Hi,
I'm very new to Juniper and networking in general, and am trying to learn how to set up VLAN across our juniper equipment.
The goal is to segment our office network into 4 VLANs: internal, guest, telephony, video streaming. We're using an SRX300 firewall and two EX2200 switches. Currently, we have succesfully configured the firewall and switch with the basic default vlan serving DHCP for a 192.168.0.0/20 subnet.
I spent today fruitlessly fiddling with both the switch and firewall trying to set up a trunk on ge0/0/4.0 to be used for (at the moment) 1 vlan, called Telephony with an ID of 101, which I have attempted to associate with a DHCP pool of 192.168.16.0/24.
On the EX2200, I configured one port as a trunk and added the same vlan ID, and configured another port as access for this vlan. I get a self-assigned IP when I connect to the port.
I don't fully understand how VLANs work, and I'm pretty sure part of the problem is that I'm assigning an IP (192.168.16.1/24) wherever it asks me what the IP address is for the VLAN, which is probably incorrect.
Here is the readout of the show configuration command for the SRX300:
version 15.1X49-D45;
system {
host-name Mobifirewall;
time-zone GMT-8;
root-authentication {
encrypted-password “blahblahblahblah"; ## SECRET-DATA
}
name-server {
8.8.8.8;
8.8.4.4;
208.67.222.222;
208.67.220.220;
}
name-resolution {
no-resolve-on-input;
}
services {
ssh;
web-management {
https {
system-generated-certificate;
interface ge-0/0/1.0;
}
session {
idle-timeout 60;
}
}
dhcp {
router {
192.168.1.1;
192.168.16.1;
}
pool 192.168.0.0/20 {
address-range low 192.168.1.1 high 192.168.15.254;
name-server {
8.8.8.8;
8.8.4.4;
}
router {
192.168.1.1;
}
}
pool 192.168.16.0/24 {
address-range low 192.168.16.1 high 192.168.16.254;
exclude-address {
192.168.16.1;
}
name-server {
8.8.8.8;
8.8.4.4;
}
router {
192.168.16.1;
}
propagate-settings irb.0;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
ntp {
server us.ntp.pool.org;
}
}
security {
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set nsw_srcnat {
from zone Mobify;
to zone Internet;
rule nsw-src-interface {
match {
source-address 0.0.0.0/0;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone Mobify to-zone Internet {
policy All_Mobify_Internet {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
zones {
security-zone Mobify {
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
dhcp;
https;
ssh;
}
}
}
}
}
security-zone Internet {
interfaces {
ge-0/0/6.0 {
host-inbound-traffic {
system-services {
ping;
}
}
}
}
}
security-zone telephone {
host-inbound-traffic {
system-services {
dhcp;
ping;
https;
ssh;
}
}
interfaces {
irb.0 {
host-inbound-traffic {
system-services {
dhcp;
ping;
https;
ssh;
}
}
}
}
}
}
}
interfaces {
ge-0/0/1 {
unit 0 {
family inet {
address 192.168.1.1/20;
}
}
}
ge-0/0/4 {
gigether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching {
interface-mode trunk;
inner-vlan {
members Telephony;
}
}
}
}
ge-0/0/6 {
unit 0 {
family inet {
address 104.255.11.140/29;
}
}
}
irb {
unit 0 {
family inet {
address 192.168.16.1/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 104.255.11.137;
}
}
protocols {
l2-learning {
global-mode switching;
}
}
vlans {
Telephony {
description telephones;
vlan-id 101;
l3-interface irb.0;
switch-options {
interface ge-0/0/4.0;
}
}
}any help is much appreciated!
Thanks in advance
-Alex
latforms.xml.gz 100 % 257 Bytes/ 257 Bytes
