Hot answers tagged

6

I solved this problem finally. By capturing and comparing DHCP Discover packets sent from JunOS and Cisco, I found Cisco sends Option 64 Client Identifier and Option 12 Host Name by default. However, JunOS will not send them without explicit instructions. I think my ISP sets up a filter or something on their side. The above two options are mandatory. When I ...


6

X indicates that it is a aggressive feature train per KB27144 and TSB16034. The NN is a normal incremental version number.


5

Look at the Juniper SRX datasheet for more detail. If you use the SRX100B model, you can buy an additional license to use UTM. The SRX100B has 1GB RAM, but only half of that is accessible.


5

Yep, indeed, this is a base memory SRX. UTM is supported on high memory devices only. Bad luck. :(


5

There are a couple of ways you can check show interfaces routing-instance all terse which will list all interfaces and their routing instance (See example) show confiuration routing-instances which is going to show the configuration of any routing instances you have, you will need to check out the interface stanza Check the routing table and see if the ...


4

OK, so I have revisited this issue several times, and now have working IPv6 with TWC via my SRX. I wish I could mark several answers and comments as correct as several of you gave me parts of the overall solution. Thank you all, for that. I've upvoted the answers that contributed to give as much as I could to contributors. As it turns out, the DOCSIS ...


4

In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below : assign the interface for security zone : EX: set security zones security-zone untrust interfaces ge-0/0/1.0 you have to enable ping in the security zone : EX: set security zones security zone host inbound traffic system ...


3

Not related to your specific problem, but you'll need to permit ICMPv6 to come back to you (Echo Reply, Echo Request and Packet too big at least) because IPv6 doesn't support fragmentation and Packet Too Big messages is the only way you (your SRX, PC etc) will know to send smaller packet.


3

As per Juniper you can actually check the defaults by: Log in as the root user and provide your credentials. In shell mode, navigate to the /etc/config folder. (% cd /etc/config) Use ls to list which files are available, there should be something similar to srx650-factory.conf or srx650-defaults.conf Use vi filename to view contents Steps taken from ...


3

Hello and welcome to NetworkEngineering! Change your source-nat pool... to source-nat interface in SNAT config. Remove interface ge-0/0/6.0 from trust zone to untrust. [edit] delete security nat source rule-set rs1 rule r1 then source-nat set security nat source rule-set rs1 rule r1 then source-nat interface delete security zones security-zone trust ...


3

I would recommend not using AppDDoS moving forward. Juniper announced its deprecation some time ago, and this is probably the reason you can't find many solid examples of its use: http://kb.juniper.net/InfoCenter/index?page=content&id=KB28592&actp=search&viewlocale=en_US&searchid=1374905420170 Ironically, that KB recommends using the DDos ...


3

Proxy-identity defaults to whatever you have set on the policy (in case of policy-based VPN). In case of route-based VPN, it defaults to: proxy-identity { local 0.0.0.0/0; remote 0.0.0.0/0; service any; } Proxy-identity is used only for negotiating the IKE phase of the VPN, and has to mirror the proxy-identity that is set on the other site of the ...


3

Your config is possibly safe (if you care about them you should consider rancid or make manual backups) as it's on a different partition. If you place the install image on a FAT32 formatted USB key you can reinstall JunOS from there, however you may need to use the reformat option which will wipe any config. Juniper doc: http://www.trapezenetworks.com/...


3

Packets should be classified regardless of the TCP handshake being watched or not. If there isn't a session defined for that flow (fast path) a new one should be created (first path). Do you have any screen configured?? Maybe it's the screen that's dropping the traffic. More details on Troubleshooting Traffic Flows and Session Establishment Maybe you can ...


2

Came across this, and not sure if you ever got this working, but I was just working on the same thing, trying to get TWC working with an SRX. After some debugging, I found this in the traces: Jun 17 20:50:41 [DEBUG][default:default][N/A][INET6][ge-0/0/0.0] dhcpv6_client_validate_msgs: Server does not have rapid commit. I had it working on a Cisco where I ...


