Screen OS

Hi all,

My SSG20 have a strange issue, the link/act LED is not blink after I connect to Cisco switch, always steady light 

And my LAN not working well, sometime lost 30% when I ping to outside.

I have 3 Cisco switch and around 90 users on LAN.

Anyone can give me some advise???

Does the same thing happen when you connect a PC to the port?  Have you tried changing the cable?

It's not happen when I connect a PC to the port. Already changing the cable

I would confirm that the speed and duplex settings on the SSG port match your Cisco configuration.  By default the SSG is set to auto and is only 10/100 port.

You set specific speed/duplex on the interfaces settings

Network - Interfaces - list

edit interface name

Phy tab (Physical)

Dear spuluka,

I changed all ethernet port setting - duplex: Full; speed: 100M. But the issue still happen, some time the LED blink a little bit...my LAN not working well 

What should I do next Sir?

All Cisco switch are 10/100M (1 pcs 24port & 2 pcs 48port)

Perhaps you are creating a layer two loop with this connection.  Are there aother ports on from the SSG that go to the same switch matrix?

On the Cisco side are you running spanning tree? Is so, can you enable it on this port and see if it goes to blocking?

Last time, I used only 1 port for my LAN (SSG->Switch1->Switch2->Swich3)

Now i connect 3 ports to 3 switches

STP has enabled on switches by default. 

When I check on STP setting, all port state is FORWARDING. Its normal? I don't have much experience about Cisco switch

Forwarding means the port is sending traffic an blocking is when it is in "standby" to take traffic if the primary link fails.

Based on your description I suspect there is a layer 2 loop here somewhere.

The three ports you now connect to the switches are they all suppose to be the same vlan?  How are they configured on both sides?

I don't use VLAN. All switch running by default setting. one net IP for LAN only

The package drop not happen continunously.

All ports on Juniper in layer 3. so all switch need to be in same layer or not?

I suspect changing your switch connection method accidently introducted a loop.

Confirm that there are no cables connecting any of the three switches to each other.

Confirm that the three ports on the SSG are assigned to the same bgroup interface that has the ip address for your switches default gateway.

Dear puluka,

As my looking, the issue come when SSG take more than 2000 session (allocated). My SSG show 8000 session max.

Current ScreenOS is 6.2. Should I need upgrade to 6.3?

The OS version will not affect the session count limit.  There is an extended license for this but it looks like you don't come close.

I might suspect that there is too much bandwidth for the device as a possible cause.

Dear Spuluka,

The issue has been solved. There is an policy Trust to Untrust (Any-any-any-permit) so too much bandwidth go through SSG...

I disabled it then create others policies accordingly. My LAN working fine now...

Thank so much for your kind help!

Regards,

SY