I would like to configure a SRX 220 for 2 separate (aftermarket) access points.
Please let me know if anything sticks out that I have missed
- I haven't tried this configuration yet, but hoped to run it by the100% of you out there that know better than I do. I'm concerned the propagate-settings portion isn't correct.
set system services dhcp pool 192.168.1.0/24 address-range low 192.168.1.2 high 192.168.1.99 set system services dhcp pool 192.168.1.0/24 maximum-lease-time 86400 set system services dhcp pool 192.168.1.0/24 default-lease-time 86400 set system services dhcp pool 192.168.1.0/24 router 192.168.1.1 set system services dhcp pool 192.168.1.0/24 server-identifier 192.168.1.1 set system services dhcp pool 192.168.1.0/24 propagate-settings fe-0/0/7 set system services dhcp pool 192.168.2.0/24 address-range low 192.168.2.2 high 192.168.2.99 set system services dhcp pool 192.168.2.0/24 maximum-lease-time 86400 set system services dhcp pool 192.168.2.0/24 default-lease-time 86400 set system services dhcp pool 192.168.2.0/24 router 192.168.2.1 set system services dhcp pool 192.168.2.0/24 server-identifier 192.168.2.1 set system services dhcp pool 192.168.2.0/24 propagate-settings fe-0/0/7 set interfaces interface-range interfaces-trust member ge-0/0/0 set interfaces interface-range interfaces-trust member ge-0/0/1 set interfaces interface-range interfaces-trust member fe-0/0/2 set interfaces interface-range interfaces-trust member fe-0/0/3 set interfaces interface-range interfaces-trust member fe-0/0/4 set interfaces interface-range interfaces-trust member fe-0/0/5 set interfaces interface-range interfaces-trust unit 0 family ethernet-switching vlan members vlan-trust set interfaces fe-0/0/6 unit 4 family ethernet-switching vlan members dmz-trust set interfaces fe-0/0/7 unit 0 description "To Cable Modem" set interfaces fe-0/0/7 unit 0 family inet dhcp set interfaces vlan unit 0 family inet address 192.168.1.1/24 set interfaces vlan unit 4 family inet address 192.168.2.1/24 set vlans vlan-trust vlan-id 3 set vlans vlan-trust l3-interface vlan.0 set vlans dmz-trust vlan-id 4 set vlans dmz-trust l3-interface vlan.4 set security nat source rule-set trust-to-untrust from zone trust set security nat source rule-set trust-to-untrust to zone untrust set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0 set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface set security nat source rule-set dmz-to-untrust from zone dmz-trust set security nat source rule-set dmz-to-untrust to zone untrust set security nat source rule-set dmz-to-untrust rule source-nat-rule match source-address 0.0.0.0/0 set security nat source rule-set dmz-to-untrust rule source-nat-rule then source-nat interface set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces vlan.0 set security zones security-zone dmz-trust host-inbound-traffic system-services all set security zones security-zone dmz-trust host-inbound-traffic protocols all set security zones security-zone dmz-trust interfaces vlan.4 set security zones security-zone untrust screen untrust-screen set security zones security-zone untrust interfaces fe-0/0/7.0 set security zones security-zone untrust interfaces fe-0/0/7.0 host-inbound-traffic system-services dhcp set security policies from-zone trust to-zone trust policy default-permit match source-address any set security policies from-zone trust to-zone trust policy default-permit match destination-address any set security policies from-zone trust to-zone trust policy default-permit match application any set security policies from-zone trust to-zone trust policy default-permit then permit set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit set security policies from-zone dmz-trust to-zone dmz-trust policy default-permit match source-address any set security policies from-zone dmz-trust to-zone dmz-trust policy default-permit match destination-address any set security policies from-zone dmz-trust to-zone dmz-trust policy default-permit match application any set security policies from-zone dmz-trust to-zone dmz-trust policy default-permit then permit set security policies from-zone dmz-trust to-zone untrust policy trust-to-untrust match source-address any set security policies from-zone dmz-trust to-zone untrust policy trust-to-untrust match destination-address any set security policies from-zone dmz-trust to-zone untrust policy trust-to-untrust match application any set security policies from-zone dmz-trust to-zone untrust policy trust-to-untrust then permit
P.S. I do understand some of the challenges users will face with these devices being on a separate network. I see this more or less as a baby step.