SRX Services Gateway
Highlighted
SRX Services Gateway

How to solve that several VR can access the same reth0 vlan for untrust

‎11-16-2016 12:04 AM

I have several VRs on an SRX.

The untrust is on reth0 vlan 10

But i cant create reth0 unit 10 vlan-id 10 and at the same time unit 11 vlanid-10 to hook these up to different VRs.

Any suggestion on how to design this?

 

Since I have production running on VR1 i dont really like to do a major redesign on that one :x

One solution I can see is to hook up vlan 10 on another reth interface to the same switch segment. Not that pretty but it might work.

 

//Rob

3 REPLIES 3
SRX Services Gateway

Re: How to solve that several VR can access the same reth0 vlan for untrust

‎11-16-2016 03:09 AM

I'm not sure, but based on your description I am guessing you have internet on one VR and want to use this in a separate VR for the upstream traffic.

 

If that is the case, then you probably can use Instance Import to send the default route into the the other VR.

 

https://kb.juniper.net/InfoCenter/index?page=content&id=KB19787

Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
http://puluka.com/home
SRX Services Gateway

Re: How to solve that several VR can access the same reth0 vlan for untrust

‎11-17-2016 01:39 AM

Hi,

 

Thanks for the reply.

I was thinking of that as well but im not quite sure about how the routing will work with that setup.

 

VR1-VPN (has internet/default-route)

VR2-Other-VPN

 

Leaking the default route from VR1 to VR2 shouldnt be a problem. But im not sure if the traffic will work...

VPN on VR2, will be established via the internet that comes via VR1 but the VPN/st0.100 will be terminated on a zone that is located in VR2. The basic goal in all this is that VR1 shouldnt have a clue on what kind of IPs that is used in VR2.

 

//Rob

 

 

SRX Services Gateway

Re: How to solve that several VR can access the same reth0 vlan for untrust

‎11-17-2016 02:45 AM

Well, if the traffic needs to be isolated from the two VR then you will likely need a 3rd one.  Moving the internet up to this and then leaking the default route down to both the other two.

Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
http://puluka.com/home