The post Configure Dual ISP Link Failover in Juniper SRX appeared first on MustBeGeek.

If you have two ISPs or two different links for same destination, then you can configure floating static route. Floating static route allows you to failover the link if the primary link fails. This is accomplished by using preference and qualified-next hop feature available in JunOS operating system. To configure dual ISP link failover in Juniper SRX you need two ISP links. This technique is not just for ISP links. You can apply this technique to any dual link scenario that have same destination network. SRX series, MX series and J series devices are mostly used in these types of scenario.

Configure Dual ISP Link Failover in Juniper SRX

Below is our scenario. We have two ISPs, ISP A and ISP B. What we want to accomplish is, if primary ISP’s link fail, then switch the link through secondary link to ISP B. So, let’s get started.

We need to configure the routing table under [routing-options] hierarchy.

In this way you can configure floating static route in JunOS systems.

The post Configure Dual ISP Link Failover in Juniper SRX appeared first on MustBeGeek.

The post Load Balance Dual ISP Internet in Juniper SRX appeared first on MustBeGeek.

There are two different methods for load balancing internet traffic in Juniper SRX series devices. They are per flow load balancing and filter based forwarding load balancing. Both techniques can be applied to MX series routers as well. You can use any method to load balance dual ISP internet in Juniper SRX or MX series or J series devices. Here, I will load balance dual ISP internet in Juniper SRX device using per flow load balancing method.

Load Balance Dual ISP Internet in Juniper SRX

The diagram below shows our existing scenario. We have two ISPs that we want to load balance the internet traffic to. Two internet links are in UNTRUST zone whereas the internal network is in TRUST zone. I have already configured required security policies.

The first step is to define routing policy. Configure the following policy under [edit-policy-options] hierarchy.

The second step is to configure the routing option. Configure the following routing information under [edit-routing-policy] hierarchy.

Now, configure the routing policy called LOAD-BALANCE under the forwarding option.

Type show command to view the configuration.

You can now view route forwarding table to verify.

You will see two next-hop MAC addresses for default destination network.

By default JunOS include only layer 3 IP address to determine the flow but you can change this behavior and include layer 4 as well. To do so hit the following command under [edit forwarding-options] hierarchy.

You can now see the logs or even do tracert from client PC and test the load sharing. You can test from a single PC in the network.

The post Load Balance Dual ISP Internet in Juniper SRX appeared first on MustBeGeek.

The post Configure Filter Based Load Balancing in Juniper SRX appeared first on MustBeGeek.

There are various tricks to configure load balancing in JunOS devices. Filter based forwarding and per flow load balancing methods are quite popular. These type of load balancing can be configured in many Juniper devices like, MX series, J series, SRX series, etc. Here, I will show steps to configure filter based load balancing in Juniper SRX device. In filter based forwarding, two routing tables are configured. Each table will have different ISP as their primary gateway and remaining opposite ISP as secondary gateway.

Configure Filter Based Load Balancing in Juniper SRX

We want to balance the traffic coming from internal network to the Internet using both ISP links. At first, we need to create two routing tables. Then, create firewall filter and create RIB groups. I will show the step by step process of the configuration. Below shown diagram is our scenario. We have two ISP links and two internal networks. We want to route 192.168.1.0/24 network via ISP A and ISP B will be the backup. Similarly, route 192.168.2.0/24 via ISP B and ISP A will be it’s backup.

Step 1: Create Routing Tables

At first, let’s create some routing tables. We need to create two routing tables. Routing tables are configured under [edit routing-instances] hierarchy. We will create routing tables named ISPA and ISPB.

Type show to view the configuration.

Now let’s configure ISPB routing instance.

Type show to view the configuration.

Step 2: Create Firewall Filters

Now, let’s create firewall filters.

Type show to view the firewall filter.

Now apply the filter in for each internal interface.

Step 3: Create RIB Group

RIB (Routing Information Base) group is created to share route information from master routing table to other custom routing tables. For inet family, master routing table is inet.o. As of now, routing tables ISPA and ISPB only knows the routes that have been configured while creating the routing instance. That is, the default route only. We need to copy all the routes from inet.0 to ISPA and ISPB routing tables to make the routing work properly. RIB group is configured under [edit routing-options] hierarchy.

