It's basically the default SRX100B config [load factory default], but I deleted the --- fe-0/0/7 interface to remove ethernet-switching, and make it a true routed interface with an IP of 172.16.254.1.
The bottom line is, despite my efforts of following the Juniper literature and recommendations from forums on placing both interfaces in the same security zone, creating explicit security policies, etc, I have yet to be able to simply plug into either a 192.168.1.1 interface, or the 172.16.254.1 interface and be able to ping the opposite subnet. I even tried changing the hidden "deny-all" policy to "permit-any" ... but still no joy 😕
In other words, if I have 192.168.1.20 assigned to laptop and plugged into fe-0/0/1-6, I can ping 192.168.1.1, but cannot ping the other subnet 172.16.254.1. Similarly, if I plug into fe-0/0/7 interface and assign my laptop 172.16.254.20, I can ping 172.16.254.1 all day ... but of course cannot ping 192.168.1.1.
What I've tried thus far in multiple iterations:
- Placed both interfaces in the same default "trust" security zone.
- Changing the hidden/default deny-all policy with a permit-all (still a no-go).
- Create unique security policies and explicitly allowed access between 192.168.1.x and 172.16.254.x, etc.
I stepped away from Juniper for a bit after grabbing JNCIA and JNCIS-SEC, and knocked out the CCNP R/S track, but man ... I didn't think this simple setup would be such a pain.
So again, objective is to simply load default config, delete fe-0/0/7 ethernet-switching, then assign 172.16.254.1 to it. Then ensure I can connect a laptop to any interface and ping between both RVIs/subnets. What is the most simplified method of accomplishing this? Sheesh, how hard can pinging between two interfaces assigned to the same "trust" zone actually be? And yes, I'm away of the "intra-zone" traffic being blocked by default ... but as I've already stated, I set the "permit-any/all" command instead of the default "deny-any" but didnt' work!
Oh by the way, (second question/quirk) the SRX 100 interfaces have to be physically connected to actually be up. On other appliances, the RVIs stay up, even if something isn't connected. Is that just the way it is with the SRX?
Thanks in advance!
-Peace-