  • You have a static route (192.168.33.0/24) to a host in the same directly attached subnet (vlan.33) - delete this.
  • You also have L2 interfaces configured under your Area security zone (ge-0/0/1-5) delete these as well - security zones only require L3 interfaces.

If your servers are in the 192.168.208.0/24 range and on the other side of the Brocade, you will need to make sure that the Brocade has a static route pointing to the Laptop VLAN 192.168.32.0/24 with a next-hop of 192.168.33.1 for return traffic.

  • that was spot on! I added a static route pointing back to the laptop VLAN and can now ping the laptop from the Brocade. Although the laptop is still unable to ping the servers, I think this is down to the static route for 192.168.208.0/24 to 172.16.33.2 which is the gateway for VLAN 33 on the Brocade, I will change this to 172.16.33.1 instead which is the gateway on the Juniper for VLAN 33. – Ragna May 4 '18 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.