You can verify the configuration by running traceroute from client PC in both network. You can also check the routing tables. To view the routing tables, type

This is how you configure filter based load balancing.

The post Configure Filter Based Load Balancing in Juniper SRX appeared first on MustBeGeek.

Install JunOS From Loader is a post from: MustBeGeek

In this post, I am going to talk about SRX 240 upgrade error. I was trying to upgrade SRX 240 H2 from JunOS 11.4R7.5 to JunOS 11.4R11.4. I got an Error saying, Please install a package with version 11.4R5 or Higher.

SRX 240 Error! Install Package Version 11.4R5 or Higher!

Here is the log of the error,

If you are facing similar issue, then don’t worry, this is a known issue. Solution of this problem is to downgrade JunOS to 11.4R5 or 11.4R5 and then upgrade to required JunOS version. This problem is known in SRX 240 B2 and H2 model numbers if you are upgrading or downgrading to 11.4R10 or higher JunOS version from 11.4R7/R8/R9 or 12.1R5/R6/R7 or 12.1X44-D10/D15/D20/D25. Visit this link for more information about this problem. You must have Juniper account to be able to login to this page.

SRX 240 Error! Install Package Version 11.4R5 or Higher! is a post from: MustBeGeek

Branch series Juniper SRX can operate at two different modes; packet mode and flow mode. In flow mode, SRX process all traffic by analyzing the state or session of traffic. In packet mode, SRX can process traffic as traditional router without analyzing the session of the traffic. By default, JunOS in SRX devices work at Flow mode. But if you want to operate it as a typical router then you can disable the security features like IPSec, NAT, UTM, etc. There are two ways to configure SRX mode to packet mode from flow mode in branch series SRX devices. First method shown in this post strictly converts to packet mode using set security forwarding-options command, whereas Second method allows the use of both packet and flow mode at the same time using firewall filters.

Configure SRX Mode to Packet Mode from Flow Mode

First Method

To view the existing flow mode type, show security flow status command in operational mode as shown below. As you can see it is now flow based forwarding mode, Inet forwarding mode: flow based.

We can change to packet mode by typing, set security forwarding-options family mpls mode packet-based command in configuration mode as shown below. Don’t forget to delete the security settings. 

After commit, you will get a warning saying, you must reboot the device for the change to take effect. After the reboot, issue show security flow status command.

Configure SRX Mode to Packet Mode from Flow Mode is a post from: MustBeGeek

Dynamic VPN or Remote Access VPN is a feature available in branch series SRX. By default, branch series SRX gateways come pre-installed with two dynamic VPN licenses. So by default, only two remote users can have dynamic VPN simultaneously. You can purchase additional license for more dynamic VPN users. Dynamic VPN is used by users from Internet to access the corporate LANs. The required VPN client for user’s machine can be downloaded from SRX’s web interface and is automatically installed. When the user logs into the SRX’s dynamic VPN web page, the VPN session on user’s PC is initiated and required VPN client is automatically downloaded without user interaction. You can also manually download and install JunOS Pulse which is a VPN client application. In this post, I will show steps to configure Dynamic (Remote Access) VPN in Juniper SRX.

Configure Dynamic (Remote Access) VPN in Juniper SRX

To view the existing license information, type show system license command as shown below. As you can see the number of dynamic-vpn installed license is 2 and the expiry is permanent.

The diagram below is our scenario for dynamic access VPN. Here, 10.0.0.0/24 is the protected network. We have Active Directory Domain Controller in the network. We want users to be able to access this protected network from the Internet.

Step 1. Configure Dynamic VPN Users and IP Address Pool

 Step 2. Configure IPSec Phase 1

Step 3. Configure IPSec Phase 2

Step 4. Configure Dynamic VPN Parameters

Step 5. Configure Security Policy

Step 6. Verifying IPSec Connection

You can download and install JunOS Pulse client application on user PCs. JunOS Pulse is a VPN client from Juniper. Users out on the internet can use this tool to connect to VPN. To use this tool, click Add (+) button. Uner type, choose SRX. Then type name of the connection. Type IP address or domain name of the SRX device. And then, click Add button.

