JNCIE-DC #128

This year (2018) is my year for Juniper. I got certification JNCIE-DC Juniper Networks Certified Internet Expert with number #128, It's mean 128 people got that certification in earth on 13th July 2018.

Second on December 2018, Juniper give me new badge 3A, due to pass JNCIA-Cloud. The JNCIA x 3 (or AAA) certification badge from Juniper Networks recognizes individuals who have developed a broad range of introductory skills across a number of networking technologies. Individuals have achieved the associate-level certifications for design (JNCDA), Junos OS (JNCIA-Junos) and Cloud (JNCIA-Cloud). A recipient of this badge is well-positioned to begin specialization in a variety of networking roles.

Junos Event Scripts Automation

Previously I have posted simple example for Junos Op Script or Operation Script, Now I'm posting simple example for On-box Scripts about Junos Event Scripts Automation when detect interface down and execute health check command to get realtime evidence.

awa@JUNOS# show event-options                  
May 30 17:41:20
policy LINK_DOWN_LOG {
    events snmp_trap_link_down;
    then {
        execute-commands {
            commands {
                "show interfaces extensive {$$.interface-name}";
            }
            output-filename show_interfaces_extensive;
            destination LOCAL_VAR_TMP;
            output-format text;
        }
    }
}
destinations {
    LOCAL_VAR_TMP {
        archive-sites {
            /var/tmp;
        }
    }
}

{master:0}[edit]

awa@JUNOS# 

How to test that event scripts ?

awa@JUNOS# run file list /var/tmp/ | grep show 
May 30 17:42:23 

{master:0}[edit]
awa@JUNOS# set interfaces xe-0/0/1 disable 
May 30 17:42:33

{master:0}[edit]
awa@JUNOS# commit           
May 30 17:42:43
configuration check succeeds
commit complete

{master:0}[edit]
awa@JUNOS# run file list /var/tmp/ | grep show    
May 30 17:42:50
JUNOS_20180530_174245_show_interfaces_extensive

{master:0}[edit]
awa@JUNOS# run file show /var/tmp/JUNOS_20180530_174245_show_interfaces_extensive | no-more 
May 30 17:43:06


root@JUNOS> show interfaces extensive "xe-0/0/1"

Physical interface: xe-0/0/1, Administratively down, Physical link is Up
  Interface index: 650, SNMP ifIndex: 512, Generation: 141
  Link-level type: Ethernet, MTU: 2000, LAN-PHY mode, Speed: 10Gbps, Duplex: Full-Duplex, BPDU Error: None, Loop Detect PDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled, Flow control: Disabled, Media type: Fiber
  Device flags   : Present Running
  Interface flags: Down SNMP-Traps Internal: 0x4000
  Link flags     : None
  CoS queues     : 8 supported, 8 maximum usable queues
  Hold-times     : Up 0 ms, Down 0 ms
  Current address: 02:05:86:71:2d:07, Hardware address: 02:05:86:71:2d:07
  Last flapped   : 2018-05-30 17:28:23 UTC (00:14:22 ago)
  Statistics last cleared: Never
  Traffic statistics:
   Input  bytes  :                    0                    0 bps
   Output bytes  :               176652                    0 bps
   Input  packets:                    0                    0 pps
   Output packets:                    0                    0 pps
   IPv6 transit statistics:
    Input  bytes  :                   0
    Output bytes  :                   0
    Input  packets:                   0
    Output packets:                   0
  Input errors:
    Errors: 0, Drops: 0, Framing errors: 0, Runts: 0, Policed discards: 0, L3 incompletes: 0, L2 channel errors: 0, L2 mismatch timeouts: 0, FIFO errors: 0, Resource errors: 0
  Output errors:
    Carrier transitions: 5, Errors: 0, Drops: 0, Collisions: 0, Aged packets: 0, FIFO errors: 0, HS link CRC errors: 0, MTU errors: 0, Resource errors: 0
  Egress queues: 8 supported, 4 in use
  Queue counters:       Queued packets  Transmitted packets      Dropped packets
    0              16045690984503098046                    0 16045690984503098046
    3              16045690984503098046                    0 16045690984503098046
    4              16045690984503098046                    0 16045690984503098046
    7              16045690984503098046                    0 16045690984503098046
  Queue number:         Mapped forwarding classes
    0                   best-effort
    3                   fcoe
    4                   no-loss
    7                   network-control
  Active alarms  : None
  Active defects : None
  MAC statistics:                      Receive         Transmit
    Total octets                             0           176652
    Total packets                            0                0
    Unicast packets                          0                0
    Broadcast packets                        0             4206
    Multicast packets                        0                0
    CRC/Align errors                         0                0
    FIFO errors                              0                0
    MAC control frames                       0                0
    MAC pause frames                         0                0
    Oversized frames                         0
    Jabber frames                            0
    Fragment frames                          0
    VLAN tagged frames                       0
    Code violations                          0
  MAC Priority Flow Control Statistics:
    Priority :  0                             0                0
    Priority :  1                             0                0
    Priority :  2                             0                0
    Priority :  3                             0                0
    Priority :  4                             0                0
    Priority :  5                             0                0
    Priority :  6                             0                0
    Priority :  7                             0                0
  Filter statistics:
    Input packet count                       0
    Input packet rejects                     0
    Input DA rejects                         0
    Input SA rejects                         0
    Output packet count                                       0
    Output packet pad count                                   0
    Output packet error count                                 0
    CAM destination filters: 2, CAM source filters: 0
  Packet Forwarding Engine configuration:
    Destination slot: 0 (0x00)
  CoS information:
    Direction : Output
    CoS transmit queue               Bandwidth               Buffer Priority   Limit
                              %            bps     %           usec
    0 best-effort            15     1500000000    15              0      low    none
    3 fcoe                   35     3500000000    35              0      low    none
    4 no-loss                35     3500000000    35              0      low    none
    7 network-control        15     1500000000    15              0      low    none
  Interface transmit statistics: Disabled

