Skip to main content
Share Your Experience: Take the 2024 Developer Survey
6 votes

Juniper SRX answers all ping requests instead of forwarding

The session output shows that the box is translating the destination address 10.5.5.22 to 10.41.22.3 and then routing it out ae0.22 instead of ae0.5 like you'd expect. It is very likely that your NAT ...
Benjamin Dale's user avatar
5 votes
Accepted

IPv6 default route not being installed from RA

From JTAC... The issue you are facing is described on internal PR. Workaround Configure IPv6 default route manually. Add prefix info to the RA sent Known issue will be resolved in: junos:15.1X49-...
Jason Keller's user avatar
5 votes
Accepted

Dump traffic on routing-instance with a Juniper SRX firewall

This works fine on the lower-end SRX models - try using the layer 3 interface bound to your VLAN eg: tcpdump -i vlan.10 My configuration looks like this: routing-instances { TCPDUMP-TEST { ...
Benjamin Dale's user avatar
4 votes

How do you disable IGMP-snooping on virtual nic macvtap

This is actually a known issue and there are a couple of ways to fix it. The best one is actually to edit the XML definition for the libvirt network and add trustGuestRxFilters=yes to the ...
rnxrx's user avatar
  • 6,114
4 votes
Accepted

Can't ping directly connected SRX210 (Juniper)

In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below : assign the interface for security zone : EX: set security ...
Mr.lock's user avatar
  • 1,733
4 votes
Accepted

Connecting an SRX chassis cluster to redundant upstream WAN links

If I put two interfaces (one on each SRX) in a reth, is that sufficient to ensure that there won't be any loops? Yes* - reth interfaces are essentially a logical L3 interface - they will not loop ...
Benjamin Dale's user avatar
4 votes

Juniper SRX 240 - Routing subsystem not running on secondary node

In a Juniper SRX Chassis Cluster, the master Routing Engine (RE) runs on only one node. This creates an active/passive control plane. All control plane processes (rpd, kmd, etc.) run only on the ...
RobinG's user avatar
  • 1,969
4 votes

Juniper SR300 maximum BGP routes

The route table stores all received routes (from your peer). The forwarding table only stores those routes accepted by policy. The maximum size (256K routes) applies to each. You may want to ask ...
Ron Trunk's user avatar
  • 67.7k
4 votes

Juniper SR300 maximum BGP routes

The SRX3xx data sheet shows both the SRX300 and the SRX345 having 4GB of memory, but their RIB scale being 256K and 1M routes respectively: https://www.juniper.net/assets/us/en/local/pdf/datasheets/...
Benjamin Dale's user avatar
4 votes
Accepted

IPSec route-based vpn st0 interface

Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
Benjamin Dale's user avatar
4 votes
Accepted

Advertise all static route except the default gateway with Juniper SRX firewall

You need to add a term to your policy statement which explicitly rejects the default route then, and add that before the export-statics term: policy-statement bgp-export-policy { term reject-...
Teun Vink's user avatar
  • 17.4k
4 votes
Accepted

Juniper SRX 340 configuration import/export

So a couple of things: first, I would recommend you upgrade from 15.1X49D70.3 immediately on both units, as there a a lot of issues with this code. The current (as of today) JTAC recommended version ...
Benjamin Dale's user avatar
4 votes
Accepted

Juniper SRX Management Redirects

Solved! I checked the /var/log/httpd.log log and I found the required interface (not the one I thought to): httpd: 0: GET IFNAME WORKED st0.6 httpd: 0: GET ALLOWED FAILED st0.6 now I can reach the ...
Gianluca's user avatar
  • 371
3 votes
Accepted

Juniper JunOS routing issue in v15.1.49

Change the subnet mask on your reth interface from a /20 to a /24.
A-A-Ron's user avatar
  • 636
3 votes
Accepted

what command will show my zone address books?

show security zones security-zone <zone-name> address-book
Andrey Prokhorov's user avatar
3 votes

Why logical systems?

