Questions tagged [juniper-srx]

The Juniper SRX is a series of security services devices running Junos. Security features include the full UTM functionality previously found on ScreenOS, including web filtering, IDP and anti-virus. Although high-end and low-end SRX platforms differ in the underlying hardware, common software base enables feature consistency and signature Juniper routing code.

Filter by
Sorted by
Tagged with
10
votes
3answers
3k views

SRX DHCP client compatibility with HP Procurve DHCP Relay

I am trying to bootstrap the config on some Juniper SRX100s and am having some DHCP issues. Specifically, I am connecting the 0/0 port (fe-0/0/0 in the software) to my existing network, where DHCP ...
9
votes
1answer
3k views

Juniper SRX HA links passing through switch

it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples. Please , help to define correct choice and describe what the ...
7
votes
1answer
15k views

Juniper SRX: Where do I look to see IKE debug messages?

Going through a JSEC book I noticed the following slide explains that there are 6 ike phase 1 messages that take place for a tunnel to establish. I am looking in the kmd log and traceoptions data but ...
7
votes
1answer
1k views

how to create managment access to SRX Lsys.

is there a way to configure separated admins, one for the SRX root lsys and another to a specific lsys? i'm trying to create two users that when you login with user1 you will login to the root lsys ...
7
votes
1answer
2k views

What are some workarounds / fixes for UTM/IDP on Junos 12.1X44-D10.4 for SRX Series branch devices?

The JNCIP / JNCIE-SEC latest courses use 12.1X44-D10.4 as the recommended Junos version. I setup a 30-day evaluation on my home SRX device to study JIPS, based on 12.1. At this point, I'm guessing ...
7
votes
1answer
2k views

Juniper SRX240H loses connectivity to upstream router

I have two SRX240's clustered together. The clustering is configured with 2 redundancy groups and then 3 RETH's. reth1 is connected to our internet connection via ge-0/0/5 and ge-5/0/5. Our internet ...
6
votes
4answers
3k views

DHCPv6 (with PD) client on Juniper SRX

OK, this one may technically be off-topic since I'm actually doing this at home, but I could easily see the exact same scenario arises in a small enterprise type of setup... Using an SRX210 to be a ...
6
votes
2answers
4k views

Juniper SRX240 Clustering - Policy out of sync

I have two Juniper SRX240's in a cluster. After re-ordering some security policies on the primary device and committing them ok I now can not make any other changes without the warning error: Policy ...
6
votes
1answer
2k views

SRX100 in bootloop. Flash storage problem?

About a month ago one of my SRX100 started to go into a bootloop for no obvious reason to me. After some hours, it eventually stopped and booted up the system again (primary) and I was happy that I ...
6
votes
3answers
2k views

How to log out of state sessions on Juniper SRX platform?

I am really having trouble to get our SRXes to log sessions that are not in the state table and get dropped because of that. For example, if you reboot the firewall and some old NFS implementation ...
5
votes
1answer
7k views

Juniper SRX100 and SRX210 goes to factory reset for no reason

We had two SRX210 in a HA cluster, that both accidentely lost power, and when they came up again, the both had lost ALL setup, (similar to a factory reset!), this was very strange and took us som time ...
5
votes
1answer
1k views

Juniper SRX to SRX site-to-site VPN over existing WAN in trust zone

I have a client with 5 sites, each using their own private LAN subnet. They are currently using a service provider to link their branches and for Internet breakout centrally. I need to break them out ...
4
votes
2answers
9k views

Backup IP for site 2 site VPN (Juniper SRX)

We have two separate networks with SRXes on both sides (router, firewall, and site2sitevpn). On one side (Site A), we have two ISPs (BGP), and currently the VPN is setup to the IP address of one of ...
4
votes
2answers
403 views

Juniper SR300 maximum BGP routes

I've got a Juniper SRX300 which i'm using to connect to 2 BGP peers. The documentation i've read says this SRX only supports 300,000 BGP routes, so for each peer I created an import policy (based on ...
4
votes
2answers
734 views

Juniper SRX answers all ping requests instead of forwarding

I have about 4 different subnetworks at my place, when i'm trying to ping to static device in subnetwork1 from subnetwork2 i always see that device pings, even if it's off. I assume my SRX300 answers ...
4
votes
1answer
329 views

Dump traffic on routing-instance with a Juniper SRX firewall

A Juniper firewall can display data with the tcpdump command: % tcpdump -i ge-0/0/0 % tcpdump -i vlan10 However, if the interface or the VLAN is assigned to a routing instance, the traffic is not ...
4
votes
1answer
617 views

