SRX

 View Only
last person joined: 23 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  Unable to ping lo0 interface on vSRX in GNS3

    Posted 06-28-2019 08:12

    Hello, 

     

    I am unable to ping the lo0 interface on my vSRX. I am labbing on the following topology.

     

    lo0.png

     

    This is a Firefly running on the GNS3 VM. Briefly, interfaces ge-0/0/0.0 and lo0.0 are in zone1 and ICMP traffic is allowed on this zone.  I cannot ping the lo0 interface on the vSRX. 

     

    I want to know if this is a GNS3/vSRX quirck, or have I actually misconfigured anything on the vSRX.  

    When I try to ping from the IOS-XR-1 towards ge-0/0/0 it works.

    RP/0/0/CPU0:ios#show ip int br
    Fri Jun 28 14:42:56.341 UTC
    
    Interface IP-Address Status Protocol
    Loopback0 10.1.1.1 Up Up
    MgmtEth0/0/CPU0/0 unassigned Shutdown Down
    GigabitEthernet0/0/0/0 192.168.12.1 Up Up
    GigabitEthernet0/0/0/1 unassigned Shutdown Down
    GigabitEthernet0/0/0/2 unassigned Shutdown Down
    GigabitEthernet0/0/0/3 unassigned Shutdown Down
    GigabitEthernet0/0/0/4 unassigned Shutdown Down
    GigabitEthernet0/0/0/5 unassigned Shutdown Down
    GigabitEthernet0/0/0/6 unassigned Shutdown Down
    GigabitEthernet0/0/0/7 unassigned Shutdown Down
    RP/0/0/CPU0:ios#ping 192.168.12.2
    Fri Jun 28 14:43:05.761 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms

    When I try to ping lo0.0 it fails, even though I have route.

    RP/0/0/CPU0:ios#ping 10.2.2.2
    Fri Jun 28 14:43:50.217 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
    .....
    RP/0/0/CPU0:ios#show route 10.2.2.2
    Fri Jun 28 14:44:48.044 UTC
    Routing entry for 10.2.2.2/32
    Known via "ospf 1", distance 110, metric 1, type intra area
    Installed Jun 28 14:19:47.906 for 00:25:00
    Routing Descriptor Blocks
    192.168.12.2, from 10.2.2.2, via GigabitEthernet0/0/0/0
    Route metric is 1
    No advertising protos.

    Oddly enough, pinging IOS-XR-1 from the vSRX with source lo0.0 works just fine. 

    root> ping 10.1.1.1 source 10.2.2.2
    PING 10.1.1.1 (10.1.1.1): 56 data bytes
    64 bytes from 10.1.1.1: icmp_seq=0 ttl=255 time=8.100 ms
    64 bytes from 10.1.1.1: icmp_seq=1 ttl=255 time=9.008 ms
    ^C
    --- 10.1.1.1 ping statistics ---
    2 packets transmitted, 2 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 8.100/8.554/9.008/0.454 ms

    Please see below configuration on the SRX 

    root> show configuration | display set
    set version 12.1X47-D15.4
    set system root-authentication encrypted-password "$1$a4EKwDdk$r.ylgf5ZoxYcwXf2xmmRb0"
    set system services ssh
    set system services web-management http interface ge-0/0/0.0
    set system syslog user * any emergency
    set system syslog file messages any any
    set system syslog file messages authorization info
    set system syslog file interactive-commands interactive-commands any
    set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval
    set interfaces ge-0/0/0 unit 0 family inet address 192.168.12.2/24
    set interfaces ge-0/0/1 unit 0 family inet address 192.168.23.2/24
    set interfaces lo0 unit 0 family inet address 10.2.2.2/32
    set protocols ospf area 0.0.0.0 interface ge-0/0/0.0
    set protocols ospf area 0.0.0.0 interface ge-0/0/1.0
    set protocols ospf area 0.0.0.0 interface lo0.0
    set security policies from-zone zone1 to-zone zone2 policy z1z2 match source-address any
    set security policies from-zone zone1 to-zone zone2 policy z1z2 match destination-address any
    set security policies from-zone zone1 to-zone zone2 policy z1z2 match application junos-icmp-all
    set security policies from-zone zone1 to-zone zone2 policy z1z2 then permit
    set security zones security-zone zone1 host-inbound-traffic system-services ping
    set security zones security-zone zone1 host-inbound-traffic system-services all
    set security zones security-zone zone1 host-inbound-traffic protocols ospf
    set security zones security-zone zone1 interfaces ge-0/0/0.0
    set security zones security-zone zone1 interfaces lo0.0
    set security zones security-zone zone2 host-inbound-traffic protocols ospf
    set security zones security-zone zone2 interfaces ge-0/0/1.0

    Any ideas or suggestions are appreciated.



