SRX100 Vlan tagging issue

[ Edited ]
‎09-25-2019 09:59 PM

I need to separate the wired and wireless into 2 subnets. (e.g. and

Right now there is only 1 subnet and everthing is fine. Both wired and wireless use the same subnet

1. fe-0/0/1 connected to an unmanaged switch, which connected to the wired devices

2. fe-0/0/2 connected to a WiFi AP (IP=

3. vlan1 with ID "3" and value "vlan.1". IP=

5. DHCP pool for

6. fe-0/0/1.0 and fe-0/0/2.0 are access mode and is the member of vlan1


I added below settings in hope to achieve my target but not work

1. Add DHCP pool for

2. Add vlan2 with ID "4" and value "vlan.2". IP=

3. fe-0/0/2.0 change to trunk mode and inlcude is the member of vlan1 and vlan2

*. above setting make pingable but cannot ping the AP (

*. if switch fe-0/0/2.0 back to access mode and member vlan1. It can ping AP again but cannot ping

4. Security zones were created for vlan1 and vlan2. Two policies were made for them to reach each other (intra zone)


I'm connect to J-Web from a computer in subnet.

My target is to let both subnets can ping each other. Subnet get IP from the new DHCP pool. And can reach internet. Desperately need some help.



Re: SRX100 Vlan tagging issue

‎09-25-2019 11:39 PM

In your current configuration, your ap does not apply vlan tags to traffic on including management of itself. Therefore you loose access to the AP when changing fe-0/0/2 to a trunk where the SRX expect vlan tagged traffic.


You have two options:


1. Configure vlan id 3 as native-vlan-id on the trunk port ( set interfaces fe-0/0/2 unit 0 family ethernet-switching native-vlan-id <name-of-vlan-with-vlan-id-3> )  This let's the SRX know which vlan to put untagged packets into.


2. Right before changing fe-0/0/2, log in to the AP as have it do vlan-tagging of it's management traffic to vlan id 3.


My recommandation would be to go for option 1.

Best regards,

Jonas Hauge Klingenberg
Juniper Ambassador & Technology Architect, SEC DATACOM A/S (Denmark)

Re: SRX100 Vlan tagging issue

[ Edited ]
‎09-26-2019 12:26 AM

Thanks jon.

I first set fe-0/0/2.0 to trunk and include both vlan (with the vlan id 3 at top) then commit in J-Web.

Next, I run the command you provided and commit in command mode. It commit without error. But still unable to ping the AP ( It return "Destination host unreachable".


And I have some questions:

1. Should the port connected to AP set to trunk? The AP uplink port seems no option for change port mode. Is trunk mode need to set on both ports in order to work?

2. In J-Web, the interface has option "Enable Vlan Tagging". Is this need to enable?

3. I have experience this kinds of settings is work IF there is a manage network switch. The ports connected between firewall and switch were set to trunk. Ports between switch and AP were access mode. Of course the switch has vlan config. Do I need to setup a switch just for that single interface?


Re: SRX100 Vlan tagging issue

‎09-30-2019 09:22 PM

If your AP is responding to untagged packets, then your switch needs to deliver it an untagged packet.


It can be done by putting the link between AP and switch in access mode but make sure that this access switch port is configured with the correct vlan tag or is a member of the single vlan-id configured on SRX.


Note that an access port needs to be a part vlan on the switch in order to transfer the traffic.




Re: SRX100 Vlan tagging issue

‎10-01-2019 06:49 PM

Hello TheDisciple,

This time. There's no network switch between the SRX100 and the AP. Or you mean the "Ethernet switch" mode of the SRX100 port?


Re: SRX100 Vlan tagging issue

[ Edited ]
‎10-16-2019 11:57 AM

Hello jlotag,


I am a little confused about your topology.


In my understanding you have the following topology : -


Current :-

Wired network (192.168.2.x) ---------- (fe-0/0/1) SRX (fe-0/0/2) ------------ ( AP

fe-0/0/1 and fe-0/0/2 are access port with vlan.1 (vlan-id 3).


Expected topology:-


Wired network (192.168.20.x) ---------- (fe-0/0/1) SRX (fe-0/0/2) ------------ ( AP

vlan.1 --- 192.168.2.x  --- id-3
vlan.2 --- 192.168.20.x   ---- id-4


If there is no switch between SRX & AP, then you don't need fe-0/0/2 to be a part of 2 vlans. It can stay as a part of vlan.1 .


This is how I would connect to get this requirement working: -


1. Configure fe-0/0/1 and fe-0/0/2 in access mode.

2. fe-0/0/1 will be a part of vlan.2 (192.168.20.x) . Assuming 20.x subnet is only needed by Wired network.

3. fe-0/0/2 will be a part of vlan.1 (192.168.2.x) . Here I am assuming that the AP is capable of assigning IPs to its clients in the subnet 192.168.2.x .

4. Make a security policy between the zones of vlan.1 & vlan.2 to allow traffic between the vlans and to the itnernet too.



Another scenario can be that you want your AP to be managed by subnet but assign 192.168.20.x subnet to AP's client. In this scenario, your AP interface needs to be vlan tagged on the AP and fe-0/0/2 will be "trunk" mode with both vlans.


Hope this clarifies.