IPv6 default route not being installed from RA

Platform: Juniper SRX300 Version: JUNOS 15.1X49-D160.2 ISP: Midco I currently have an issue where the IPv6 default route is not being installed from the CMTS RA. Try as I might, I cannot get ...
4
votes
1answer
805 views

Advertise all static route except the default gateway with Juniper SRX firewall

With the following policy, all static routes are advertised via BGP to my neighbor: root@Nitrogen# show policy-options policy-statement bgp-export-policy { term export-statics { from ...
4
votes
1answer
878 views

Juniper SRX 240 - Routing subsystem not running on secondary node

Does anyone know why rpd would not run on secondary node? Thanks
4
votes
1answer
4k views

Juniper SRX - interface filters vs firewall rules?

I'm trying to display all firewall rule associated with a specific interface. However, the best I can find is show interfaces filters. I'm assuming since these are called "filters", they're not the ...
4
votes
1answer
2k views

Juniper SRX240 unstable uplink when client is connected to VPN

In an office setting, multiple clients (Mac OSX, Ubuntu, iOS, Android and Windows 8) connect to a VPN server in another location. These clients are behind an SRX240B router which is connected to a ...
4
votes
1answer
898 views

SRX240 AppFw block message

I am configuring the AppFw on a SRX240 chassis this works fine to block Facebook or Twitter or whatever application. I also configured a custom block message to redirect a user to a specific web page ...
3
votes
1answer
1k views

Connecting an SRX chassis cluster to redundant upstream WAN links

I've been tasked with migrating some Juniper SSG 140's in an active/passive cluster to an SRX 340 cluster. I'm very familiar with ScreenOS, but am still learning JunOS. Currently, we're connected to ...
3
votes
2answers
429 views

How do you disable IGMP-snooping on virtual nic macvtap

Networking community, Question: How do you disable IGMP-snooping on virtual nic macvtap? Background: We have noticed that Juniper vSRX 15.1X49-D60 (Running on Ubuntu 16.04LTS Server KVM) is ...
3
votes
2answers
4k views

How can I view a list of which MACs an interface is restricted to on a Juniper SRX?

JUNOS has functions for either limiting the number of mac addresses on a port or locking a port to particular mac addresses. I know that I can set filters as: user@switch# set interface all allowed-...
3
votes
1answer
243 views

Juniper SRX3600 Maximum Load Set Size

What is the maximum size load set that a Juniper SRX3600, running Junos 11.4R7.5, can load and commit? I am attempting to add a 100,000+ line commit change and do not want to overwhelm the RE and ...
3
votes
1answer
173 views

Site-2-Site Juniper SRX & Zywall

I've a Juniper SRX 340 on my datacenter and a Zywall USG 100 on my office. I'd like to build a site-to-site VPN between them, but after a lot of tries I can't still reach the result. This is the ...
3
votes
1answer
79 views

Juniper MX/SRX series interface monitoring command

Good morning all, I was curious due to an issue were currently troubleshooting in our environment if there is a command in Juniper that will allow us to determine the utilization percentage of an ...
3
votes
1answer
322 views

Configuring DHCP on Juniper junos-vsrx-12.1X47-D20.7-domestic on vmware

I'm preparing for JNCIS-SEC exam. I used junos-vsrx-12.1X47-D20.7-domestic image to create virtual machine in order to practice for the exam. I am following this to configure the vsrx. When I do the ...
3
votes
1answer
2k views

Difference between junos-host zone and a security zone

As far as security zones are concerned, we apply policies to it to control the transit traffic. And we also apply host-inbound-traffic to a zone or interfaces. If we have both of the above ...
3
votes
1answer
302 views

Could launching a virtual router with less-than-recommened RAM cause interfaces to not initialize?

I'm trying to launch a few vSRX devices through GNS3 (and VirtualBox). The issue that I'm running into (I think) is that my interfaces seem to not properly initialize if I don't start the instances ...
3
votes
1answer
126 views

Can I download Juniper predefined security templates for view, outside of my router?

Based on this page: How to use predefined policy templates in an IDP policy in SRX and J-series devices I would like to download these templates to read through them, but from my desktop. I couldn't ...
3
votes
1answer
699 views

Does the Juniper SRX have spanning-tree capabilities?

