Hello,
I started by deleting everything:
delete vlans, interfaces vlan, security zones security-zone trust interfaces, etc. (figured I start from scratch).
I successfully setup my cluster:
Cluster ID: 1 Node Priority Status Preempt Manual failover Redundancy group: 0 , Failover count: 1 node0 100 primary no no node1 99 secondary no no Redundancy group: 1 , Failover count: 2 node0 100 secondary no no node1 99 primary no no
My swfab interfaces:
swfab0: Name Status ge-0/0/4 up
swfab1: Name Status ge-3/0/4 up
Assigned physical interfaces (reth):
set interfaces ge-0/0/2 gigether-options redundant-parent reth2 set interfaces ge-3/0/2 gigether-options redundant-parent reth2
reth2 unit 0 gets static IP assigned by my ISP xxx.xx.xxx.xxx/29
cables from ge-0/0/2 and ge-3/0/2 connect to the back of ISP's modem.
After that I did:
set security zones security-zone Untrust interfaces reth2.0 host-inbound-traffic system-services ssh set security zones security-zone Untrust interfaces reth2.0 host-inbound-traffic system-services https set security zones security-zone Untrust interfaces reth2.0 host-inbound-traffic system-services ping
Default route points to my ISP's GW:
set routing-options static route 0.0.0.0/0 next-hop xxx.xx.xxx.xxx
Next:
set security zones security-zone Trust description "LAN" set security zones security-zone Untrust description "Outside" set security zones security-zone Trust host-inbound-traffic protocols all set security zones security-zone Trust host-inbound-traffic system-services all
Added all the necessary system services, added myself as a 'super-user'.
I'm able to SSH into SRX and I also have access to J-Web.
I want to be able to plug my Linux boxes into: ge-0/0/0 and ge-3/0/0 and get access to Internet, so I do this:
set interfaces ge-0/0/0 unit 0 family inet address 10.1.0.10/24 set interfaces ge-3/0/0 unit 0 family inet address 10.2.0.20/24 set security zones security-zone Trust interfaces ge-0/0/0.0 host-inbound-traffic system-services ping set security zones security-zone Trust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh set security zones security-zone Trust interfaces ge-0/0/0.0 set security zones security-zone Trust interfaces ge-3/0/0.0 host-inbound-traffic system-services ping set security zones security-zone Trust interfaces ge-3/0/0.0 host-inbound-traffic system-services ssh set security zones security-zone Trust interfaces ge-3/0/0.0 et security zones security-zone Trust address-book address network_101 10.1.0.0/24 set security zones security-zone Trust address-book address network_102 10.2.0.0/24 et security policies from-zone Trust to-zone Untrust policy allow-Internal-Clients match source-address network_101 set security policies from-zone Trust to-zone Untrust policy allow-Internal-Clients match source-address network_102 set security policies from-zone Trust to-zone Untrust policy allow-Internal-Clients match destination-address any set security policies from-zone Trust to-zone Untrust policy allow-Internal-Clients match application any set security policies from-zone Trust to-zone Untrust policy allow-Internal-Clients then permit set security policies from-zone Trust to-zone Trust policy allow-Internal-Clients match source-address network_101 set security policies from-zone Trust to-zone Trust policy allow-Internal-Clients match source-address network_102 set security policies from-zone Trust to-zone Trust policy allow-Internal-Clients match destination-address any set security policies from-zone Trust to-zone Trust policy allow-Internal-Clients match application any set security policies from-zone Trust to-zone Trust policy allow-Internal-Clients then permit
source NAT:
set security nat source rule-set Internal-to-Internet from zone Trust set security nat source rule-set Internal-to-Internet to zone Untrust set security nat source rule-set Internal-to-Internet rule Internet-Access match source-address 10.1.0.0/24 set security nat source rule-set Internal-to-Internet rule Internet-Access match source-address 10.2.0.0/24 set security nat source rule-set Internal-to-Internet rule Internet-Access match destination-address 0.0.0.0/0 set security nat source rule-set Internal-to-Internet rule Internet-Access then source-nat interface
Since I deleted entries (vlans, etc.) from my config, I think this is why I have trouble accessing Internet from LAN.
I try to ping from one of my Linux boxes (ping 8.8.8.8) connected to ge-0/0/0 and I get: Network is unreachable.
Now I have no clue on how to fix it and make it work. What steps did I miss?
Any help would be greatly appreciated!
Thank you.