Hello,
Context: I'd like to be able to reach a destination network (78.x.y.z/32) via a specific interface (reth 1.112 : 172.28.x.2/30) from my source network (172.20.x.y/24). (I change the network for confidentiality):
So I just created a static route to this destination via the specific interface.
Then I created policies when I allow the traffic from source zone to the destination zone.
Results :
1) When I try to ping/traceroute from the juniper to this destination, the route is working.
I can see the "hops" on the specific interface that I specified in the route.
2) When I try to ping/traceroute from my source to this destination, the route doesn't work.
No ping answers, no hops in the traceroute results.
If you have any idea to help me to solve this ? Any debug commands ?
I'll give you the configuration that I setup.
Policies :
set security policies from-zone zone-destination to-zone zone-source policy permit-all match source-address any
set security policies from-zone zone-destination to-zone zone-source policy permit-all match destination-address any
set security policies from-zone zone-destination to-zone zone-source policy permit-all match application any
set security policies from-zone zone-destination to-zone zone-source policy permit-all then permit
set security policies from-zone zone-source to-zone zone-destination policy server-access match source-address any
set security policies from-zone zone-source to-zone zone-destination policy server-access match destination-address any
set security policies from-zone zone-source to-zone zone-destination policy server-access match application any
set security policies from-zone zone-source to-zone zone-destination policy server-access then permit
Route :
set routing-options static route 78.x.y.z/32 next-hop 172.28.x.1
Results :
Simple ping without specifying the source OK :
> ping 78.x.y.z
PING 78.x.y.z (78.x.y.z): 56 data bytes
64 bytes from 78.x.y.z: icmp_seq=0 ttl=254 time=4.238 ms
64 bytes from 78.x.y.z: icmp_seq=1 ttl=254 time=5.294 ms
^C
--- 78.x.y.z ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 4.238/4.766/5.294/0.528 ms
Traceroute OK :
> traceroute 78.x.y.z
traceroute to 78.x.y.z (78.x.y.z), 30 hops max, 40 byte packets
1 hop1 (172.28.x.1) 3.435 ms 1.262 ms 1.394 ms
2 hop2 (1.2.3.4) 2.344 ms 2.311 ms 2.357 ms
3 hop3 (78.x.y.z) 6.184 ms 5.215 ms 4.856 ms
Simple ping with source KO :
> ping 78.x.y.z source 172.20.x.254
PING 78.x.y.z (78.x.y.z): 56 data bytes
^C
--- 78.x.y.z ping statistics ---
854 packets transmitted, 0 packets received, 100% packet loss
Traceroute with source :
> traceroute 78.x.y.z source 172.20.x.254
traceroute to 78.x.y.z (78.x.y.z) from 172.20.x.254, 30 hops max, 40 byte packets
1 * * *
2 * * *
3 * *^C
Best Regards,
John