Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: Configure srx240 to ISP

$
0
0

Create a firewal filter with the correct match conditions; You want the most specific term to be the first term and to also account for all other traffic. term accept-all-other should be the last term in the filter
==================================================================
set firewall family inet filter fbf-filter term to-server from source-address 192.168.34.0/24
set firewall family inet filter fbf-filter term to-server from destination-address 10.110.1.0/24
set firewall family inet filter fbf-filter term to-server then routing-instance To-Server
set firewall family inet filter fbf-filter term default-to-internet from source-address 192.160.34.0/24
set firewall family inet filter fbf-filter term default-to-internet then routing-instance To-Internet
set firewall family inet filter fbf-filter term accept-all-other then accept

 

NOTE*** if term to-server is not the first term, then insert term to-server before term default-to-internet
=======================================================
Apply it to the ingress interface
===================================================
set interfaces ge-0/0/1 unit 0 family inet filter input fbf-filter

This assuming that the incoming interface is ge-0/0/1.0 (just replace this interface with your incoming interface)

=================================================
Create the routing instances and the static routes
=================================================
set routing-instances To-Internet instance-type forwarding
set routing-instances To-Internet routing-options static route 0/0 next-hop 94.97.241.x

set routing-instances To-Server instance-type forwarding
set routing-instances To-Server routing-options static route 0.0.0.0/0 next-hop 10.110.4.1

=========================================================
Ensure that the routes are imported into the routing instances. I think this should get you going. You could be more specific by using routing policies from protocol direct and from interface ge-0/0/3 and ge-0/0/0 and plly those to the specific routing instances. Or you could also create a routing policy that only accepts the desired routes and apply it as an import-policy to the rib-group. For now test this. I dont know what I am missing yet.
========================================================

set routing-options interface-routes rib-group inet rib-group
set routing-options rib-groups rib-group import-rib inet.0
set routing-options rib-groups rib-group import-rib To-Internet.inet.0
set routing-options rib-groups rib-group import-rib to-server.inet.0


Viewing all articles
Browse latest Browse all 17645

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>