11

Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches: Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure. set interface x mtu 9216 ...


9

I opened a case with HP concerning this issue. After escalating past the useless Level 1 tech, the Level 2 tech very alertly spotted something that I had not. The SRX is sending its DHCPDISCOVER packet with a TTL of 1. The Procurve's apparently will decrement the TTL and use the resulting TTL in the relay'ed packet to the DHCP server. In this case, the ...


8

Junos does have DPD and you can use it in conjunction with multiple endpoint IP addresses in a single IKE tunnel. There is a bit of info about it here (which I've copied below) http://kb.juniper.net/InfoCenter/index?page=content&id=KB29211&actp=RSS SUMMARY: This article explains how redundancy in site-to-site VPN can be achieved using multiple ...


7

Juniper KB explaining how to locate / interpret information in the Kmd log : How do I Find the VPN Entry in the Kmd Log on a J-Series or SRX-Series device? although for releases prior to 12 the following kmd log issues below are also relevant for the higher end firewalls. [SRX High End] request security ike debug-enable does not print any useful kmd debug ...


6

You can use show ethernet switching table. The following is taken from, Configuring MAC Limiting (Official Juniper Documentation). Configure: [edit ethernet-switching-options secure-access-port] user@host# set interface all allowed-mac 00:05:85:3A:82:80 user@host# set interface all allowed-mac 00:05:85:3A:82:81 user@host# set interface all allowed-mac 00:...


5

There are three steps to this. Create a logical system Create a user class bound to the logical system Create a user with the class Here is a very incomplete example: set logical-system lsys1 set system login class lsys1-class logical-system lsys1 set system login user lsys1-admin class lsys1-class Obviously you need to configure the rest of the ...


5

From JTAC... The issue you are facing is described on internal PR. Workaround Configure IPv6 default route manually. Add prefix info to the RA sent Known issue will be resolved in: junos:15.1X49-D180 junos:17.4R3 junos:18.1R4 junos:18.2R3 junos:18.3R2 junos:18.4R2 junos:19.1R2 junos:19.2R1 Tentative release for 15.1x49-D180 is end of May. I've ...


5

This works fine on the lower-end SRX models - try using the layer 3 interface bound to your VLAN eg: tcpdump -i vlan.10 My configuration looks like this: routing-instances { TCPDUMP-TEST { instance-type virtual-router; interface vlan.10; } } vlans { v10-TEST { vlan-id 10; l3-interface vlan.10; } } Bear in ...


5

The session output shows that the box is translating the destination address 10.5.5.22 to 10.41.22.3 and then routing it out ae0.22 instead of ae0.5 like you'd expect. It is very likely that your NAT config will help determine why this is (static and destination)


4

OK, so I have revisited this issue several times, and now have working IPv6 with TWC via my SRX. I wish I could mark several answers and comments as correct as several of you gave me parts of the overall solution. Thank you all, for that. I've upvoted the answers that contributed to give as much as I could to contributors. As it turns out, the DOCSIS ...


4

After opening a JTAC case I was told there is not a known load set limit but that RE impact is to be expected. I can verify that I have been able to successfully load and commit a 250,000 line change on a Juniper SRX3600 running Junos 11.4R7.5 while under minimal load taking six minutes to verify and commit.


4

It appeared this was an easy fix (I also tried 12.1R6.5 and 12.1X44-D11.5, to no avail). First, I looked at the version of the signature DB that it's trying to download (2263): netops> request security idp security-package download check-server Successfully retrieved from(https://services.netscreen.com/cgi-bin/index.cgi). Version info:2263(...


4

Here's some version info that should help. I think that the other thing that immediately strikes me is autonegotiation being disabled, which shouldn't be necessary. Is this something that your provider is asking for, or based on learned behaviors? I recommend reading what's out there, since autonegotiation has been recommended for over 10 years. Anything ...


4

This is actually a known issue and there are a couple of ways to fix it. The best one is actually to edit the XML definition for the libvirt network and add trustGuestRxFilters=yes to the opening network definition stanza. The default is "no" - which, unfortunately, breaks both IPv6 and multicast for IPv4. This is actually laid out in a RedHat Bug ...


