SRX

Current setup we have two lans, Lan1 on Port0 and Lan2 on Port1 both lans are routed to ISP-1 Port15. We recently added a second ISP service and would like to have all Lan1 traffic go to ISP-1 Port15 and all Lan2 traffic go to ISP-2 Port14. Lan1 and Lan2 do not need to talk to each other. Not sure how to route this.

While Lan2 and Lan1 do have different ip's and i could do a routing policy based on IP's i was hoping to do one based on ports. Found lots of help on load balancing and failover but not looking to do that. Cant find this type of setup when searching support articals, any ideas? 

Thanks!

Well if LAN 1 and LAN 2 don't need to talk and the two ISP networks are completely separate  you could just make two routing instances and place the associated interfaces into the their respective instances. They would then act independently of each other. 

Hi  dpelletier,

You can configure Filter based forwarding as per this KB article:

http://kb.juniper.net/InfoCenter/index?page=content&id=KB17223
http://kb.juniper.net/InfoCenter/index?page=content&id=KB22052

also IP monitoring with RPM will hep automatic route failover :

http://kb.juniper.net/InfoCenter/index?page=content&id=KB25052

Regards
rparthi
 

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated Too

Hi dpelletier,

The easiset way to achieve this is create a routing-instance (virtual router type) and add the New ISP (ISP-2) and LAN2 to the new routing instance.

On your default routing instnace create a default route poining to ISP1

set routing-options static route 0/0 next-hop x.x.x.x (ISP1)

On custom routing instnace create a default route as below.

set routing-instances TEST instance-type virtual-router
set routing-instances TEST interface ge-0/0/1.0
set routing-instances TEST interface ge-0/0/14.0
set routing-instances TEST routing-options static route 0.0.0.0/0 next-hop y.y.y.y (ISP2 IP)

Please put necessary security policies.

Thanks,

Suraj

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too

rsuraj

I have that entered but i think right now it is my security settings blocking my access. A "ping (External IP) interface ge-0/0/14.0" works but a "ping (External IP) interface ge-0/0/1.0 routing-instance TEST" fails.

Whats a good way to follow my security (like a debug) in juniper to see where it is currently routing traffic from my port 1.0?

Hi,

You need to apply flow traceoptions.

Below KB explains the configuration and details.

http://kb.juniper.net/InfoCenter/index?page=content&id=KB16110

Thanks,

Suraj

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too

rsuraj,

Thanks i had a bad firewall filter that was causing the issue. Resolved!