Thanks, I noow have updated firmare and things are starting to work as they should. I still have two issues I can't figure out though. At the moment I have two SRX 340 firewalls. THey are connected together via a vlan trunk (on all vlans). There is a Maintenance vlan configured that should be routable to all other vlans and VRRP providing a gateway IP for that VLAN. I also have a DHCP server configured on that vlan.
I have a laptop connected to a port on SRX 2 and that port is also on the maintenance vlan. I get an IP address without issue and can ping the l3 irb IP address on both SRX switches.
Problem 1 - I cannot ping the VRRP address. VRRP appears to work, one is in master and one is in backup mode but I cannot ping the shared IP. The accept-data flag is set.
Problem 2 - I have setup policies between vlans so my maintenance vlan can communicate with the other VLANs, however I cannot ping any vlan interfaces on SRX 1 (which is the VRRP master) from the laptop. The policies are set and incoming ping services are allowed on the interfaces.
Hopefully someone can help me solve these two issues. They may be related? I have included my configs below. They are almost the same, just different IP addresses, VRRP config and DHCP pools.
SRX1:
set version 15.1X49-D45
set system host-name OPS-KOC-A
set system time-zone GMT
set system root-authentication encrypted-password "$5$jAAwwN6v$Cd4FbXRkBh4d4hK2LxLyzUQE3DRf5HuDuXZUO936fr5"
set system name-server 208.67.222.222
set system name-server 208.67.220.220
set system name-resolution no-resolve-on-input
set system login user admin uid 2002
set system login user admin class super-user
set system login user admin authentication encrypted-password "$5$trBTfuvQ$fkkoVuImv1MC3mI6cH0EfsRmpkX5KmX8JdB2DRMu7Q."
set system services ssh
set system services telnet
set system services dhcp-local-server group g1 interface irb.20
set system services web-management http interface fxp0.0
set system syslog archive size 100k
set system syslog archive files 3
set system syslog user * any emergency
set system syslog file messages any critical
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands error
set system max-configurations-on-flash 5
set system max-configuration-rollbacks 5
set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval
set system ntp server us.ntp.pool.org
set security screen ids-option untrust-screen icmp ping-death
set security screen ids-option untrust-screen ip source-route-option
set security screen ids-option untrust-screen ip tear-drop
set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200
set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048
set security screen ids-option untrust-screen tcp syn-flood timeout 20
set security screen ids-option untrust-screen tcp land
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM match source-address any
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM match destination-address any
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM match application any
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM then permit
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM match source-address any
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM match destination-address any
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM match application any
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM then permit
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM match source-address any
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM match destination-address any
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM match application any
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM then permit
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM match source-address any
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM match destination-address any
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM match application any
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM then permit
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA match source-address any
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA match destination-address any
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA match application any
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA then permit
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA match source-address any
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA match destination-address any
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA match application any
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA then permit
set security zones security-zone NetworkManagement host-inbound-traffic system-services all
set security zones security-zone NetworkManagement interfaces irb.10 host-inbound-traffic system-services all
set security zones security-zone NetworkManagement interfaces irb.10 host-inbound-traffic protocols all
set security zones security-zone Maintenance host-inbound-traffic system-services all
set security zones security-zone Maintenance interfaces irb.20 host-inbound-traffic system-services all
set security zones security-zone Maintenance interfaces irb.20 host-inbound-traffic protocols all
set security zones security-zone IonMeters host-inbound-traffic system-services all
set security zones security-zone IonMeters interfaces irb.13 host-inbound-traffic system-services all
set security zones security-zone IonMeters interfaces irb.13 host-inbound-traffic protocols all
set security zones security-zone GeneralDeviceManagement host-inbound-traffic system-services all