2

Make sure that you do not have the dhcpd deamon running (set system services dhcp). When running dual stack you'll need to be running your internal dhcp through the jdhcpd deamon (system services dhcp-local-server). Its a bit odd, but the dhcpd deamon stomps on the jdhcpd deamon.


2

Ethernet switching on Juniper SRX firewalls in Chassis Cluster is not done through reth interfaces, but by creating a "switching fabric" accross the cluster. In this switching fabric you can create vlans and RVI's as ususal, but this does require a sslight redesign of your configuration. You would need to: Create an additional link between the nodes: swfab ...


2

https://www.juniper.net/documentation/en_US/junos/topics/example/firewall-filter-option-filter-based-forwarding-example.html This would explain how to decide how to route by origin. But I'd prefer - like Indigo said - to use virtual-routers on the srx. Just configure a routing-instance for each network, add the interfaces to the routing instances and set ...


2

The issue is: you applied a wrong profile (profile Block-Message-WLAN-profile) on your rule-sets Block-Message. The correct profile is profile Block-Message-profile (without 'WLAN' word in betwwen) as defined. In addition, to ensure your from-zone UNTRUSTED-CLIENTS to-zone INTRANET policy is working properly, try to access/open the URL of blockmessage....


2

A couple of things - your major issue is that you aren't allowing bgp under your host-inbound-traffic - think of this is like an ACL directly to your interface IP addresses. Fix this with: set security zones security-zone internal host-inbound-traffic protocols bgp A couple of other things I spot: your loopback address should be a /32, not a /24 - it ...


2

Most common reasons to reject route on local interface is: interface with assigned IP is down/disabled there is IP conflict and this IP is assigned in two places, could be even on unused interface etc. zone misconfiguration Please supply full configuration so we can advise.


2

I did not setup the port group. All nodes that are to share a segment need to be connected to the same port group. Set up a port group each for the server and one for the clients. Connect each client's vNIC to the clients group and the server's vNIC to the server group. Connect each firewall vNIC to one of the groups. I'd recommend using a single vSwitch ...


2

Assuming your Call Server is 10.0.20.3, then I think you've got a mistake in your configuration - you're referencing the TFTP Server IP address using boot-file instead of boot-server. Try the following and see if it fixes your issue: delete routing-instances GLOBAL access address-assignment pool TEST_VOIP_v2085 family inet dhcp-attributes boot-file 10.0.20....


1

The answer is: The setting forwarding-options { hash-key { family inet { layer-4; } } } only works in PACKET MODE The default mode for an SRX is flow mode. You can set configure packet mode by deleting ALL of the configuration under the security stanza and then running set security forwarding-options family mpls mode ...


1

Answer was found on Juniper forums and it states, quote: This will restart the entire IPSec process. So, answering my question - all IPSEC connections will be terminated.


1

Here's a 'thumbnail' sketch of how to do it provided you have SRX's on both ends: https://kb.juniper.net/InfoCenter/index?page=content&id=KB28077&cat=SRX_SERIES&actp=LIST The basic idea is that you use a 'hostname' in the IKE gateway setup on both sides. The SRX with the dynamic IP will establish IKE using the hostname.


1

Okay, from the top: I would highly recommend you upgrade code to 15.1X49-D60.7 before you get started. You'll need to enable switching mode globally on the box (this will require a restart but save it until you've added all the config): set protocols l2-learning global-mode switching Next, create your VLAN - let's assume VLAN-ID 4 and a matching irb (...


1

If I understand your topology correctly, you are using the SRX as a layer-2 device between your ISP router and the hosts in the branch (in place of the managed switch in the drawing). In this case you will have to run the SRX in "Transparent Mode", in stead of the default "Routed Mode". This has a couple of caveats and limitations, so be sure to check the ...


1

This is a job for BGP. You want a single public AS. You will use BGP and each ISP facing router eBGP peers with the ISP. APNIC When should an AS be created? An AS needs to be created if a network connects to more than one AS with different routing policies. Some common examples of Autonomous Systems are networks connected to two or more upstream service ...


1

The correct procedure for this would be to run request system zeroize from the cli. Does the device still boot to U-boot when you restart it? If so maybe you can follow this procedure to re-install junos.


Only top voted, non community-wiki answers of a minimum length are eligible