  • 2.  RE: Unable to ping lo0 interface on vSRX in GNS3

     
    Posted 06-28-2019 08:32

    The configuration on Junos SRX looks fine to me. Maybe I missed something. But we can trouble shoot

     

    1. Turn on "monitor traffic interface ge-0/0/0.0" on SRX when you are pinging from Cisco. Check what source Cisco is using as source, ideally it should be 10.1.1.1. If not, try to specify a source on Cisco side 

    2. If Cisco is not using 10.1.1.1 as source address, check "show route x.x.x.x" on SRX and see if you have the route

     

     



  • 3.  RE: Unable to ping lo0 interface on vSRX in GNS3

     
    Posted 06-28-2019 08:35

    Did you try to capture the ICMP packets on the SRX interface when you initiate the ping from Cisco? It will tell you whether the packets are being received from the Cisco

     

    Here is an exmample - I am pinging lo0 address on this host from a directly connected neighbor.

    > monitor traffic interface xe-1/1/0 no-resolve matching icmp 
    verbose output suppressed, use <detail> or <extensive> for full protocol decode
    Address resolution is OFF.
    Listening on xe-1/1/0, capture size 96 bytes
    
    08:34:17.418307  In IP 7.7.7.1 > 68.86.11.52: ICMP echo request, id 62988, seq 63, length 64
    08:34:17.418335 Out IP truncated-ip - 24 bytes missing! 68.86.11.52 > 7.7.7.1: ICMP echo reply, id 62988, seq 63, length 64
    08:34:18.419149  In IP 7.7.7.1 > 68.86.11.52: ICMP echo request, id 62988, seq 64, length 64
    08:34:18.419170 Out IP truncated-ip - 24 bytes missing! 68.86.11.52 > 7.7.7.1: ICMP echo reply, id 62988, seq 64, length 64


  • 4.  RE: Unable to ping lo0 interface on vSRX in GNS3
    Best Answer

    Posted 06-28-2019 08:45
    Since both interfaces are part of a same security zone zone1, you have to create an intra-zone policy from zone1 to zone1 to ping the lo0 ip. Or remove lo0 from the zone config.






  • 5.  RE: Unable to ping lo0 interface on vSRX in GNS3

    Posted 06-28-2019 09:09

    For some reason which escapes me, this worked. 

     

    Added the following config on the SRX. 

    set security policies from-zone zone1 to-zone zone1 policy z1z1 match source-address any
    set security policies from-zone zone1 to-zone zone1 policy z1z1 match destination-address any
    set security policies from-zone zone1 to-zone zone1 policy z1z1 match application any
    set security policies from-zone zone1 to-zone zone1 policy z1z1 then permit
    

    And now the ping works just fine. 

    RP/0/0/CPU0:ios#ping 10.2.2.2 source 192.168.12.1
    Fri Jun 28 15:42:05.128 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms
    RP/0/0/CPU0:ios#ping 10.2.2.2 source 10.1.1.1
    Fri Jun 28 15:42:11.408 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

    But what gives ? The destination address of the echo requests is 10.2.2.2. When this traffic enters the SRX, it does through ge-0/0/0.0. For the SRX does this count as intra-zone traffic which is denied by default ? 

     



  • 6.  RE: Unable to ping lo0 interface on vSRX in GNS3

    Posted 06-28-2019 10:26

    Yes, since lo0 is configured as part of same zone (zone1) as incoming interface ge-0/0/0. 

     

    Host inbound traffic processing is given below:

    When the SRX receives traffic destined to itself, it first examines whether the destination IP of the traffic is the incoming interface IP. If so, the Junos OS checks to see if the service or protocol is allowed on that interface by referencing the configuration under the host-inbound-traffic statement for the zone or interface. If the traffic is permitted by the configuration under the host-inbound-traffic statement, then the Junos OS checks to see if there is a junos-host zone security policy.
    If there is a junos-host zone security policy that matches the traffic, the traffic is acted up on based on the action in the policy.
    If no junos-host zone security matches the traffic, then the traffic is permitted.


    If the traffic is destined for another interface IP other than the incoming interface (in this case lo0.0 ip), the device first evaluates security policies to determine if the traffic is allowed. It then the device examines the list of services and protocol s allowed on the destination interface by using the host-inbound-traffic statement within the corresponding zone.