set security zones security-zone GeneralDeviceManagement interfaces irb.9 host-inbound-traffic system-services all
set security zones security-zone GeneralDeviceManagement interfaces irb.9 host-inbound-traffic protocols all
set security zones security-zone EngineeringAccess host-inbound-traffic system-services all
set security zones security-zone EngineeringAccess interfaces irb.21 host-inbound-traffic system-services all
set security zones security-zone EngineeringAccess interfaces irb.21 host-inbound-traffic protocols all
set security zones security-zone DFR host-inbound-traffic system-services all
set security zones security-zone DFR interfaces irb.14 host-inbound-traffic system-services all
set security zones security-zone DFR interfaces irb.14 host-inbound-traffic protocols all
set security zones security-zone Internal
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members all
set interfaces ge-0/0/2 unit 0 family inet
set interfaces ge-0/0/3 unit 0 family inet
set interfaces ge-0/0/4 unit 0 family inet
set interfaces ge-0/0/5 unit 0 family inet
set interfaces ge-0/0/6 unit 0 family inet
set interfaces ge-0/0/7 unit 0 family inet
set interfaces fxp0 unit 0 family inet address 192.168.1.1/24
set interfaces irb unit 9 family inet address 10.207.10.3/23
set interfaces irb unit 10 family inet address 10.207.8.3/24
set interfaces irb unit 13 family inet address 10.207.50.3/23
set interfaces irb unit 14 family inet address 10.207.48.3/23
set interfaces irb unit 20 family inet address 10.207.22.3/24 vrrp-group 20 virtual-address 10.207.22.1
set interfaces irb unit 20 family inet address 10.207.22.3/24 vrrp-group 20 priority 200
set interfaces irb unit 20 family inet address 10.207.22.3/24 vrrp-group 20 accept-data
set interfaces irb unit 20 family inet address 10.207.22.3/24 vrrp-group 20 track interface irb.20 priority-cost 200
set interfaces irb unit 21 family inet address 10.207.24.3/21
set routing-options static route 0.0.0.0/0 next-hop 10.207.22.3
set protocols l2-learning global-mode switching
set access address-assignment pool p1 family inet network 10.207.22.0/24
set access address-assignment pool p1 family inet range r1 low 10.207.22.101
set access address-assignment pool p1 family inet range r1 high 10.207.22.125
set access address-assignment pool p1 family inet dhcp-attributes maximum-lease-time 2419200
set access address-assignment pool p1 family inet dhcp-attributes name-server 10.207.22.1
set access address-assignment pool p1 family inet dhcp-attributes router 10.207.22.1
set vlans Corp vlan-id 30
set vlans Corp l3-interface irb.30
set vlans DFR vlan-id 14
set vlans DFR l3-interface irb.14
set vlans Engineering vlan-id 21
set vlans Engineering l3-interface irb.21
set vlans GeneralDeviceManagement vlan-id 9
set vlans GeneralDeviceManagement l3-interface irb.9
set vlans Ion vlan-id 13
set vlans Ion l3-interface irb.13
set vlans Maintenance vlan-id 20
set vlans Maintenance l3-interface irb.20
set vlans NetworkManagement vlan-id 10
set vlans NetworkManagement l3-interface irb.10
set vlans Phones vlan-id 31
set vlans Phones l3-interface irb.31
set vlans VHF vlan-id 16
set vlans VHF l3-interface irb.16
set vlans Video vlan-id 32
set vlans Video l3-interface irb.32
SRX2
set version 15.1X49-D45
set system host-name SCC
set system time-zone GMT
set system root-authentication encrypted-password "$5$49q.90sE$fMyWz9qOLJzItFpRwrs6dIzKkNyIRdzVfpt4yXypD64"
set system name-server 208.67.222.222
set system name-server 208.67.220.220
set system name-resolution no-resolve-on-input
set system login user admin uid 2000
set system login user admin class super-user
set system login user admin authentication encrypted-password "$5$AO4gzXBq$iBIwPMvx7GthLZJzKjBR5TfIEXFZXIFjYBwlgyAult8"
set system services ssh
set system services telnet
set system services dhcp-local-server group g1 interface irb.20
set system services web-management http
set system syslog archive size 100k
set system syslog archive files 3
set system syslog user * any emergency
set system syslog file messages any critical
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands error
set system max-configurations-on-flash 5
set system max-configuration-rollbacks 5
set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval
set system ntp server us.ntp.pool.org
set security screen ids-option untrust-screen icmp ping-death
set security screen ids-option untrust-screen ip source-route-option
set security screen ids-option untrust-screen ip tear-drop
set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200
set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048
set security screen ids-option untrust-screen tcp syn-flood timeout 20
set security screen ids-option untrust-screen tcp land
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM match source-address any
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM match destination-address any
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM match application any
set security policies from-zone Maintenance to-zone NetworkManagement policy M-NM then permit
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM match source-address any
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM match destination-address any
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM match application any
set security policies from-zone NetworkManagement to-zone Maintenance policy M-NM then permit
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM match source-address any
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM match destination-address any
