0

So im new at juniper and networking. On my Juniper EX4550 switch i want to setup a transfer network to my upstream provider. So my upstream provider assigned a /30 subnet for the transfer network:

Providers site: 5.5.5.17/30 My site: 5.5.5.18/30

So my /24 subnet can routed over the transfer network e.g. 6.6.6.0/24

[upstream] <---> [EX Switch] <---> [Hostsystem] <---> [VM]

On my switch a vlan like 100 and assigned the upstream

interfaces {
    ge-0/0/0 {
        unit 0 {
            description "WAN";
            family ethernet-switching {
                port-mode trunk;
                native-vlan-id 100;
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            description "srv1";
            family ethernet-switching {
                port-mode trunk;
                native-vlan-id 200;
            }
        }
    }
    vlan {
        unit 100 {
            family inet {
                address 5.5.5.18/30;
            }
        }
        unit 200 {
            family inet {
                address 6.6.6.1/24;
            }
        }
    }
    me0 {
        unit 0 {
            family inet {
                address 10.0.0.2/24;
            }
        }
    }
}
vlans {
    wan {
        vlan-id 100;
        l3-interface vlan.100;
    }
    servers {
        vlan-id 200;
        l3-interface vlan.200;
    }
}

My routing table:

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 51w6d
                    > to 10.0.0.2 via me0.0
10.0.0.0/24        *[Direct/0] 47w0d 20:30:42
                    > via me0.0
10.0.0.2/32        *[Local/0] 51w6d 03:41:18
                      Local via me0.0
5.5.5.16/30        *[Local/0] 02:27:50
                      Local via vlan.100
5.5.5.18/32        *[Local/0] 02:27:50
                      Local via vlan.100
6.6.6.0/24         *[Direct/0] 00:23:52
                    > via vlan.200
6.6.6.1/32         *[Local/0] 00:23:52
                      Local via vlan.200

So on my Port ge-0/0/2 i want to connect a server to provide virtual maschines. So in the first step i've created a new vlan 200 for my servers 6.6.6.0/24 and assigned the ip 6.6.6.1/24 to the l3-interface. So i can ping the ip 6.6.6.1 from my virtual maschine or servers. Thats working.

But i don't know exactly how to route the subnet 6.6.6.0/24 over the transfer network 5.5.5.18/30. So from my switch i can ping the providers site.

So the default route 0.0.0.0/0 points to the me0 interface to connect the switch from my vpn. The vpn is directly in the same subnet from me0 Interface. And it is unclear to me how to correctly build the routing for the subnet.

2
  • 1
    Please do not use IP addressing that does not belong to you. IANA has set aside three IPv4 (192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24) and one IPv6 (2001:db8::/32) address ranges that you can use for example addresses. You would not want someone using your addresses, phone numbers, etc. for examples, so please do not do that to others.
    – Ron Maupin
    Nov 27 '21 at 21:56
  • You talk about a VPN connection - what does that connect to?
    – Zac67
    Nov 27 '21 at 22:14
1

The me0 interface is for management traffic and it can't be used to forward/route packets from the data-plane. Think of me0 as an interface you should use only for things like SSH, SNMP, or connecting to an out-of-band management network.

I don't think you actually intended to create that segmentation between management & data plane at this stage. Therefore, keep in mind as you're reading this answer, I'd like to both answer your immediate problem (how to get your VMs talking to the Internet via the upstream on ge-0/0/0) AND to help you continue managing your switch via me0.

The simplest configuration is to assign private IPs to your me0 interface, and for your VPN connectivity to use NAT so your SSH session from home comes from an RFC1918 IP instead of a public IP.

If that's true (show users says you're coming from e.g. a 10.x.x.x IP) you can simply delete your existing default route, and replace it with a new one to your upstream. For example:

        /----------\
        | upstream |
        \----------/
             |
        192.0.2.0/30 (.1 upstream, .2 you) ge-0/0/0
             |
         /--------\                           /-------------\
         | EX4550 |-------me0 10.0.0.2/24-----| vpn gateway |
         \--------/                           |  10.0.0.1   |
                                              \-------------/
                                                    |
                                              /-------------\
                                              | remote user |
                                              |  10.x.x.x   |
                                              \-------------/ 

routing-options {
  rib inet.0 {
    static {
      route 0.0.0.0/0 {
        next-hop 192.0.2.1;
      }
      route 10.0.0.0/8 {
        next-hop 10.0.0.1;
      }
    }
  }
}

Note the remote user won't have Internet connectivity via the upstream and they will not be able to reach the VMs unless the vpn gateway has some routing table configuration as well.

A more advanced configuration would place me0 into a VRF. That is not a topic for a newer network operator, though.

2
  • But its possible to route only the traffic via 0.0.0.0/0 from vlan 200 over vlan 100? So the vm in the vlan 200 shout be routed to the internet over vlan 100 and shout be need to get access to the ip range 10.0.0.0/24. This is possible with rib routing-options? Nov 29 '21 at 15:14
  • It's possible to do, but that is an advanced configuration called Virtual Routing & Forwarding (VRF). It's not a good idea to deploy complex configuration like that into your very first network! Try to keep things simpler while you're learning. Dec 1 '21 at 12:50
0

Routing towards 6.6.6.0/24 from WAN needs to be done by your ISP. Either they set up a static route or you use BGP to advertise the subnet (or any other method you agree upon).

Routing from 6.6.6.0/24 towards WAN simply requires a default route on the hosts pointing to the Juniper's VLAN 200 interface 6.6.6.1/24. The Juniper's default route needs to point to 5.5.5.17, your ISP router.

I don't know where a VPN comes into play - you might need to elaborate.

However, you do need a firewall as well - not for routing but for security. Remember that the Internet is a hostile place and almost all devices need a firewall in front.

2
  • Thank you. But when i changed the static route, so in my case i've tried that my internal network dosen't work. So i cant connect to the switch over my interface ip address that i assigned to me0. I want to go outside from my 6.6.6.0/24 subnet over next hop 5.5.5.17; but my switch with the internal ip 10.0.0.2 shout route the traffic over 10.0.0.1. So that the switch can use ntp or pull updates over the internal network. Nov 27 '21 at 20:30
  • You'll need to add the details - the subnets you use and where they attach - to your question to make sense of it.
    – Zac67
    Nov 27 '21 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.