SRX

Expand all | Collapse all

Can't ping from SRX to host and from host to SRX

Jump to Best Answer
  • 1.  Can't ping from SRX to host and from host to SRX

    Posted 07-26-2018 10:21

    Hello,

     

    I'm new with Juniper and looking forward for help. I have basic configuration (which will change in near future). So i want to have few VLANS over same Interface ge-0/0/4  (for now it's only 1), but i have an issue with services - can't ping from SRX to Host and back. I red Juniper KB but i can't find solution so far....

    system {
        root-authentication {
            encrypted-password ""; ## SECRET-DATA
        }
        name-server {
            208.67.222.222;
            208.67.220.220;
        }
        services {
            ssh;
            telnet;
            xnm-clear-text;
            web-management {
                http {
                    interface vlan.0;
                }
                https {
                    system-generated-certificate;
                    interface vlan.0;
                }
            }
            dhcp {
                router {
                    192.168.1.1;
                }
                pool 192.168.1.0/24 {
                    address-range low 192.168.1.2 high 192.168.1.254;
                }
                propagate-settings ge-0/0/0.0;
            }
        }
        syslog {
            archive size 100k files 3;
            user * {
                any emergency;
            }
            file messages {
                any critical;
                authorization info;
            }
            file interactive-commands {
                interactive-commands error;
            }
        }
        max-configurations-on-flash 5;
        max-configuration-rollbacks 5;
        license {
            autoupdate {
                url https://ae1.juniper.net/junos/key_retrieval;
            }
        }
    }
    security {
        screen {
            ids-option untrust-screen {
                icmp {
                    ping-death;
                }
                ip {
                    source-route-option;
                    tear-drop;
                }
                tcp {
                    syn-flood {
                        alarm-threshold 1024;
                        attack-threshold 200;
                        source-threshold 1024;
                        destination-threshold 2048;
                        timeout 20;
                    }
                    land;
                }
            }
        }
        nat {
            source {
                rule-set trust-to-untrust {
                    from zone trust;
                    to zone untrust;
                    rule source-nat-rule {
                        match {
                            source-address 0.0.0.0/0;
                        }
                        then {
                            source-nat {
                                interface;
                            }
                        }
                    }
                }
            }
        }
        policies {
            from-zone trust to-zone untrust {
                policy trust-to-untrust {
                    match {
                        source-address any;
                        destination-address any;
                        application any;
                    }
                    then {
                        permit;
                    }
                }
            }
            from-zone Internal to-zone Internal {
                policy Inter_to_Inter {
                    match {
                        source-address any;
                        destination-address any;
                        application any;
                    }
                    then {
                        permit;
                    }
                }
            }
        }
        zones {
            security-zone trust {
                host-inbound-traffic {
                    system-services {
                        all;
                    }
                    protocols {
                        all;
                    }
                }
                interfaces {
                    vlan.0;
                }
            }
            security-zone untrust {
                screen untrust-screen;
                interfaces {
                    ge-0/0/0.0 {
                        host-inbound-traffic {
                            system-services {
                                dhcp;
                                tftp;
                            }
                        }
                    }
                }
            }
            security-zone Internal {
                host-inbound-traffic {
                    system-services {
                        all;
                    }
                    protocols {
                        all;
                    }
                }
                interfaces {
                    ge-0/0/4.100 {
                        host-inbound-traffic {
                            system-services {
                                ping;
                                all;
                            }
                            protocols {
                                all;
                            }
                        }
                    }
                }
            }
        }
    }
    interfaces {
        ge-0/0/0 {
            unit 0;
        }
        ge-0/0/1 {
            unit 0 {
                family ethernet-switching {
                    vlan {
                        members vlan-trust;
                    }
                }
            }
        }
        ge-0/0/2 {
            unit 0 {
                family ethernet-switching {
                    vlan {
                        members vlan-trust;
                    }
                }
            }
        }
        ge-0/0/3 {
            unit 0 {
                family ethernet-switching {
                    vlan {
                        members vlan-trust;
                    }
                }
            }
        }
        ge-0/0/4 {
            vlan-tagging;
            unit 100 {
                vlan-id 100;
                family inet {
                    address 10.10.2.254/24;
                }
            }
        }
        vlan {
            unit 0 {
                family inet {
                    address 192.168.1.1/24;
                }
            }
        }
    }
    protocols {
        stp;
    }
    vlans {
        vlan-trust {
            vlan-id 3;
            l3-interface vlan.0;
        }
    }
    

     

    Ping from SRX cli to interface gw works



  • 2.  RE: Can't ping from SRX to host and from host to SRX
    Best Answer

     
    Posted 07-26-2018 14:47

    Is the host you are trying to ping in the same 10.10.2.0/24 subnet as your ge-0/0/4 interface?

    If not do you have a route to that subnet on the SRX?

     

    I assume your switch port is configured to accept the 100 vlan tag for this interface.

     

    When you ping the host what is in the SRX arp table?

    show arp

     

     

     



  • 3.  RE: Can't ping from SRX to host and from host to SRX

    Posted 07-26-2018 22:43

    You are a life saver mate 🙂 because of my stupidity i forgot to place that one port to untagged VLAN. Now it works like charm!