  Logical interface xe-0/0/1.0 (Index 565) (SNMP ifIndex 519) (HW Token 4094) (Generation 174)
    Flags: Device-Down SNMP-Traps 0x4004000 Encapsulation: ENET2
    Traffic statistics:
     Input  bytes  :                    0
     Output bytes  :                 3738
     Input  packets:                    0
     Output packets:                   89
    Local statistics:
     Input  bytes  :                    0
     Output bytes  :                 3738
     Input  packets:                    0
     Output packets:                   89
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :                    0                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                    0                    0 pps
    Protocol inet, MTU: 1986, Generation: 199, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
        Destination: 192.168.111/24, Local: 192.168.111.1, Broadcast: 192.168.111.255, Generation: 169

{master:0}[edit]

awa@JUNOS# 

Junos Op Script Hello World

This is example and demo uses Junos on-box script for hello world. Basically on-box script divide into 3: operational script (op script), commit script and event script. On this posting I will show you the very simple about op script.

# Running Op Script from operational mode

awa@JUNOS> show configuration system scripts 
op {
    file hello.slax;
    file show.slax;
}

{master:0}
awa@JUNOS> file list /var/db/scripts/op 

/var/db/scripts/op:
hello.slax
show.slax*

{master:0}
awa@JUNOS> file show /var/db/scripts/op/hello.slax 
version 1.0;

ns junos = "http://xml.juniper.net/junos/*/junos";
ns xnm = "http://xml.juniper.net/xnm/1.1/xnm";
ns jcs = "http://xml.juniper.net/junos/commit-scripts/1.0";

import "../import/junos.xsl";

match / {
    {
 

"Hello World";

    }
}

{master:0}
awa@JUNOS> op hello 
Hello World

{master:0}
awa@JUNOS> 

# Running Op Script from start shell
*not all op script can running from start shell

awa@JUNOS> start shell 
% cd /var/db/scripts/op
% ls -l
total 16
-rw-r--r—  1 awa  wheel  275 Jan  9 17:02 hello.slax
-rwxrws---  1 awa  wheel  442 Jan  8 16:29 show.slax
% cat hello.slax
version 1.0;

ns junos = "http://xml.juniper.net/junos/*/junos";
ns xnm = "http://xml.juniper.net/xnm/1.1/xnm";
ns jcs = "http://xml.juniper.net/junos/commit-scripts/1.0";

import "../import/junos.xsl";

match / {
    {
 

"Hello World";

    }
}
% cli op hello
Hello World

%

Juniper vSRX Flow-based to Packet-based

This posting explains how to change the forwarding mode on Juniper vSRX from flow-based to packet-based for IPv4 traffic.

Juniper vSRX 'show version'

So basically An Juniper vSRX can operate in two different modes: packet mode and flow mode. In flow mode, vSRX processes all traffic by analyzing the state or session of traffic. This is also called stateful processing of traffic. In packet mode, vSRX processes the traffic as a traditional router on a per-packet basis. This is also known as stateless processing of traffic. Security features like IPsec, NAT, UTM, and so on, do not work in packet mode. By default, Junos OS on Juniper vSRX devices works in flow mode.