Logical systems are generally used in the lab as a way of doing realistic network testing on a single or smaller number of physical devices. Having said that, I have seen Logical Systems used in ...
Benjamin Dale's user avatar
3 votes
Accepted

Difference between junos-host zone and a security zone

Junos-host zone can be used to add an additional check for traffic destined to SRX. If you don't configure any security policy to-zone junos-host, the traffic/packet will be validated based on ...
Andrey Prokhorov's user avatar
3 votes
Accepted

Configuring DHCP on Juniper junos-vsrx-12.1X47-D20.7-domestic on vmware

When you are running the SRX stand-alone (eg: not clustered), the first port is ge-0/0/0. It's only when you switch the unit to a chassis cluster member that the interface becomes fxp0. Use: delete ...
Benjamin Dale's user avatar
3 votes
Accepted

Juniper MX/SRX series interface monitoring command

monitor interface and show interface <...> detail are the commands most often used. However, I don't think many people use a CLI nowadays to get this information. There are many tools which use ...
Teun Vink's user avatar
  • 17.4k
3 votes
Accepted

Site-2-Site Juniper SRX & Zywall

Exist next kb KB24642 related to your question: This could be attributed to the following: The st0 interface needs to be configured under a specific security zone. Even if the st0 interface is ...
Ivan Gurzhiy's user avatar
3 votes
Accepted

Juniper SRX sniffing

When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on. [edit forwarding-options packet-...
Gareth Hastings's user avatar
3 votes
Accepted

Juniper SRX Cluster and Switching with AWS Direct Connect

Your config looks good - can you confirm that your swfab interfaces are connected to each other? Eg: 0/0/7 on node 0 is patched to 5/0/7 on node 1? show chassis cluster ethernet-switching interfaces ...
Benjamin Dale's user avatar
3 votes
Accepted

Can link-local address be used by DHCPv6 Relay

So is there just a configuration I am missing that would allow the Juniper to forward/relay the DHCPv6 from the link-local address assigned to reth0.1 or is it just an absolute must for reth0.1 to ...
Marc 'netztier' Luethi's user avatar
2 votes
Accepted

Bandwidth hogging on managed switched network 17 users

QoS mechanisms only come into effect when there is congestion on the link. If you have a 20M circuit but connected to a 1G interface, your device will never recognize the congestion because the ...
John K.'s user avatar
  • 969
2 votes
Accepted

Juniper SRX300 cluster

You can find full documentation here. You're on the right track, but cluster-id should be greater than 0. From the documentation: Setting a cluster ID to 0 is equivalent to disabling a cluster. A ...
RobinG's user avatar
  • 1,969
2 votes
Accepted

How to configure L2TP Client on Juniper SRX?

As mentioned here, Juniper SRX cannot act as L2TP client.
Andrey Prokhorov's user avatar
2 votes

Juniper SRX 1400: Policy to redirect users to custom URL

The issue is: you applied a wrong profile (profile Block-Message-WLAN-profile) on your rule-sets Block-Message. The correct profile is profile Block-Message-profile (without 'WLAN' word in betwwen) ...
Hung Tran's user avatar
  • 3,754
2 votes
Accepted

Juniper SRX Log Traffic From Source Address

There are a number of ways you could do this depending on what you mean by "how much traffic". If you just want to log individual flows from that range, the following will work: set system syslog ...
Benjamin Dale's user avatar
2 votes
Accepted

How can I monitor SSH or HTTPS activity on Juniper SRX 240 firewall?

In Junos you can both of these requirements are captured in the default messages log file. show log messages You can also create a dedicated log file for this if you want: set system syslog file ...
Benjamin Dale's user avatar
2 votes
Accepted

BGP between two SRX210s?

A couple of things - your major issue is that you aren't allowing bgp under your host-inbound-traffic - think of this is like an ACL directly to your interface IP addresses. Fix this with: set ...
Benjamin Dale's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible