SRX

 View Only
last person joined: 2 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  fxp0 in mgmt vr but cant ping internet

    Posted 12-08-2023 18:04

    Hello ,

    I have cluster of SRX 380 , I have setup two 

    mgmt_junos.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both
     
    0.0.0.0/0          *[Static/5] 00:17:31
                        >  to 10.0.89.58 via fxp0.0
    10.0.89.0/24       *[Direct/0] 01:10:45
                        >  via fxp0.0
    10.0.89.10/32      *[Local/0] 01:10:45
                           Local via fxp0.0
     
    PRODUCTION.inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both
     
    0.0.0.0/0          *[Static/5] 07:50:59
                        >  to 192.168.60.1 via reth2.0
    10.0.89.0/24       *[Direct/0] 05:44:28
                        >  via reth3.0
    10.0.89.58/32      *[Local/0] 05:44:28
                           Local via reth3.0
    192.168.57.0/24    *[Direct/0] 07:55:14
                        >  via reth1.0
    192.168.57.1/32    *[Local/0] 07:55:14

    Production vr has all the traffic interfaces and default route in prod vrf is towards upstream router ; i can ping Internet from PROD VR 

    i have reth3 which is in PROD vr and has IP of 10.0.89.58 

    I have put fxp0 in mgmt_junos vr   and put nexthop as IP of reth3 because they fall in same subnet

    I cant ping Internet from management VR ;

    i tried putting next-table as PROD vr  but still not luck

    how can i ping internet from mgmt_junos vr



  • 2.  RE: fxp0 in mgmt vr but cant ping internet

    Posted 12-08-2023 20:07

    Can you do a trace route and determine where the path fails?

    I suspect one of two issues:

    The routing from the reth3 gateway onward is not working.

    The source nat rules on the reth3 internet path to not allow the translation of the mgmt VR ip address using that path.



    ------------------------------
    Steve Puluka BSEET - Juniper Ambassador
    IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP - Retired)
    http://puluka.com/home
    ------------------------------



  • 3.  RE: fxp0 in mgmt vr but cant ping internet

    Posted 12-09-2023 05:25

    Hello , Thanks a lot for your reply . it was indeed related to reth3 ; ports were in wrong vlan . after fixing ports , i can ping internet from both VRs

    mgmt_junos.inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both
     
    0.0.0.0/0          *[Static/5] 00:28:02
                        >  to 10.0.89.58 via fxp0.0
    10.0.89.0/24       *[Direct/0] 00:28:02
                        >  via fxp0.0
    10.0.89.10/32      *[Local/0] 00:28:02
                           Local via fxp0.0
    192.168.89.0/24    *[Static/5] 00:28:02
                        >  to 10.0.89.254 via fxp0.0
     
    PRODUCTION.inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both
     
    0.0.0.0/0          *[Static/5] 00:28:02
                        >  to 192.168.60.1 via reth2.0
    10.0.89.0/24       *[Direct/0] 00:28:02
                        >  via reth3.0
    10.0.89.58/32      *[Local/0] 00:28:02
                           Local via reth3.0
    192.168.57.0/24    *[Direct/0] 00:28:02
                        >  via reth1.0
    192.168.57.1/32    *[Local/0] 00:28:02

    root@B-PRI> ping 8.8.8.8 routing-instance mgmt_junos
    PING 8.8.8.8 (8.8.8.8): 56 data bytes
    64 bytes from 8.8.8.8: icmp_seq=0 ttl=60 time=19.093 ms
    ^C
    --- 8.8.8.8 ping statistics ---
    2 packets transmitted, 1 packets received, 50% packet loss
    round-trip min/avg/max/stddev = 19.093/19.093/19.093/0.000 ms
     
    {primary:node0}
    root@B-PRI> ping 8.8.8.8 routing-instance PRODUCTION
    PING 8.8.8.8 (8.8.8.8): 56 data bytes
    64 bytes from 8.8.8.8: icmp_seq=0 ttl=61 time=135.507 ms
    64 bytes from 8.8.8.8: icmp_seq=1 ttl=61 time=16.438 ms
    ^C
    --- 8.8.8.8 ping statistics ---