Juniper vSRX or vSRX is virtual form of security platform from Juniper Networks, as we know appliance form called Juniper SRX or SRX.

1. To check the forwarding mode 'show security flow status'.

Juniper vSRX flow-based 'show security flow status'

2. To change Juniper vSRX from flow-based to packet-based, delete the security feature configuration then change the mode to packet-mode using following command and commit.

change the mode to packet-mode

3. Reboot the vSRX to make the changes effective.

reboot needed to change to packet mode

4. Once the vSRX is up after reboot, check the flow status again. As you can see, the forwarding mode is now packet-based.

Juniper vSRX packet-based

Runnng JUNOS CLI from Shell

This is one tips how to execute JUNOS CLI from shell ( BSD shell ).

Execute / running command from JUNOS CLI

lab@D23_EX4200> show version 

fpc0:

--------------------------------------------------------------------------

Hostname: D23_EX4200

Model: ex4200-48t

JUNOS Base OS boot [12.3R9.4]

JUNOS Base OS Software Suite [12.3R9.4]

JUNOS Kernel Software Suite [12.3R9.4]

JUNOS Crypto Software Suite [12.3R9.4]

JUNOS Online Documentation [12.3R9.4]

JUNOS Enterprise Software Suite [12.3R9.4]

JUNOS Packet Forwarding Engine Enterprise Software Suite [12.3R9.4]

JUNOS Routing Software Suite [12.3R9.4]

JUNOS Web Management [12.3R9.4]

JUNOS FIPS mode utilities [12.3R9.4]

{master:0}

lab@D23_EX4200>

Execute / running command from BSD shell

lab@D23_EX4200> start shell 

% cli show version

fpc0:

--------------------------------------------------------------------------

Hostname: D23_EX4200

Model: ex4200-48t

JUNOS Base OS boot [12.3R9.4]

JUNOS Base OS Software Suite [12.3R9.4]

JUNOS Kernel Software Suite [12.3R9.4]

JUNOS Crypto Software Suite [12.3R9.4]

JUNOS Online Documentation [12.3R9.4]

JUNOS Enterprise Software Suite [12.3R9.4]

JUNOS Packet Forwarding Engine Enterprise Software Suite [12.3R9.4]

JUNOS Routing Software Suite [12.3R9.4]

JUNOS Web Management [12.3R9.4]

JUNOS FIPS mode utilities [12.3R9.4]

%

Juniper JUNOS Configuration Check-out Failed

Below is one example / case of configuration check-out failed in Juniper JUNOS. Even JUNOS allow you to set command line, isn't sure the command is correct one, verify with commit check or straight with commit, you will see failed.

This example is interface access mode with VLAN member more than one members, if you want the interface with more than one member of VLAN, you must set port-mode trunk.

awa@D22_EX2200# show interfaces ge-1/0/7  

unit 0 {

    family ethernet-switching {

        port-mode access;

        vlan {

            members TEST;

        }

    }

}

awa@D22_EX2200# set interfaces ge-1/0/7 unit 0 family ethernet-switching port-mode access vlan members MGMT 

{master:1}[edit]

awa@D22_EX2200# show interfaces ge-1/0/7                                                                       

unit 0 {

    family ethernet-switching {

        port-mode access;

        vlan {

            members [ TEST MGMT ];

        }

    }

}

{master:1}[edit]

awa@D22_EX2200# commit                                                                                         

error: Access interface has more than one vlan member: and

error: configuration check-out failed

{master:1}[edit]

awa@D22_EX2200#

Juniper SRX 1500 Firewall Performance 9 Gbps (1518 bytes)

Product Overview

The SRX 1500 Services Gateway is a next-generation firewall and security services gateway offering outstanding protection, performance, scalability, availability, and security service integration. Designed for port density, a high-performance security services architecture, and seamless integration of networking and security in a single platform, the SRX 1500 is best suited for client protection in enterprise campus, regional headquarters or cloud-based security solutions with a focus on application visibility and control, intrusion prevention, and advanced threat protection. The SRX 1500 is powered by Junos OS, the industry-leading operating system that keeps the world’s largest and most mission-critical enterprise networks secure.

SRX 1500 is one of newest product from security family of Juniper Networks. Juniper SRX 1400 is a previous product with the similar performance and capacity with SRX 1500.

