6
votes
Juniper SRX answers all ping requests instead of forwarding
The session output shows that the box is translating the destination address 10.5.5.22 to 10.41.22.3 and then routing it out ae0.22 instead of ae0.5 like you'd expect. It is very likely that your NAT ...
- 9,421
5
votes
Accepted
IPv6 default route not being installed from RA
From JTAC...
The issue you are facing is described on internal PR.
Workaround
Configure IPv6 default route manually.
Add prefix info to the RA sent
Known issue will be resolved in:
junos:15.1X49-...
- 91
5
votes
Accepted
Dump traffic on routing-instance with a Juniper SRX firewall
This works fine on the lower-end SRX models - try using the layer 3 interface bound to your VLAN eg:
tcpdump -i vlan.10
My configuration looks like this:
routing-instances {
TCPDUMP-TEST {
...
- 9,421
4
votes
How do you disable IGMP-snooping on virtual nic macvtap
This is actually a known issue and there are a couple of ways to fix it.
The best one is actually to edit the XML definition for the libvirt network and add
trustGuestRxFilters=yes
to the ...
- 6,104
4
votes
Accepted
Can't ping directly connected SRX210 (Juniper)
In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below :
assign the interface for security zone :
EX: set security ...
- 1,723
4
votes
Accepted
Connecting an SRX chassis cluster to redundant upstream WAN links
If I put two interfaces (one on each SRX) in a reth, is that
sufficient to ensure that there won't be any loops?
Yes* - reth interfaces are essentially a logical L3 interface - they will not loop ...
- 9,421
4
votes
Juniper SRX 240 - Routing subsystem not running on secondary node
In a Juniper SRX Chassis Cluster, the master Routing Engine (RE) runs on only one node. This creates an active/passive control plane. All control plane processes (rpd, kmd, etc.) run only on the ...
- 1,949
4
votes
Juniper SR300 maximum BGP routes
The route table stores all received routes (from your peer). The forwarding table only stores those routes accepted by policy.
The maximum size (256K routes) applies to each.
You may want to ask ...
- 67.1k
4
votes
Juniper SR300 maximum BGP routes
The SRX3xx data sheet shows both the SRX300 and the SRX345 having 4GB of memory, but their RIB scale being 256K and 1M routes respectively:
https://www.juniper.net/assets/us/en/local/pdf/datasheets/...
- 9,421
4
votes
Accepted
IPSec route-based vpn st0 interface
Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
- 9,421
4
votes
Accepted
Advertise all static route except the default gateway with Juniper SRX firewall
You need to add a term to your policy statement which explicitly rejects the default route then, and add that before the export-statics term:
policy-statement bgp-export-policy {
term reject-...
- 17k
4
votes
Accepted
Juniper SRX 340 configuration import/export
So a couple of things: first, I would recommend you upgrade from 15.1X49D70.3 immediately on both units, as there a a lot of issues with this code. The current (as of today) JTAC recommended version ...
- 9,421
4
votes
Accepted
Juniper SRX Management Redirects
Solved!
I checked the /var/log/httpd.log log and I found the required interface (not the one I thought to):
httpd: 0: GET IFNAME WORKED st0.6
httpd: 0: GET ALLOWED FAILED st0.6
now I can reach the ...
- 371
3
votes
Why logical systems?
Logical systems are generally used in the lab as a way of doing realistic network testing on a single or smaller number of physical devices.
Having said that, I have seen Logical Systems used in ...
- 9,421
3
votes
Accepted
Could launching a virtual router with less-than-recommened RAM cause interfaces to not initialize?
I believe officially vSRX needs 4 GB RAM, 2 CPU and a min of 16 GB disk space. If this requirement is not met, an instance can behave abnormally and will be hard to debug. Maybe you are facing a ...
- 66
3
votes
Accepted
Juniper routing - one way communication
Figured out what was going on. This is unique to SRX devices as they are security devices. I had to add host-system-services inbound ping to my trust zone, like so:
admin@wb1# set security zones ...
- 191
3
votes
Accepted
what command will show my zone address books?
show security zones security-zone <zone-name> address-book
- 2,774
3
votes
Accepted
Juniper JunOS routing issue in v15.1.49
Change the subnet mask on your reth interface from a /20 to a /24.
- 536
3
votes
Accepted
Difference between junos-host zone and a security zone
Junos-host zone can be used to add an additional check for traffic
destined to SRX. If you don't configure any security policy to-zone
junos-host, the traffic/packet will be validated based on
...
- 2,774
3
votes
Accepted
Configuring DHCP on Juniper junos-vsrx-12.1X47-D20.7-domestic on vmware
When you are running the SRX stand-alone (eg: not clustered), the first port is ge-0/0/0. It's only when you switch the unit to a chassis cluster member that the interface becomes fxp0.
Use:
delete ...
- 9,421
3
votes
Accepted
Juniper MX/SRX series interface monitoring command
monitor interface and show interface <...> detail are the commands most often used. However, I don't think many people use a CLI nowadays to get this information. There are many tools which use ...
- 17k
3
votes
Accepted
Site-2-Site Juniper SRX & Zywall
Exist next kb KB24642 related to your question:
This could be attributed to the following:
The st0 interface needs to be configured under a specific security zone.
Even if the st0 interface is ...
- 449
3
votes
Accepted
Juniper SRX sniffing
When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on.
[edit forwarding-options packet-...
- 860
3
votes
Accepted
Juniper SRX Cluster and Switching with AWS Direct Connect
Your config looks good - can you confirm that your swfab interfaces are connected to each other? Eg: 0/0/7 on node 0 is patched to 5/0/7 on node 1?
show chassis cluster ethernet-switching interfaces
...
- 9,421
3
votes
Accepted
Can link-local address be used by DHCPv6 Relay
So is there just a configuration I am missing that would allow the Juniper to forward/relay the DHCPv6 from the link-local address assigned to reth0.1 or is it just an absolute must for reth0.1 to ...
- 8,826
2
votes
=> sign is showing in juniper srx100
Please review this article, hopefully it will help you:
Installing JUNOS Software
From u-boot:
=> setenv ipaddr 10.157.70.170
=> setenv netmask 255.255.255.0
=> setenv gatewayip 10.157.64....
- 376
2
votes
Accepted
Juniper SRX-240. Single Address Translation
Do you need the server to also access the public network or only reply to requests from the public network?
On the first case you use static nat (bidirectional NAT), on the second you use destination ...
- 131
2
votes
Accepted
Bandwidth hogging on managed switched network 17 users
QoS mechanisms only come into effect when there is congestion on the link. If you have a 20M circuit but connected to a 1G interface, your device will never recognize the congestion because the ...
- 969
2
votes
Accepted
Juniper SRX300 cluster
You can find full documentation here.
You're on the right track, but cluster-id should be greater than 0. From the documentation:
Setting a cluster ID to 0 is equivalent to disabling a cluster. A
...
- 1,949
2
votes
Accepted
Juniper JUNOS security policy incorrectly blocking traffic that is explicitly permitted
The two routes you are summarising have different destination addresses.
eg:
route 10.10.201.0/25 next-hop 172.18.10.6;
route 10.10.201.128/25 next-hop 172.18.10.10;
after your change, the entire /...
- 9,421
Only top scored, non community-wiki answers of a minimum length are eligible