After creating a new connection, click Connect button. The client will now attempt to connect.

Click Connect again on certificate warning. Now type username and password to connect to VPN.

In this way you can configure dynamic VPN in Juniper SRX and use JunOS Pulse to connect to VPN.

Configure Dynamic (Remote Access) VPN in Juniper SRX is a post from: MustBeGeek

Logs are important feature that can be very handy to troubleshoot or monitor networks. You can configure firewall filters in various Juniper devices. Juniper’s SRX, EX, MX, T and other series devices support stateless firewall filters. Firewall filters are like access control lists (ACLs) in Cisco world. Firewall filters can be used to allow or reject packets based on various match conditions. You can apply firewall filter to a port, VLAN, or layer 3 interface. A firewall filter can have multiple terms that define specific match conditions and actions. Firewall filters are executed from top to bottom. In this port, I will show steps to configure logging in Juniper firewall filter.

Configure Logging in Juniper Firewall Filter

Juniper firewall filters are made up of terms and match conditions. A filter can contain numerous terms. A term can contain various match conditions and actions. An example of firewall rule is shown below. The rule has two terms, T1 and T2. T1 matches traffic from any source address and destination port of 22 or 443 and has the action of accept. T2 has the action of reject. So only traffic matching destination port 22 or 443 will accepted by the interface fe-0/0/2, all other traffic will be dropped. Both terms have action of syslog. Syslog command logs all the packets of the corresponding terms.

The filter is applied to the interface,

There are also other match conditions and actions. You can match traffic based on source and destination IP address, mac address, port numbers, protocol numbers, dscp number, dot1q tag, icmp type, and many other. Remember, Juniper firewall filters are stateless and unidirectional. The filters won’t track states of the connection. Similarly, it also doesn’t care about return traffic. So you have option to apply firewall filters on both inbound (input) and outbound (output) traffic of an interface. To permit or deny transient traffic, you can apply firewall filters in transient interfaces. Likewise, to permit or deny traffic to Juniper device’s routing engine, you can apply firewall filter in loopback 0 interface. For example, to block SSG login attack you can create and apply firewall filter in loopback interface.

To view the log of firewall filter, create a custom syslog of firewall facility. Here is how you do that,

Now, to view the log of firewall filters, type

In this way you can configure firewall filter and monitor log in Juniper SRX device.

Configure Logging in Juniper Firewall Filter is a post from: MustBeGeek

It is often a requirement to split a broadcast traffic or to restrict communication between hosts within a same VLAN. Private VLAN or PVLAN is a feature that is used to split broadcast traffic or restrict communication between hosts within a same VLAN in a switch. Private VLANs can be configured on all models of Juniper switches. In this post, I will show steps to configure Private VLANs in Juniper Switch.

Configure Private VLANs in Juniper Switch

Private VLANs in Juniper switch can have four types of switch ports.

• Promiscuous Port – It is a trunk port on a switch that is connected uplink to Router or Firewall or servers. Promiscuous port can communicate with all other private VLAN ports within a private VLAN. The port is assigned member of primary VLAN and must be associated with 802.1Q tag. Trunk ports that are member of private VLANs are promiscuous port.
• Community Port – It is a private VLAN where hosts connected to ports in a same community VLAN can communicate with each others and can also communicate with promiscuous port of the same private VLAN. It is a secondary VLAN and the port is assigned member of primary VLAN.
• Isolated Port – The isolated port can’t communicate with other hosts connected to other isolated ports or community ports within a same private VLAN. Isolated port can communicate with promiscuous port and private VLAN trunk ports. If you want an Isolated port in a single switch then you don’t need to create VLAN for Isolated vlan. In Juniper switches, we have another flavor of Isolated port called inter-switch Isolated VLAN. This VLAN is used to pass traffic from one Isolated port of a switch to Isolated port of another switch through a PVLAN trunk. Inter-switch isolated VLAN must have secondary VLAN ID associated with it.
• PVLAN Trunk Port – It is the trunk port which is used to connect two or more switches when PVLAN is configured in all of these switches. The trunk port is member of all the private VLAN, the primary VLAN, community VLAN and inter-switch Isolated VLAN. Trunk ports that are member of private VLANs with pvlan-trunk command are PVLAN trunk ports.