SRX 1400 SRX 1500
Form Factor 3U (3RU) 1U (3RU)
Firewall Performance    10 Gbps 10 Gbps
(max)
Firewall Performance       -  9 Gbps
(1518 bytes)

*performance of data is based on datasheet

I have tested with simple test for one of performance SRX 1500 in lab environment use traffic generator with parameter mention in datasheet 1518 bytes. Next time I will test Juniper SRX 1500 to get maximum firewall performance.

Datasheet Actual Test
Firewall Performance         9 Gbps 9227892208 bps
(1518 bytes)

- 9227892208 bps
- 768991 pps
- CPU: 33% (FPC)
- memory: 19% (FPC)

hermawan@SRX1500> show interfaces | match "Desc|rate" | except "0 pps"
    Description: ge-0/0/1.0 - 001
  Output rate    : 9227892208 bps (768991 pps)
    Description: xe-0/0/16.0 - 003
  Input rate     : 9227898200 bps (768991 pps)

hermawan@SRX1500> show security monitoring
                  Flow session   Flow session     CP session     CP session 
FPC PIC CPU Mem        current        maximum        current        maximum

  0   0  33  19              1        2097152              0              0

Bandwidth VS Speed

I have not updated this blog for long time, due to busy and enjoy with new role on my daily job. My current role is Sales Engineer or some of people say Solution Architect. This is very different with my previous role in mostly as Project and Support Engineer with daily activity hands-on devices. Sales Engineer is combine technical perspective and soft skill to communicate product and solution to customer.

Lets back to main topic 'Bandwidth VS Speed'.

Some of people understand bandwidth and speed is same but for actual both is very different meaning. Bandwidth is how much or how many or how wide the way go to destination or to reach destination or to get something from destination, the unit on internet network world is bit or byte. We can say bandwidth is capacity of the way go to destination. Speed is how fast the source go to destination or to get something from destination, the unit on internet network world is bit/s ( bit per second ) or byte/s ( byte per second ) Even bandwidth and speed is different meaning but the both is related, lets look below tested.

# Server (receiver):

$ iperf -u -s
------------------------------------------------------------
Server listening on UDP port 5001
Receiving 1470 byte datagrams
UDP buffer size:   107 KByte (default)
------------------------------------------------------------
[  3] local 10.0.1.5 port 5001 
connected with 10.0.1.10 port 65299
[  3]  0.0-10.0 sec  1.25 MBytes  1.05 Mbits/sec  0.008 ms    
0/893 (0%)

# Client (sender):
# Please look at below with bold text ( sentence is confusing ), Bandwidth value use Mbits/sec

$ iperf -u -c 10.0.1.5 -b 1M
------------------------------------------------------------
Client connecting to 10.0.1.5, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 9.00 KByte (default)
------------------------------------------------------------
[  3] local 10.0.1.10 port 65300 
connected with 10.0.1.5 port 5001
[ ID] Interval      Transfer     Bandwidth
[  3]  0.0-10.0 sec 1.25 MBytes  1.05 Mbits/sec
[  3] Server Report:
[  3]  0.0-10.0 sec  1.25 MBytes  1.05 Mbits/sec  0.003 ms 
0/893 (0%)
[  3] Sent 893 datagrams

Cisco Etherchannel or Aggregate Cause of Forwarding Loops

The Etherchannel is an aggregated set of several physical interface as a single logical interface. The purpose of Etherchannel is to provide greater capacity than a single avaibility physical interface. The creation of danger to avoid is forwarding loops, due to two interface or more connect to same device. The Spanning Tree Protocol (STP) should be avoid forwarding loops, but some condition for example channeling ports aren't consistent, intermittent physical layer can be reason of forwarding loops.

But don't worry if you are configuring good etherchannel, the physical port will remain down untul port-channel is up.

%EC-5-STAYDOWN: Fa0/1 will remain down as its port-channel Po1 is admin-down

Here is the output of Etherchannel didn't worked :

STP will keep one of physical port which incorrect configuration remain block (BLK).
The condition will be danger if both of port Fa0/1 and Fa0/2 should be as one port-channel keep in forward and loops will be happen.

SW1#show spanning-tree vlan 200

VLAN0200

  Spanning tree enabled protocol ieee

skip

Interface           Role Sts Cost      Prio.Nbr Type

------------------- ---- --- --------- -------- --------------------------------

Fa0/1               Root LRN 19        128.1    P2p 

Fa0/2               Altn BLK 19        128.2    P2p 

Fa0/3               Desg FWD 19        128.3    P2p 

To avoid forwarding loops, this is best practices to config Etherchannel L2.

