dot1q Trunk Port configuration options

[CaskStrength]

I am working on installing an SRX240 in place of an old Cisco 7102 (IOS 12.0) and a PIX.  The 7104 is connected via ATT Opteman on FE0/0.1  

Here is the current configuration:

interface FastEthernet0/1

 no ip address

 no ip directed-broadcast

 duplex full

 speed 100

!

interface FastEthernet0/1.1

 description OptEMan Uplink

 bandwidth 20000

 encapsulation dot1Q 169

 ip address a.b.c.e 255.255.255.248

 no ip directed-broadcast  

I am unsure of the best method to configure this interface in JUNOS as wanted some opinions or advice.  I'm thinking I have two options, however I haven't installed yet so I might only have one.

option one:

set interface ge-3/0/0 vlan-tagging

set interface ge-3/0/0 unit 0 proxy-arp

set interface ge-3/0/0 unit 0 vlan-id 169

set interface ge-3/0/0 unit 0 family inet address a.b.c.d/29

set vlans Opteman vlan-id 169

option two:

set interface ge-3/0/0 unit 0 family ethernet-switching port-mode trunk

set interface ge-3/0/0 unit 0 family ethernet-switching vlan member 169

set interface vlan unit 1 family inet address a.b.c.d/29

set vlans Opteman vlan-id 169

set vland Opteman l3-interface vlan.1

Any thoughts?

[Duga]

Hi,

In my opinion, using proxy-arp doesn't make sense in your situation.

You will only use one main IP on your connection.

In a general point of view, solution 2 is more consistent.

So, I would use solution 2.

[dfex]

If you're only installing a single SRX, then either will be fine - as the previous poster said though, there is no need for proxy-arp, unless you intend to do some destination NAT to IPs that aren't assigned to fe-0/0/7.

The only caveat with using the family ethernet-switching method is that you currently it isn't supported when using HA cluster.  If you're not using HA, then this won't matter, and I believe switching in HA mode will be supported in JUNOS 11.1 anyway.

[CaskStrength]

I used this configuration during the cutover and everything worked perfectly.  I went with the proxy-arp setting due to having lots of static nat and destination nat settings.  I'm not sure if it was required, but it worked.  

    ge-3/0/0 {

        vlan-tagging; 

        unit 0 { 

            description ATTOpteMan;

            proxy-arp;

            vlan-id 169;

            family inet {

                address x.x.x.x/29;

            }

        }

    }

Question - Is the proxy-arp statement on the interface required to have proxy-arp statements under NAT for the same interface?

[dfex]

No, in fact I think by enabling it on your interface, your interface will reply on behalf of ANY routable address behind your SRX.  Keeping it confined to just the Dest-NAT config will lock it down to just that IP