Hot answers tagged

4 votes
Accepted

Can't ping directly connected SRX210 (Juniper)

In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below : assign the interface for security zone : EX: set security ...
Mr.lock's user avatar
  • 1,723
3 votes
Accepted

Traffic flow for internal traffic in Juniper SRX 650

As per Juniper you can actually check the defaults by: Log in as the root user and provide your credentials. In shell mode, navigate to the /etc/config folder. (% cd /etc/config) Use ls to list which ...
DRP's user avatar
  • 1,491
3 votes

Fixing an SSL problem in Juniper SRX

I know this is an old question, but for anyone else with a similar issue, it sounds like TCP-MSS clamping is not configured on the new SRX. Inevitably you'll be blocking ICMP on the SRX, which in turn ...
Benjamin Dale's user avatar
3 votes
Accepted

Source NAT on Juniper SRX300

Hello and welcome to NetworkEngineering! Change your source-nat pool... to source-nat interface in SNAT config. Remove interface ge-0/0/6.0 from trust zone to untrust. [edit] delete security nat ...
Andrey Prokhorov's user avatar
2 votes

Ip telephone being not served by DHCP

Assuming your Call Server is 10.0.20.3, then I think you've got a mistake in your configuration - you're referencing the TFTP Server IP address using boot-file instead of boot-server. Try the ...
Benjamin Dale's user avatar
2 votes

Juniper SRX, workstation on SRX switch port cannot ping reth interface

A reth interface on the SRX is a Layer 3 interface - that is to say that VLAN tags are only added to traffic from a reth interface as it egresses the physical port(s) you have bound it to - it does ...
Benjamin Dale's user avatar
2 votes

Turning Off SPC card on Juniper SRX5800 series Firewall

That would appear to be the case. Juniper's documentation only shows a full chassis shutdown when messing with an SPC. (shutdown and power off the standby unit.)
Ricky's user avatar
  • 31.7k
2 votes

Juniper SRX routing based on Network

https://www.juniper.net/documentation/en_US/junos/topics/example/firewall-filter-option-filter-based-forwarding-example.html This would explain how to decide how to route by origin. But I'd prefer - ...
flo's user avatar
  • 75
2 votes

Juniper SRX 1400: Policy to redirect users to custom URL

The issue is: you applied a wrong profile (profile Block-Message-WLAN-profile) on your rule-sets Block-Message. The correct profile is profile Block-Message-profile (without 'WLAN' word in betwwen) ...
Hung Tran's user avatar
  • 3,754
2 votes
Accepted

BGP between two SRX210s?

A couple of things - your major issue is that you aren't allowing bgp under your host-inbound-traffic - think of this is like an ACL directly to your interface IP addresses. Fix this with: set ...
Benjamin Dale's user avatar
2 votes

SRX FW - Show route - output reject

Most common reasons to reject route on local interface is: interface with assigned IP is down/disabled there is IP conflict and this IP is assigned in two places, could be even on unused interface ...
Datagram.Network's user avatar
2 votes

Can't ping from firewall to Hosts and from Hosts to firewall and host to host

I did not setup the port group. All nodes that are to share a segment need to be connected to the same port group. Set up a port group each for the server and one for the clients. Connect each ...
Zac67's user avatar
  • 82.6k
2 votes

Fixing an SSL problem in Juniper SRX

Juniper has a good Tech Library page for troubleshooting SSL proxy issues. It's a complex subject -- especially if you're not very familiar with PKI concepts -- and they've done a nice job of ...
Jeff Wheeler's user avatar
  • 5,449
1 vote
Accepted

Juniper SRX Application Inactivity Timeout

Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy? Assuming you had both ...
Jordan Head's user avatar
  • 7,044
1 vote
Accepted

Juniper SRX BGP based ECMP not working as expected

The answer is: The setting forwarding-options { hash-key { family inet { layer-4; } } } only works in PACKET MODE The default mode for an SRX is flow mode. You ...
Gareth Hastings's user avatar
1 vote
Accepted

Result of running `restart ipsec-key-management`

Answer was found on Juniper forums and it states, quote: This will restart the entire IPSec process. So, answering my question - all IPSEC connections will be terminated.
Andrey Prokhorov's user avatar
1 vote
Accepted

Site-to-site IPSEC for multiple peers with dynamic IP on Juniper SRX

Here's a 'thumbnail' sketch of how to do it provided you have SRX's on both ends: https://kb.juniper.net/InfoCenter/index?page=content&id=KB28077&cat=SRX_SERIES&actp=LIST The basic idea ...
Trey Thompson's user avatar
1 vote

Configure VLANs on Juniper SRX - cannot figure it out

Okay, from the top: I would highly recommend you upgrade code to 15.1X49-D60.7 before you get started. You'll need to enable switching mode globally on the box (this will require a restart but save ...
Benjamin Dale's user avatar
1 vote
Accepted

Juniper SRX240 firewall family inet issue on VLAN

If I understand your topology correctly, you are using the SRX as a layer-2 device between your ISP router and the hosts in the branch (in place of the managed switch in the drawing). In this case ...
RobinG's user avatar
  • 1,949
1 vote

how to setup dual ISP fail over with 2 routers

This is a job for BGP. You want a single public AS. You will use BGP and each ISP facing router eBGP peers with the ISP. APNIC When should an AS be created? An AS needs to be created if a network ...
Ronnie Royston's user avatar
1 vote

Juniper srx-100-b doesn't boot anymore

The correct procedure for this would be to run request system zeroize from the cli. Does the device still boot to U-boot when you restart it? If so maybe you can follow this procedure to re-install ...
xpto's user avatar
  • 131
1 vote

Juniper SRX-1100 VPN configuration

You'll configure and allow hairpin NAT on your SRX (http://kb.juniper.net/InfoCenter/index?page=content&id=KB24639&actp=search), make sure to allow the traffic from the VPN zone to the other ...
Fallacy11's user avatar
  • 566

Only top scored, non community-wiki answers of a minimum length are eligible