8 votes
Accepted

Backup IP for site 2 site VPN (Juniper SRX)

Junos does have DPD and you can use it in conjunction with multiple endpoint IP addresses in a single IKE tunnel. There is a bit of info about it here (which I've copied below) http://kb.juniper.net/...
user avatar
6 votes
Accepted

How can I view a list of which MACs an interface is restricted to on a Juniper SRX?

You can use show ethernet switching table. The following is taken from, Configuring MAC Limiting (Official Juniper Documentation). Configure: [edit ethernet-switching-options secure-access-port] ...
user avatar
  • 6,440
6 votes

Juniper SRX answers all ping requests instead of forwarding

The session output shows that the box is translating the destination address 10.5.5.22 to 10.41.22.3 and then routing it out ae0.22 instead of ae0.5 like you'd expect. It is very likely that your NAT ...
user avatar
5 votes
Accepted

how to create managment access to SRX Lsys.

There are three steps to this. Create a logical system Create a user class bound to the logical system Create a user with the class Here is a very incomplete example: set logical-system lsys1 set ...
user avatar
  • 847
5 votes
Accepted

IPv6 default route not being installed from RA

From JTAC... The issue you are facing is described on internal PR. Workaround Configure IPv6 default route manually. Add prefix info to the RA sent Known issue will be resolved in: junos:15.1X49-...
user avatar
5 votes
Accepted

Dump traffic on routing-instance with a Juniper SRX firewall

This works fine on the lower-end SRX models - try using the layer 3 interface bound to your VLAN eg: tcpdump -i vlan.10 My configuration looks like this: routing-instances { TCPDUMP-TEST { ...
user avatar
4 votes
Accepted

DHCPv6 (with PD) client on Juniper SRX

OK, so I have revisited this issue several times, and now have working IPv6 with TWC via my SRX. I wish I could mark several answers and comments as correct as several of you gave me parts of the ...
user avatar
  • 2,476
4 votes

How do you disable IGMP-snooping on virtual nic macvtap

This is actually a known issue and there are a couple of ways to fix it. The best one is actually to edit the XML definition for the libvirt network and add trustGuestRxFilters=yes to the ...
user avatar
  • 6,036
4 votes
Accepted

Can't ping directly connected SRX210 (Juniper)

In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below : assign the interface for security zone : EX: set security ...
user avatar
  • 1,713
4 votes
Accepted

Connecting an SRX chassis cluster to redundant upstream WAN links

If I put two interfaces (one on each SRX) in a reth, is that sufficient to ensure that there won't be any loops? Yes* - reth interfaces are essentially a logical L3 interface - they will not loop ...
user avatar
4 votes

Juniper SRX 240 - Routing subsystem not running on secondary node

In a Juniper SRX Chassis Cluster, the master Routing Engine (RE) runs on only one node. This creates an active/passive control plane. All control plane processes (rpd, kmd, etc.) run only on the ...
user avatar
  • 1,899
4 votes

Juniper SR300 maximum BGP routes

The route table stores all received routes (from your peer). The forwarding table only stores those routes accepted by policy. The maximum size (256K routes) applies to each. You may want to ask ...
user avatar
  • 62.9k
4 votes

Juniper SR300 maximum BGP routes

The SRX3xx data sheet shows both the SRX300 and the SRX345 having 4GB of memory, but their RIB scale being 256K and 1M routes respectively: https://www.juniper.net/assets/us/en/local/pdf/datasheets/...
user avatar
4 votes
Accepted

IPSec route-based vpn st0 interface

Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
user avatar
4 votes
Accepted

Advertise all static route except the default gateway with Juniper SRX firewall

You need to add a term to your policy statement which explicitly rejects the default route then, and add that before the export-statics term: policy-statement bgp-export-policy { term reject-...
user avatar
  • 15.7k
4 votes
Accepted

Juniper SRX 340 configuration import/export

So a couple of things: first, I would recommend you upgrade from 15.1X49D70.3 immediately on both units, as there a a lot of issues with this code. The current (as of today) JTAC recommended version ...
user avatar
4 votes
Accepted

Juniper SRX Management Redirects

Solved! I checked the /var/log/httpd.log log and I found the required interface (not the one I thought to): httpd: 0: GET IFNAME WORKED st0.6 httpd: 0: GET ALLOWED FAILED st0.6 now I can reach the ...
user avatar
  • 359
3 votes
Accepted

Performance differences of logging session-init and session-close invididually compared to through apply-groups

If we are assuming you want to log every session on your device then the apply-groups statement itself will as you thought only impact the performance of commit's. This is because the system will ...
user avatar
3 votes
Accepted

Could launching a virtual router with less-than-recommened RAM cause interfaces to not initialize?

I believe officially vSRX needs 4 GB RAM, 2 CPU and a min of 16 GB disk space. If this requirement is not met, an instance can behave abnormally and will be hard to debug. Maybe you are facing a ...
user avatar
3 votes
Accepted

Juniper routing - one way communication

Figured out what was going on. This is unique to SRX devices as they are security devices. I had to add host-system-services inbound ping to my trust zone, like so: admin@wb1# set security zones ...
user avatar
  • 191
3 votes

Juniper SRX 210: Slow upload performance after enabling UTM IDP

Per a JNCIE who offered help: This behavior is expected on branch-devices which lack dedicated processing for UTM and IDP functionality. The fix is to granularly apply an IDP policy which ...
user avatar
3 votes
Accepted

Can I download Juniper predefined security templates for view, outside of my router?

I've uploaded the template output for you here: http://pastebin.com/iBx30XP7
user avatar
3 votes
Accepted

How to configure 2 LAN as input and one output ports in juniper switch

The basic process is as follows: Configure your VLANs set vlans v100-INTERNAL1 vlan-id 100 set vlans v101-INTERNAL2 vlan-id 101 set vlans v102-EXTERNAL vlan-id 102 Attach VLANs to switch ports set ...
user avatar
3 votes
Accepted

Juniper SRX - interface filters vs firewall rules?

You are correct, these are not the same thing. "Interface Filters" / Firewall Filters The show interfaces filters command is used to show what firewall filters are applied to each interface, and in ...
user avatar
  • 6,440
3 votes
Accepted

Does the Juniper SRX have spanning-tree capabilities?

The vSRX doesn't support switching features, so the answer is: (b) the SRX doesn't support spanning-tree features. vSRX is designed to be a virtual firewall, therefore it doesn't need "switching"....
user avatar
  • 138
3 votes
Accepted

Juniper SRX240 unstable uplink when client is connected to VPN

With help from our service provider we've been able to localise the problem. The idea I had in my last comment proved correct: the difference between fast ethernet and gigabit ethernet was the source ...
user avatar
3 votes

Why logical systems?

Logical systems are generally used in the lab as a way of doing realistic network testing on a single or smaller number of physical devices. Having said that, I have seen Logical Systems used in ...
user avatar
3 votes
Accepted

what command will show my zone address books?

show security zones security-zone <zone-name> address-book
user avatar
3 votes
Accepted

Juniper JunOS routing issue in v15.1.49

Change the subnet mask on your reth interface from a /20 to a /24.
user avatar
  • 536
3 votes
Accepted

Difference between junos-host zone and a security zone

Junos-host zone can be used to add an additional check for traffic destined to SRX. If you don't configure any security policy to-zone junos-host, the traffic/packet will be validated based on ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible