SRX

I have two laptops connected to two difference interfaces, laptop#1 is setup on fe-0/0/0.0 which has a static ip.  Laptop#2 is on vlan.0 with dhcp.  Both fe-0/0/0.0 and vlan.0 are in the trust zone and configured to permit all host inbound traffic system services/protocols.  Policies have been configured to allow trust to trust traffic.  However, the laptops are unable to ping each other, I get destination host unreachable.  Laptop#2 can ping the other devices on the vlan.0 fine. 

set security zones security-zone trust interfaces fe-0/0/0.0 host-inbound-traffic system-services all
set security zones security-zone trust interfaces fe-0/0/0.0 host-inbound-traffic protocols all

set security zones security-zone trust interfaces vlan.0 host-inbound-traffic system-services all
set security zones security-zone trust interfaces vlan.0 host-inbound-traffic protocols all

set security policies from-zone trust to-zone trust policy trust-to-trust match source-address any
set security policies from-zone trust to-zone trust policy trust-to-trust match destination-address any
set security policies from-zone trust to-zone trust policy trust-to-trust match application any
set security policies from-zone trust to-zone trust policy trust-to-trust then permit

please attach the complete config of you srx, so people over here can have look and try to help you

## Last changed: 2015-02-04 02:13:16 UTC
version 12.1X44-D35.5;
system {
    root-authentication {
        encrypted-password "$1$iAmgr82d4yIN3eDBUR93rN0W55555TY"; ## SECRET-DATA
    }
    name-server {
        8.8.8.8;
    }
    services {
        ssh;
        web-management {
            https {
                system-generated-certificate;
                interface [ fe-0/0/0.0 vlan.0 ];
            }
        }
        dhcp {
            default-lease-time 3200;
            domain-name srx100;
            name-server {
                8.8.8.8;
                8.8.4.4;
            }
            router {
                10.2.2.8;
            }
            pool 10.2.2.0/24 {
                address-range low 10.2.2.33 high 10.2.2.62;
            }
            propagate-settings vlan.0;
        }
    }
}
interfaces {
    interface-range interface-trust {
        member fe-0/0/3;
        member fe-0/0/4;
        member fe-0/0/5;
        member fe-0/0/6;
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-100;
                }
            }
        }
    }
    fe-0/0/0 {
        unit 0 {
            family inet {
                address 10.2.2.254/24;
            }
        }
    }
    fe-0/0/1 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members vlan-100;
                }
            }
        }
    }
    fe-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members vlan-100;
                }
            }
        }
    }
    fe-0/0/7 {
        unit 0 {
            encapsulation ppp-over-ether;
        }
    }
    pp0 {
        unit 0 {
            ppp-options {
                pap {
                    default-password "$1$iAmgr82d4yIN3eDBUR93rN0W55555TY"; ## SECRET-DATA
                    local-name "capped@verizon.com";
                    local-password "$1$iAmgr82d4yIN3eDBUR93rN0W55555TY; ## SECRET-DATA
                    passive;
                }
            }
            pppoe-options {
                underlying-interface fe-0/0/7.0;
                idle-timeout 0;
                auto-reconnect 3;
                client;
            }
            family inet {
                mtu 1492;
                negotiate-address;
            }
        }
    }
    st0 {
        unit 0 {
            family inet;
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 10.2.2.8/24;
            }
        }
    }
}
routing-options {
    static {
        route 10.1.1.0/24 next-hop st0.0;
        route 139.130.4.5/32 next-hop pp0.0;
        route 0.0.0.0/0 next-hop st0.0;
    }
}
security {
    ike {
        policy ike-policy-office {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$1$iAmgr82d4yIN3eDBUR93rN0W55555TY"; ## SECRET-DATA
        }
        gateway ike-gate-office {
            ike-policy ike-policy-office;
            address 139.130.4.5;
            dead-peer-detection {
                interval 10;
                threshold 5;
            }
            external-interface pp0.0;
            version v2-only;
        }
    }
    ipsec {
        vpn-monitor-options {
            interval 10;
            threshold 10;
        }
        policy ipsec-policy-office {
            perfect-forward-secrecy {
                keys group5;
            }
            proposal-set standard;
        }
        vpn ipsec-vpn-office {
            bind-interface st0.0;
            vpn-monitor {
                optimized;
            }
            ike {
                gateway ike-gate-office;
                ipsec-policy ipsec-policy-office;
            }
            establish-tunnels immediately;
        }
    }
    address-book {
        global {
            address Network-A 10.1.1.0/24;
            address Network-B 10.2.2.0/24;
        }
    }

    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule untrust-access {
                    match {
                        source-address 10.2.2.0/24;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy allow-trust-clients {
                match {
                    source-address Network-B;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone VPNzone {
            policy trust-VPNzone-office {
                match {
                    source-address Network-B;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone VPNzone to-zone trust {
            policy VPNzone-trust-office {
                match {
                    source-address Network-A;
                    destination-address Network-B;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                pp0.0;
            }
        }
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                fe-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
                fe-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
                fe-0/0/2.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
                vlan.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
        security-zone VPNzone {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                st0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                    }
                }
            }
        }
    }
}
vlans {
    vlan-100 {
        vlan-id 100;
        l3-interface vlan.0;
    }
}

Both fe-0/0/0.0 and vlan.0 are part of the same /24 subnet.  Is this intentional?

fe-0/0/0.0 and vlan.0 should be assigned an IP from different IP subnets, and the SRX will route between.

Hope this helps.

Sam

Changed the fe-0/0/0.0 to 10.3.3.0/24 and it now works.  Can you explain to me why they can't be on the same part of the subnet?  Thanks.

Yeah... needs to be separate broadcast domains.

Say PC1 has I 10.2.2.111 (fe-0/0/0), and PC2 has 10.2.2.222 (vlan.0).

If PC1 tries to ping PC2, PC1 notices that PC2's IP is on the same subnet, so it sends a ARP request for 10.2.2.222.  But of course, will never get  a ARP response.

If the IP subnets are different, PC1 will forward ping to its default gateway (srx).

Regards,

Sam

Hi all. Can you help with this here