• I have a SRX345 firewall that has a workstation hanging off one of its ethernet ports.
  • The workstation cannot ping the SRX reth interface, reth1.50 (its default gw) even though the ethernet port is configured as access and in vlan 50.
  • The workstation and reth1.50 are in the same subnet and security zone.
  • There is also in intrazone security policy
  • Reth1.50 has host-inbound system service ping.
  • What am I missing? Thanks in advance!
  • Please add the (sanitized) configuration to your question, as text using the editor's {} option. We cannot just guess what you did wrong.
    – Zac67
    Jun 13, 2023 at 6:48

1 Answer 1


A reth interface on the SRX is a Layer 3 interface - that is to say that VLAN tags are only added to traffic from a reth interface as it egresses the physical port(s) you have bound it to - it does not interact with VLANs configured on the SRX in any way.

If you are just trying to provide a gateway to your workstation, create an irb interface, bind it to your VLAN and add it to the required security-zone eg:

set interfaces irb unit 50 family inet address
set vlans v50 vlan-id 50
set vlans v50 l3-interface irb.50
set security zones security-zone WORKSTATIONS interfaces irb.50

(though I would advise using a VLAN tag other than 50 since it is being used elsewhere on your network).

Alternatively, connect the workstation to a switch downstream from the SRX that the reth is connected to in VLAN 50 and it will be able to route via the reth1.50 interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.