     

     



  • 7.  RE: Unable to ping lo0 interface on vSRX in GNS3

    Posted 06-28-2019 08:58

    Hello,

    I am unable to ping the lo0.0 on the vSRX regardless of whatever source I use. Routing is fine, I have 10.2.2.2 in the IOS-XR-1 and I have the return routes in the routing table on the vSRX.

     

    RP/0/0/CPU0:ios#ping 10.2.2.2 source 10.1.1.1
    Fri Jun 28 15:26:12.963 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
    .....
    Success rate is 0 percent (0/5)
    RP/0/0/CPU0:ios#ping 10.2.2.2 source 192.168.12.1
    Fri Jun 28 15:26:35.392 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
    .....
    Success rate is 0 percent (0/5)
    RP/0/0/CPU0:ios#
    

    And the routes on the vSRX

    root> show route
    
    inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both
    
    10.1.1.1/32        *[OSPF/10] 01:10:09, metric 2
                        > to 192.168.12.1 via ge-0/0/0.0
    10.2.2.2/32        *[Direct/0] 02:50:49
                        > via lo0.0
    10.3.3.3/32        *[OSPF/10] 01:12:23, metric 2
                        > to 192.168.23.3 via ge-0/0/1.0
    192.168.12.0/24    *[Direct/0] 02:48:14
                        > via ge-0/0/0.0
    192.168.12.2/32    *[Local/0] 02:50:12
                          Local via ge-0/0/0.0
    192.168.23.0/24    *[Direct/0] 02:48:14
                        > via ge-0/0/1.0
    192.168.23.2/32    *[Local/0] 02:50:01
                          Local via ge-0/0/1.0
    224.0.0.5/32       *[OSPF/10] 02:50:58, metric 1
                          MultiRecv
    
    

    Regarding the packet capture, I used both monitor traffic interface on the vSRX and the embedded packet capture in GNS3.

    For some reason or another, I cannot see the packets on the vSRX monitor traffic command. However, the ICMP echo requests are visible in the GNS3 packet capture (see attached pcap).

    root> monitor traffic interface ge-0/0/0
    verbose output suppressed, use <detail> or <extensive> for full protocol decode
    Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
    Address resolution timeout is 4s.
    Listening on ge-0/0/0, capture size 96 bytes
    
    Reverse lookup for 224.0.0.5 failed (check DNS reachability).
    Other reverse lookup failures will not be reported.
    Use <no-resolve> to avoid reverse lookups on IP addresses.
    
    15:25:49.044108 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:25:54.669154  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:25:58.704670 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:04.184808  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:06.795161 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:14.121342  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:16.345768 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:21.996176  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, LS-Update, length 76
    15:26:23.006613 Out IP truncated-ip - 4 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, LS-Ack, length 44
    15:26:23.537140  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:24.626016 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:32.958452  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:33.806748 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:42.224985  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:42.808639 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:50.762522 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:26:52.164226  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:00.338248 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:01.419876  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:08.015357 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, LS-Update, length 60
    15:27:10.035525  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, LS-Ack, length 44
    15:27:10.224349 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:11.285635  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:19.000488 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:20.835210  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:28.291342 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:30.529253  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:37.381334 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:39.771659  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:45.411498 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:49.309079  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:54.248601 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:27:58.607523  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:28:02.778013 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    

    This is rather strange. But I cannot see the packets on the monitor traffic in the vSRX even when I ping ge-0/0/0.0, which works.

    RP/0/0/CPU0:ios#ping 192.168.12.2
    Fri Jun 28 15:33:30.793 UTC
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/7/19 ms
    
    root> monitor traffic interface ge-0/0/0
    verbose output suppressed, use <detail> or <extensive> for full protocol decode
    Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
    Address resolution timeout is 4s.
    Listening on ge-0/0/0, capture size 96 bytes
    
    Reverse lookup for 224.0.0.5 failed (check DNS reachability).
    Other reverse lookup failures will not be reported.
    Use <no-resolve> to avoid reverse lookups on IP addresses.
    
    15:33:11.029086 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:33:12.859759  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:33:18.580848 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:33:22.551047  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    15:33:28.206080 Out IP truncated-ip - 20 bytes missing! 192.168.12.2 > 224.0.0.5: OSPFv2, Hello, length 60
    15:33:31.787104  In IP 192.168.12.1 > 224.0.0.5: OSPFv2, Hello, length 60
    ^C
    6 packets received by filter
    0 packets dropped by kernel
    


  • 8.  RE: Unable to ping lo0 interface on vSRX in GNS3

    Posted 06-28-2019 09:03
    Since both interfaces are part of a same security zone zone1, you have to create an intra-zone policy from zone1 to zone1 to ping the lo0 ip. Or remove lo0 from the zone config