4

In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below : assign the interface for security zone : EX: set security zones security-zone untrust interfaces ge-0/0/1.0 you have to enable ping in the security zone : EX: set security zones security zone host inbound traffic system ...


4

If I put two interfaces (one on each SRX) in a reth, is that sufficient to ensure that there won't be any loops? Yes* - reth interfaces are essentially a logical L3 interface - they will not loop traffic between node0 and node1 of the SRX chassis cluster Is this the correct/optimal way to ensure redundancy with the two upstream links? No. Ask your ...


4

In a Juniper SRX Chassis Cluster, the master Routing Engine (RE) runs on only one node. This creates an active/passive control plane. All control plane processes (rpd, kmd, etc.) run only on the master RE. From Branch SRX Series and J Series Chassis Clustering: The special redundancy group 0 refers to the status of the control plane. In this example, ...


4

The route table stores all received routes (from your peer). The forwarding table only stores those routes accepted by policy. The maximum size (256K routes) applies to each. You may want to ask your ISP to filter for you.


4

The SRX3xx data sheet shows both the SRX300 and the SRX345 having 4GB of memory, but their RIB scale being 256K and 1M routes respectively: https://www.juniper.net/assets/us/en/local/pdf/datasheets/1000550-en.pdf These usually just marketing numbers based on the maximum number that has been officially tested, with the test being based on the target segment ...


4

Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the tunnel interface and encrypting the traffic. Usually when using an IPSEC tunnel, the link between B and C will be more hops and/or controlled by a third party, so ...


4

You need to add a term to your policy statement which explicitly rejects the default route then, and add that before the export-statics term: policy-statement bgp-export-policy { term reject-default { from { route-filter 0.0.0.0/0 through 0.0.0.0/32; then reject; } term export-statics { from protocol static; ...


3

If we are assuming you want to log every session on your device then the apply-groups statement itself will as you thought only impact the performance of commit's. This is because the system will need to calculate the effect of the applied groups across the rest of the config. The bigger your config gets and the more groups you are applying the longer your ...


3

You cannot do this through NAT. When you connect to the VM console, the traffic goes to the server running the VM, not vCenter. And it's going to get the "inside" address relative to vCenter, not the "outside" address you need.


3

When I completed SRX clustering across the EX's switches, I found the specific Juniper AppNote below quite insightful in gaining understanding of all the various requirements. SRX Series Servicer Gateways cluster Deployment across layer 2 networks


3

The article you're referring to is simply setting up a trunk between 2 switches. Please explain the logical scheme. Where are the interfaces located ( ge-0/0/0, ge-0/0/1, ge-0/1/0) which are mentioned in the configuration below (which side of the switch?)? The configuration samples in your question are placed on the interface connecting the two ...


3

Per a JNCIE who offered help: This behavior is expected on branch-devices which lack dedicated processing for UTM and IDP functionality. The fix is to granularly apply an IDP policy which applies only to traffic you care a lot about and judiciously choose your applied signatures based upon needs versus performance impact.


3

Packets should be classified regardless of the TCP handshake being watched or not. If there isn't a session defined for that flow (fast path) a new one should be created (first path). Do you have any screen configured?? Maybe it's the screen that's dropping the traffic. More details on Troubleshooting Traffic Flows and Session Establishment Maybe you can ...


3

You description is implying the issue is between the primary and secondary nodes, but the article is referencing an out of sync between the Control Plane and Data Plane ( or Routing Engine and Packet Forwarding Engine. If it is indeed the PFE out of Sync you might also try the hidden command 'commit full'. I know I had an issue where my 2 routing engines ...


3

Not related to your specific problem, but you'll need to permit ICMPv6 to come back to you (Echo Reply, Echo Request and Packet too big at least) because IPv6 doesn't support fragmentation and Packet Too Big messages is the only way you (your SRX, PC etc) will know to send smaller packet.


3

Based on your comments, everything looks correct. Althought 50.50.50.50 may not have a direct/learned route to 2.2.2.2, he does have a default-gateway set to 14.0.64.2. Router#show ip route vrf vrf-untrustgi S* 0.0.0.0/0 [1/0] via 14.0.64.2 If you didn't have an interface locally that was available to respond to ping, you wouldn't be able to use it. ...


Only top voted, non community-wiki answers of a minimum length are eligible