Juniper Mini Lab with Virtual-Router v1.0

The mini lab Juniper is template topology and preconfig to test, verify feature or behaviour. This mini lab are contain several router and connected each other. The lab is using one physical router and create several virtual-router. Each virtual-router looks like as logical router, due to virtual-router can separate routing table.

From today and next I will use this mini lab for topology and preconfig.
Please find the parameter, topology and configuration

####
# Project name: Juniper Mini Lab with Virtual-Router
# Version: 1.0
# Code name: JMib_VR
# Short name: JMib_VR_v1.0
# Release date: 2013/10/20
####

#### The Parameter
# R1
- lt-0/0/0.14 172.16.14.1/24
- lt-0/0/0.15 172.16.15.1/24
# R2
- lt-0/0/0.23 172.16.23.2/24
- lt-0/0/0.24 172.16.24.2/24
# R3
- lt-0/0/0.32 172.16.23.3/24
- lt-0/0/0.35 172.16.35.3/24
# R4
- lt-0/0/0.41 172.16.14.4/24
- lt-0/0/0.42 172.16.24.4/24
# R5
- lt-0/0/0.51 172.16.15.5/24
- lt-0/0/0.53 172.16.35.5/24

#### The Topology

R1 -- R4 -- R2 -- R3
R1 -- R5 -------- R3

#### Configuration
## R1 -- R4
set interfaces lt-0/0/0 unit 14 description "R1.R4"
set interfaces lt-0/0/0 unit 14 encapsulation ethernet
set interfaces lt-0/0/0 unit 14 peer-unit 41
set interfaces lt-0/0/0 unit 14 family inet address 172.16.14.1/24
set interfaces lt-0/0/0 unit 41 description "R1.R4"
set interfaces lt-0/0/0 unit 41 encapsulation ethernet
set interfaces lt-0/0/0 unit 41 peer-unit 14
set interfaces lt-0/0/0 unit 41 family inet address 172.16.14.4/24
set routing-instances R1 instance-type virtual-router
set routing-instances R1 interface lt-0/0/0.14
set routing-instances R4 instance-type virtual-router
set routing-instances R4 interface lt-0/0/0.41

## R1 -- R5
set interfaces lt-0/0/0 unit 15 description "R1.R5"
set interfaces lt-0/0/0 unit 15 encapsulation ethernet
set interfaces lt-0/0/0 unit 15 peer-unit 51
set interfaces lt-0/0/0 unit 15 family inet address 172.16.15.1/24
set interfaces lt-0/0/0 unit 51 description "R1.R5"
set interfaces lt-0/0/0 unit 51 encapsulation ethernet
set interfaces lt-0/0/0 unit 51 peer-unit 15
set interfaces lt-0/0/0 unit 51 family inet address 172.16.15.5/24
set routing-instances R1 instance-type virtual-router
set routing-instances R1 interface lt-0/0/0.15
set routing-instances R5 instance-type virtual-router
set routing-instances R5 interface lt-0/0/0.51

## R2 -- R3
set interfaces lt-0/0/0 unit 23 description "R2.R3"
set interfaces lt-0/0/0 unit 23 encapsulation ethernet
set interfaces lt-0/0/0 unit 23 peer-unit 32
set interfaces lt-0/0/0 unit 23 family inet address 172.16.23.2/24
set interfaces lt-0/0/0 unit 32 description "R2.R3"
set interfaces lt-0/0/0 unit 32 encapsulation ethernet
set interfaces lt-0/0/0 unit 32 peer-unit 23
set interfaces lt-0/0/0 unit 32 family inet address 172.16.23.3/24
set routing-instances R2 instance-type virtual-router
set routing-instances R2 interface lt-0/0/0.23
set routing-instances R3 instance-type virtual-router
set routing-instances R3 interface lt-0/0/0.32

## R2 -- R4
set interfaces lt-0/0/0 unit 24 description "R2.R4"
set interfaces lt-0/0/0 unit 24 encapsulation ethernet
set interfaces lt-0/0/0 unit 24 peer-unit 42
set interfaces lt-0/0/0 unit 24 family inet address 172.16.24.2/24
set interfaces lt-0/0/0 unit 42 description "R2.R4"
set interfaces lt-0/0/0 unit 42 encapsulation ethernet
set interfaces lt-0/0/0 unit 42 peer-unit 24
set interfaces lt-0/0/0 unit 42 family inet address 172.16.24.4/24
set routing-instances R2 instance-type virtual-router
set routing-instances R2 interface lt-0/0/0.24
set routing-instances R4 instance-type virtual-router
set routing-instances R4 interface lt-0/0/0.42

