SRX

 View Only

IMPORTANT MODERATION NOTICE

This community is currently under full moderation, meaning  all posts will be reviewed before appearing in the community. Please expect a brief delay—there is no need to post multiple times. If your post is rejected, you'll receive an email outlining the reason(s). We've implemented full moderation to control spam. Thank you for your patience and participation.



Help a Junos newbie set up a dual-WAN SRX?

This thread has been viewed 3 times
  • 1.  Help a Junos newbie set up a dual-WAN SRX?

    Posted 05-31-2022 11:06
    I'm trying to set up an SRX with two consumer-style ISPs.

    Design goals:

    1. Concurrent IPSec/GRE tunnels over both ISPs. I think this means I need to put both WAN interfaces into VRFs.
    2. Handful of internal VLANs / security zones for inside purposes (internal/guest WiFi/management)
    3. Tagged handoff to internal L2 switches.
    4. Internal traffic NATs toward internet with failover based on ISP health (no load balancing requirement for internet-bound traffic)
    My first time through, I set up the internet-facing stuff in virtual-router type VRFs, peered them with the global table using BGP (over lt interfaces), monitored internet health with rpm-probes, and even managed a clunky route filter to withdraw routes based on RPM probe failures. ...But then I got overwhelmed by security zones and NAT with this setup.

    So, I'm taking a few steps back, looking for a simpler strategy with fewer moving parts.

    What VRF type should I use for the internet-facing interfaces?

    What route leaking strategy should I use?

    How can I tie that route leaking strategy to an RPM probe (or similar) to effect ISP failover?

    When I'm over this hurdle, I'll probably find myself similarly over my head in terms of security zones and NAT but hey, one thing at a time.

    Thanks!