I can't find any documentation supporting spanning-tree capabilities on SRX devices. I'm running a virtual image, which I thought was more-or-less the vSRX: root> show version Model: ...
3
votes
1answer
992 views

Performance differences of logging session-init and session-close invididually compared to through apply-groups

Assumption: Your interest lies in logging each and every session Approach 1 You configure the session logging within each and every policy, for example: set security policies from-zone trust to-...
3
votes
2answers
6k views

Route-based ipsec between cisco router end juniper srx

network experts! Help, please, to understand why there is no ping from source address to destination address over ipsec vpn(here, route-based). I have such schema: Phase1 and Phase2 of IPSec are up....
3
votes
1answer
486 views

Juniper SRX320 Dynamic VPN, cannot route to Remote-Protected-Resource

Multiple VPNs setup with a Juniper SRX320. The SRX320 has an irb interface as follows: irb { unit 0 { family inet { address 192.168.120.1/24; } } } I've setup ...
3
votes
1answer
470 views

How can I monitor SSH or HTTPS activity on Juniper SRX 240 firewall?

In Junos is there any way I can monitor SSH or HTTPS login activity though logs? I would like to receive alerts if there are any changes made in the current config.
3
votes
3answers
6k views

How do I forward multicast packets over IPSec VPN Tunnel on Juniper SRX?

I have an IPSec site-to-site VPN setup between two SRX300 devices. I am trying to get multicast to travel across. I am looking for the simplest configuration possible to get this setup. I have found ...
3
votes
1answer
120 views

Bandwidth hogging on managed switched network 17 users

Lately we have been getting bandwidth hogging when any user attempts to download updates / youtube / anything large files. The rest of the network is clogged. We have a fibre 20meg line in. 20meg ...
3
votes
1answer
7k views

Cannot access web management through HTTPS despite being configured

I'm configuring a Juniper SRX240 router, and I wanted to set up the HTTPS protocol for web management, as opposed to plain HTTP which is working fine. I configure HTTPS as documented here, but ...
3
votes
1answer
5k views

How to understand Juniper SRX flow creation?

I have a Juniper SRX240H2(JUNOS 12.1X44-D20.3) firewall cluster in flow mode with interface reth2.1 facing Internet and interface reth1.1 facing LAN. I have a problem with one particular source and ...
3
votes
1answer
4k views

Juniper SRX240 and EX2200 network

I'm not a network engineer, so this must be a noob question. My task is simple, I need all clients to have internet access. Both EX2200 were configured before as layer 2 switches, so i assume their ...
3
votes
1answer
668 views

Juniper SRX 240 Routing Configuration

I am working with a Juniper SRX 240 as an aggregation routing device, it connects a Desktop (Workstation) environment over an access switch port to several (4) server environments behind Cisco Layer 2 ...
2
votes
2answers
2k views

SRX chassis cluster over layer 2 network

I need to setup a chassis cluster between two SRX650s over a layer 2 network. I have found an article which is applicable to my situation. But I do not understand some portions: Please explain the ...
2
votes
1answer
8k views

Can't ping directly connected SRX210 (Juniper)

I'm coming to terms with JunOS, and I have set up a lab that includes two SRX210s. I have set ge-0/0/1 on both devices to: ge-0/0/1 { unit 0 { family inet { address 20.0.0.1/24; } } ....
2
votes
2answers
67 views

SRX to ASA IPSec troubles

we built a VPN between partner's Cisco ASA (unknown version) and my Juniper SRX 340. The tunnel seems to go up properly: root@fw01> show security ike security-associations node0: ----------------...
2
votes
1answer
110 views

Juniper SRX sniffing

I've a Juniper SRX 340 Cluster (15.1X49-D70.3) on which I have to do some debug. I know how to sample packets on interfaces and my question is: is it possible to sample traffic at the same time on ...
2
votes
1answer
101 views

Juniper JunOS routing issue in v15.1.49

I have a Cisco Nexus that has a few vlans on it - total network size is 172.26.64.0/20 split into /24 vlans - each using the third octet as the vlan ID. It's IP is 172.26.x.254 on each vlan as the ...
2
votes
1answer
2k views

what command will show my zone address books?

# show security address-book displays the global address books. But I have no global address books I have zone address books. Is there no show command that displays this? I can see it in the GUI: I ...
2
votes
1answer
899 views

How to configure 2 LAN as input and one output ports in juniper switch

i would like to know how i can configure juniper "SRX100" switch such that there i can connect two LAN's for inbound traffic and one outbound traffic.