Newbie Configuring J2320

03.14.12   |  
‎03-14-2012 07:02 PM

Please help this newbie, I was volunteered for this and need to have something by the end of tomorrow...

I've inherited a J2320 which is the WAN connection for an internal LAN and I need some fast advice on how to configure it.  I understand the technology, I have configured some Cisco routers in the past, first time for Juniper and I don't have a contract with Juniper to get help.  On-line documentation doesn't help me.  What I need is this:

My public WAN IP is  That is the only IP alloted for the LAN.  There are three internal LANs with private IP, and  The downstream connection from the J2320 is a Cisco switch configured with VLANs 10, 20 and 30 for those three private subnets.  The J2320 will have one port connected to the public IP and another port connected to the switch over a trunk consisting of the three VLANs (subnets).
Right now -on that first subnet will be a Subversion server, and a Web server and an FTP server  On the second subnet are the laptops of folks that need to get out on the internet as well as have access to the three servers.  They will get DHCP from the J2320 on the   Third subnet, what I'll do in the future is add a proxy server for all internet access for all users, not doing that yet.
Can I get help on this?  Can someone give the configuation they would do for this?  
In order of importance...
Most concerned about the port forwarding to get the servers to be available to the public.  
Second concern is getting the DHCP server to work for the workstations on the network and the Natting so the workstations can get out on internet.  
Third most important is the trunking connection between the J2320 and the switch.
Fourth is making sure the firewall capability is working for the J2320 to protect all three subnets as well as the router itself from the internet.  
Last on the list is the provision for the proxy  -(which I imagine has to do with the security zones)
Please, this may seem like a lot but not for someone versed in Juniper.  I would really appreciate the help.  If you have a config for this please share.

Accepted by topic author mjm111690
‎08-26-2015 01:27 AM

Re: Newbie Configuring J2320

03.15.12   |  
‎03-15-2012 04:38 AM

The attached config should get you started.  This configuration has all three internal sub-interfaces in the same security zone, but you could of course seperate them out into multiple different zones if desired.  I did not validate everything, but if you have experience with networking, you should be able to  use this to get started.  Also, if you have an ios configuration, you could try the i2j tool to convert it into a JunOS configuration as a starting point.






Re: Newbie Configuring J2320

03.15.12   |  
‎03-15-2012 10:12 AM

Just a quick suggestion: Next time, don't enter your real IP address in the forum (assuming that you did- no need to comment to validate or invalidate this assumption). You never know who is out there trolling for info to attack your network.

[KUDOS PLEASE! If you think I earned it!
If this solution worked for you please flag my post as an "Accepted Solution" so others can benefit..]

Re: Newbie Configuring J2320

03.23.12   |  
‎03-23-2012 11:40 AM



Re: Newbie Configuring J2320

03.29.12   |  
‎03-29-2012 10:24 AM

Hi Ron-  Great so far, I think I am making progress.  Couple things though.


1.  Ping.  At the moment the router can't ping out and does not respond to ping.  Am I missing something?

I am not at the point yet where I test whether the internal workstations and servers can ping out.  I am just testing the router itself.


2.  I am adding another server that will need to be accessed from outside.  So I will have to add it to my rule-set inbound section of my natting.  We'll call it ...

pool newserver {


...and then the

rule newserver-nat {
                    match {


But this will differ from the other servers in that I want to port forward udp 999.

So what is the next line?  Is it this?...

destination-port udp 999;     




Re: Newbie Configuring J2320

03.30.12   |  
‎03-30-2012 10:43 AM

In the meantime I screwed something up.  I added the "zone" information in and while I was committing the changes it got hung up and when I got out and tried to log back in I was locked out, never got login prompt again.  I was on the one interface that I had not configured anything new, the web configuration interface that I had been using to configure the router.  I had not done anything to that interface yet, and adding the security zone info per your suggestion, kept me out.


So I have to go into the console port and see if I can undue what I did.  I have to postpone this action a couple days...

Any suggestions?


Re: Newbie Configuring J2320

03.30.12   |  
‎03-30-2012 11:11 AM

Well if you are locked out you are going to have to go into the box via the console. Please note that a great command to use is the "commit confirmed" command. By default if you use this then you must log back into the box within 10 minutes or you last commit is automatically rolled back. 


Great way to prevent lock out. You can also change the time from the 10 minute default to some other value. 

Kevin Barker
Juniper Networks Certified Instructor
Juniper Networks Ambassador

Juniper Elite Reseller
J-Partner Service Specialist - Implementation

If this worked for you please flag my post as an "Accepted Solution" so others can benefit. A kudo would be cool if you think I earned it.

Re: Newbie Configuring J2320

03.30.12   |  
‎03-30-2012 11:49 AM

Thank you.  I certainly will when I get back to it on Monday.  I am curious how I did that to myself, unless there was a typo.


Re: Newbie Configuring J2320

04.03.12   |  
‎04-03-2012 09:17 PM

I'm back in business, at least back to where I was before I commited the zone changes and knocked myself off.  Turns out that I didn't include my web config interface in the host-inbound-traffic allowing traffic in.


Still have a little ways to go since dhcp service doesn't appear to work yet.  This is what I have, am I omitting anything:


dhcp {
            pool {
                address-range low high;
                domain-name domain.com;
                name-server {
                router {



Re: Newbie Configuring J2320

04.04.12   |  
‎04-04-2012 04:26 PM

Got the DHCP part to work, finally.  It was a connectivity issue.


Just have that one final issue where I can't seem to do port forwarding on a udp port.


security nat destination rule-set inbound rule server-nat match destination-port udp 999


It doesn't like that/  How do I get around this and be able to use a udp port?



Re: Newbie Configuring J2320

04.16.12   |  
‎04-16-2012 08:37 AM

Done some research, and a way to do this is to use "match protocol" option to include udp.


But unfortuneately "match protocol" does not appear to be an option in my IOS.  Here are my only choices when I get this far...

rtr-1# set security nat destination rule-set inbound rule newserver-nat match ?
Possible completions:
+ apply-groups         Groups from which to inherit configuration data
+ apply-groups-except  Don't inherit configuration data from these groups
> destination-address  Destination address
> destination-port     Destination port
+ source-address       Source address

So apparantly I don't have an option to match against a udp port??


Is there another way to do port forwarding on udp ports?


Otherwise do I have to upgrade my IOS (10.R3.10) to a later version that supports "match protocol"?  (I hope not)