Before creating private VLANs in Juniper switch, check whether current version of JunOS running on switch supports PVLAN feature or not. I am running JunOS 12.3R6.6 in EX3300 switch. Here is our simple scenario,

We have a single switch connected to a SRX gateway. In addition, we have two community VLANs, COMM-SALES-10 and COMM-MARKETING-20. Similarly, one Isolated VLAN with no VLAN ID because this is a single switch setup.

At first, let’s look at configuration of SRX. As the promiscuous trunk port (ge-0/0/0 of switch) is connected to port ge-0/0/0 of SRX, the port of SRX needs to understand the tagged frames sent by the switch. So we have to configure vlan tagging in SRX port in following way,

[edit interfaces ge-0/0/0]
root@SRX# show
vlan-tagging;
unit 100 {
    vlan-id 100;
    family inet {
        address 192.168.10.1/24;
    }
}

Now, let’s configure the switch step by step.

Step 1. Configure primary VLAN name and VLAN-ID of 100.

{master:0}[edit]
root@EX3300# set vlans PVLAN vlan-id 100 no-local-switching

Step 2. Configure the promiscuous trunk port.

{master:0}[edit interfaces ge-0/0/0]
root@EX3300# set unit 0 family ethernet-switching port-mode trunk
{master:0}[edit interfaces ge-0/0/0]
root@EX3300# set unit 0 family ethernet-switching vlan members PVLAN

Step 3. Assign promiscuous trunk port in primary VLAN.

{master:0}[edit vlans]
root@EX3300# set PVLAN interface ge-0/0/0

Step 4. Configure Access Ports. All community ports and isolated ports must be in access port mode.

{master:0}[edit]
root# set interfaces ge-0/0/3 unit 0 family ethernet-switching port-mode access
{master:0}[edit]
root# set interfaces ge-0/0/4 unit 0 family ethernet-switching port-mode access
{master:0}[edit]
root# set interfaces ge-0/0/5 unit 0 family ethernet-switching port-mode access

Step 5. Configure Community VLANs and assign ports to the community PVLANs.

{master:0}[edit vlans]
root@EX3300# set COMM-SALES-10 vlan-id 10
{master:0}[edit vlans]
root@EX3300# set COMM-SALES-10 primary-vlan PVLAN
{master:0}[edit vlans]
root@EX3300# set COMM-SALES-10 interface ge-0/0/3
{master:0}[edit vlans]
root@EX3300# set COMM-MARKETING-20 vlan-id 20
{master:0}[edit vlans]
root@EX3300# set COMM-MARKETING-20 primary-vlan PVLAN
{master:0}[edit vlans]
root@EX3300# set COMM-MARKETING-20 interface ge-0/0/4

Step 6. Assign port to Isolated PVLAN.

{master:0}[edit vlans]
root@EX3300# set PVLAN interface ge-0/0/5.0

To verify the configuration you can use following commands,

root@EX3300> show vlans 
root@EX3300> show vlans pvlan extensive
root@EX3300> show vlans extensive

Here is the output of vlan configuration.

{master:0}[edit vlans]
root# show
COMM-MARKETING-20 {
    vlan-id 20;
    interface {
        ge-0/0/4.0;
    }
    primary-vlan PVLAN;
}
COMM-SALES-10 {
    vlan-id 10;
    interface {
        ge-0/0/3.0;
    }
    primary-vlan PVLAN;
}
PVLAN {
    vlan-id 100;
    interface {
        ge-0/0/0.0; //This is promiscuous port. See step 2 and 3 above. 
        ge-0/0/5.0; //This is ISOLATED port. See step 6 above. 
    }
    no-local-switching;
}

Here is the output of show vlan command.