    However now i have strange issue ; i cannot resolve any hostname from any of the VR , i can however do telent to 8.8.8.8 on port 53

    root@B-PRI> ping google.com routing-instance mgmt_junos
    ping: cannot resolve google.com: Host name lookup failure
     
    {primary:node0}
    root@B-PRI> ping google.com routing-instance PRODUCTION
    ping: cannot resolve google.com: Host name lookup failure
     
    {primary:node0}

    root@B-PRI> show configuration |display set |match name-s
    set system name-server 8.8.8.8
    set system name-server 8.8.4.4
    set system name-server 1.1.1.1
     
    {primary:node0}

    root@B-PRI> telnet 8.8.8.8 port 53 routing-instance mgmt_junos
    Trying 8.8.8.8...
    Connected to 8.8.8.8.
    Escape character is '^]'.
    ^C^Z
    Suspended

    root@B-PRI> telnet 8.8.8.8 port 53 routing-instance PRODUCTION
    Trying 8.8.8.8...
    Connected to 8.8.8.8.
    Escape character is '^]'.

    show security flow session shows nothing related to dns

    Junos is 21.2R3-S2.9

    because of dns , the antimalware atp engine showing below

    Connection status: Server hostname lookup failed

    root@B-PRI> show services advanced-anti-malware status
    node0:
    --------------------------------------------------------------------------
    Server connection status:
      Server hostname: srxapi.eu-west-1.sky.junipersecurity.net
      Server port: 443
      Proxy hostname: None
      Proxy port: None
        Control Plane:
          Connection time: 2023-12-09 18:31:29 UTC
          Connection status: Server hostname lookup failed
        Service Plane:
          cluster1.node0
            Connection active number: 0
            Connection retry statistics: 1185
          cluster1.node1
            Connection active number: 0
            Connection retry statistics: 504



  • 4.  RE: fxp0 in mgmt vr but cant ping internet

    Posted 12-10-2023 09:43

    came accross a juniper articel which mentions that dns does not wrk from fxp in mgmt-junos vr

    SRX345 DNS query through fxp0 does not work when fxp0 belongs to routing instance mgmt_junos (juniper.net)

    Tried many options with nat and allowed everything from junos-host zone , still dns does not working from both routing instances .

    Although ping  and telnet on port 53 works . 

    show log flow-trace shows nothing . i am scratching my head what to do now 




  • 5.  RE: fxp0 in mgmt vr but cant ping internet

    Posted 12-10-2023 13:51

    The note that only the branch srx has this limitation is interesting.

    Perhaps if DNS still works from standard virtual router instances you could just create a routing instance called mgmt along with a mgmt zone and then assign the fxp.0 interface to this one and get the desired functionality.



    ------------------------------
    Steve Puluka BSEET - Juniper Ambassador
    IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP - Retired)
    http://puluka.com/home
    ------------------------------



  • 6.  RE: fxp0 in mgmt vr but cant ping internet

    Posted 12-10-2023 17:56
    Edited by skywalker_007 12-10-2023 17:57

    Hi , It does not even work from Standard VR ,-PRODUCTION . 

    This VR has interface which is connected to Internet . and dns resolution does not work from this VR also 




  • 7.  RE: fxp0 in mgmt vr but cant ping internet

     
    Posted 12-10-2023 22:09

    Can you try applying either of the command below:

    set system name-server 8.8.8.8 source-address   x.x.x.x

    or 

     set system name-server 8.8.8.8 routing-instance  <routing-instance>

    Regards,



    ------------------------------
    Brijil R
    ------------------------------



  • 8.  RE: fxp0 in mgmt vr but cant ping internet

    Posted 12-11-2023 03:29
    Edited by skywalker_007 12-11-2023 03:29

    Hello ,

    i tried both options , putting routing instance as well as source interface ( which belongs to PRODUCTION vr)

    i cant even resolve from PROD vr .