## R3 -- R5
set interfaces lt-0/0/0 unit 35 description "R3.R5"
set interfaces lt-0/0/0 unit 35 encapsulation ethernet
set interfaces lt-0/0/0 unit 35 peer-unit 53
set interfaces lt-0/0/0 unit 35 family inet address 172.16.35.3/24
set interfaces lt-0/0/0 unit 53 description "R5.R3"
set interfaces lt-0/0/0 unit 53 encapsulation ethernet
set interfaces lt-0/0/0 unit 53 peer-unit 35
set interfaces lt-0/0/0 unit 53 family inet address 172.16.35.5/24
set routing-instances R3 instance-type virtual-router
set routing-instances R3 interface lt-0/0/0.35
set routing-instances R5 instance-type virtual-router
set routing-instances R5 interface lt-0/0/0.53

#### Verify
user@JunOS> #### Verify

user@JunOS> ping routing-instance R1 172.16.14.4 source 172.16.14.1 rapid 
PING 172.16.14.4 (172.16.14.4): 56 data bytes
!!!!!
--- 172.16.14.4 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.691/3.303/4.401/0.595 ms

user@JunOS> ping routing-instance R1 172.16.15.5 source 172.16.15.1 rapid 
PING 172.16.15.5 (172.16.15.5): 56 data bytes
!!!!!
--- 172.16.15.5 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.730/3.104/3.690/0.335 ms

user@JunOS> ping routing-instance R2 172.16.23.3 source 172.16.23.2 rapid 
PING 172.16.23.3 (172.16.23.3): 56 data bytes
!!!!!
--- 172.16.23.3 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.805/5.181/8.782/2.746 ms

user@JunOS> ping routing-instance R2 172.16.24.4 source 172.16.24.2 rapid 
PING 172.16.24.4 (172.16.24.4): 56 data bytes
!!!!!
--- 172.16.24.4 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.739/3.290/3.986/0.424 ms

user@JunOS> ping routing-instance R3 172.16.35.5 source 172.16.35.3 rapid 
PING 172.16.35.5 (172.16.35.5): 56 data bytes
!!!!!
--- 172.16.35.5 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.495/2.997/3.329/0.308 ms

Step by Step Juniper SRX Security Zone

I just little add for previous posting about Firewall Juniper SRX Implicit Deny. Sometime you rush to configure the SRX and forget to add policy permit in security zone. Lets remember again about OSI 7 layer and zoom in layer 2, layer 3 and layer 4 if working with firewall.

The scenario is JunOSRX (192.168.1.1/24) and XYZ server (192.168.1.11/24)

#### Layer 1 Connect physical cable between JunOSRX and XYZ

#### Layer 2 Check mac address XYZ in JunOSRX
#### If we can see XYZ mac address, it's mean Layer 1 and layer 2 is pass
user@JunOSRX> show arp 
MAC Address       Address         Name                      Interface     Flags
aa:bb:cc:dd:ee:01 192.168.1.11     192.168.1.11               ge-0/0/1.0    none
Total entries: 1

#### Layer 3 for XYZ in JunOSRX
user@JunOSRX> show configuration interfaces ge-0/0/1  
unit 0 {
    description "to XYZ";
    family inet {
        address 192.168.1.1/24;
    }
}

#### Sometime for fast, we skip check/define layer 4 and continue to check application layer with ping
#### Remember again, If play with firewall, layer 2, layer 3 and layer 4 should be pass

#### Verify Application Layer
user@JunOSRX> ping 192.168.1.11 source 192.168.1.1 rapid
PING 192.168.1.11 (192.168.1.11): 56 data bytes
.....
--- 192.168.1.11 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

#### Layer 4 Define Firewall Security/Rule/Policy
user@JunOSRX# show security zones security-zone TrustServer
interfaces {
    ge-0/0/1.0 {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
    }
}

#### Repeat verify Application Layer
user@JunOSRX> ping 192.168.1.11 source 192.168.1.1 rapid   
PING 192.168.1.11 (192.168.1.11): 56 data bytes
!!!!!
--- 192.168.1.11 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 3.002/3.867/4.676/0.686 ms