{master:0}[edit vlans]
root# run show vlans
Name           Tag     Interfaces
COMM-MARKETING-20 20
                       ge-0/0/0.0*, ge-0/0/4.0
COMM-SALES-10  10
                       ge-0/0/0.0*, ge-0/0/3.0
PVLAN          100
                       ge-0/0/0.0*, ge-0/0/3.0, ge-0/0/4.0, ge-0/0/5.0
__pvlan_PVLAN_ge-0/0/5.0__
                       ge-0/0/0.0*, ge-0/0/5.0
default
                       ge-0/0/2.0*, ge-0/0/8.0

Here is the output of show vlan PVLAN extensive command. You can see here Isolated 1, Community 2.

root# run show vlans PVLAN extensive
VLAN: PVLAN, Created at: Sun Jun 29 15:30:35 2014
802.1Q Tag: 100, Internal index: 2, Admin State: Enabled, Origin: Static
Private VLAN Mode: Primary
Protocol: Port Mode, Mac aging time: 300 seconds
Number of interfaces: Tagged 1 (Active = 1), Untagged  3 (Active = 0)
      ge-0/0/0.0*, tagged, trunk
      ge-0/0/3.0, untagged, access
      ge-0/0/4.0, untagged, access
      ge-0/0/5.0, untagged, access
Secondary VLANs: Isolated 1, Community  2, Inter-switch-isolated  0
  Isolated VLANs :
      __pvlan_PVLAN_ge-0/0/5.0__
  Community VLANs :
      COMM-MARKETING-20
      COMM-SALES-10

In this way you can configure private VLANs in Juniper switch.

Configure Private VLANs in Juniper Switch is a post from: MustBeGeek

TOR application allows users to browse any sites, by bypassing firewall. So all the policies, rules configured in SRX goes in vain if users in the network are using TOR application in their browsers. Juniper SRX can’t block TOR application but there is a work around method that can be used to block TOR application to some level. The steps shown here to block TOR application in Juniper SRX is not permanent fix as the IPs used by TOR application changes dynamically.

Block TOR Application in Juniper SRX

To block the TOR application in Juniper SRX, the only way I know to block is by blocking all the IP addresses used by TOR application. There is a site called www.dan.me.uk which finds the list of all the IP addresses used by TOR application, thanks to dan.me.uk.

You can view the list of all the IPs used by TOR application here. There can be about 6000 IP addresses which is quite a lot.

The trick is to use all these IPs in SRX and block them all by using firewall filter. There are 6K IP addresses, how can you put all that in firewall filter in shortcut. Again, the trick is to use Notepad++ application.

Step 1. Copy all the IP addresses from here and paste it in the Notepad++.

Step 2. Now, insert “;” after each IP address. You can do so by using Replace tool in Notepad++, as shown below. Find for “\r” and replace with “;”. Don’t forget to choose Extended option in under search mode in the same box.

Step 3. Now login to SRX and create a firewall filter. Before creating a firewall filter we have to create prefix-list under [edit policy-options] hierarchy.

{primary:node0}[edit policy-options prefix-list TOR-ADDRESS-LIST]
root@SRX# load merge terminal relative
[Type ^D at a new line to end input]

{primary:node0}[edit policy-options]
root@SRX# show
prefix-list TOR-ADDRESS-LIST {
    2.1.254.209/32;
    2.4.148.58/32;
    2.25.26.77/32;
    .
    .
    .
    .
    2.33.88.122/32;
}

Step 4. Now configure the firewall filter. You can also configure logging in SRX to view the logs later.

{primary:node0}[edit firewall filter BLOCK-TOR]
root@SRX# show
term TOR-LIST {
    from {
        source-prefix-list {
            TOR-ADDRESS-LIST;
        }
    }
    then {
        syslog;
        discard;
    }
}
term ALLOW-REST {
    then accept;
}

Step 5. Now apply the filter in Internet facing interface in inbound direction as shown below.

{primary:node0}[edit interfaces reth1]
root@SRX# show
description ****CONNECTED-TO-ISP1***;
redundant-ether-options {
    redundancy-group 1;
}
unit 0 {
    family inet {
        filter {
            input BLOCK-TOR;
        }
        address 100.10.10.2/30;
    }
}

In this way you can block TOR browsers used by your internal users to bypass the firewall.

Block TOR Application in Juniper SRX is a post from: MustBeGeek