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM match application any
set security policies from-zone Maintenance to-zone GeneralDeviceManagement policy M-GDM then permit
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM match source-address any
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM match destination-address any
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM match application any
set security policies from-zone GeneralDeviceManagement to-zone Maintenance policy M-GDM then permit
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA match source-address any
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA match destination-address any
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA match application any
set security policies from-zone Maintenance to-zone EngineeringAccess policy M-EA then permit
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA match source-address any
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA match destination-address any
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA match application any
set security policies from-zone EngineeringAccess to-zone Maintenance policy M-EA then permit
set security zones security-zone Internal
set security zones security-zone NetworkManagement host-inbound-traffic system-services all
set security zones security-zone NetworkManagement interfaces irb.10 host-inbound-traffic system-services all
set security zones security-zone NetworkManagement interfaces irb.10 host-inbound-traffic protocols all
set security zones security-zone Maintenance host-inbound-traffic system-services all
set security zones security-zone Maintenance interfaces irb.20 host-inbound-traffic system-services all
set security zones security-zone Maintenance interfaces irb.20 host-inbound-traffic protocols all
set security zones security-zone IonMeters host-inbound-traffic system-services all
set security zones security-zone IonMeters interfaces irb.13 host-inbound-traffic system-services all
set security zones security-zone IonMeters interfaces irb.13 host-inbound-traffic protocols all
set security zones security-zone GeneralDeviceManagement host-inbound-traffic system-services all
set security zones security-zone GeneralDeviceManagement interfaces irb.9 host-inbound-traffic system-services all
set security zones security-zone GeneralDeviceManagement interfaces irb.9 host-inbound-traffic protocols all
set security zones security-zone EngineeringAccess host-inbound-traffic system-services all
set security zones security-zone EngineeringAccess interfaces irb.21 host-inbound-traffic system-services all
set security zones security-zone EngineeringAccess interfaces irb.21 host-inbound-traffic protocols all
set security zones security-zone DFR host-inbound-traffic system-services all
set security zones security-zone DFR interfaces irb.14 host-inbound-traffic system-services all
set security zones security-zone DFR interfaces irb.14 host-inbound-traffic protocols all
set security zones security-zone trust
set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members Maintenance
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members all
set interfaces ge-0/0/2 unit 0 family inet
set interfaces ge-0/0/3 unit 0 family inet
set interfaces ge-0/0/4 unit 0 family inet
set interfaces ge-0/0/5 unit 0 family inet
set interfaces ge-0/0/6 unit 0 family inet
set interfaces ge-0/0/7 unit 0 family inet
set interfaces ge-0/0/9 unit 0 family inet
set interfaces fxp0 unit 0 family inet address 192.168.1.2/24
set interfaces irb unit 9 family inet address 10.207.10.5/23
set interfaces irb unit 10 family inet address 10.207.8.5/24
set interfaces irb unit 13 family inet address 10.207.50.5/23
set interfaces irb unit 14 family inet address 10.207.48.5/23
set interfaces irb unit 20 family inet address 10.207.22.5/24 vrrp-group 20 virtual-address 10.207.22.1
set interfaces irb unit 20 family inet address 10.207.22.5/24 vrrp-group 20 priority 100
set interfaces irb unit 20 family inet address 10.207.22.5/24 vrrp-group 20 accept-data
set interfaces irb unit 20 family inet address 10.207.22.5/24 vrrp-group 20 track interface irb.20 priority-cost 100
set interfaces irb unit 21 family inet address 10.207.24.5/21
set routing-options static route 0.0.0.0/0 next-hop 10.207.22.5
set protocols l2-learning global-mode switching
set access address-assignment pool p1 family inet network 10.207.22.0/24
set access address-assignment pool p1 family inet range r1 low 10.207.22.126
set access address-assignment pool p1 family inet range r1 high 10.207.22.150
set access address-assignment pool p1 family inet dhcp-attributes maximum-lease-time 2419200
set access address-assignment pool p1 family inet dhcp-attributes name-server 10.207.22.1
set access address-assignment pool p1 family inet dhcp-attributes router 10.207.22.1
set vlans Corp vlan-id 30
set vlans Corp l3-interface irb.30
set vlans DFR vlan-id 14
set vlans DFR l3-interface irb.14
set vlans Engineering vlan-id 21
set vlans Engineering l3-interface irb.21
set vlans GeneralDeviceManagement vlan-id 9
set vlans GeneralDeviceManagement l3-interface irb.9
set vlans Ion vlan-id 13
set vlans Ion l3-interface irb.13
set vlans Maintenance vlan-id 20
set vlans Maintenance l3-interface irb.20
set vlans NetworkManagement vlan-id 10
set vlans NetworkManagement l3-interface irb.10
set vlans Phones vlan-id 31
set vlans Phones l3-interface irb.31
set vlans VHF vlan-id 16
set vlans VHF l3-interface irb.16
set vlans Video vlan-id 32
set vlans Video l3-interface irb.32