SRX

Coming from ScreenOS I still have to adjust to junos.

I am facing some issue with spliting my routes.

I'm trying to use FBF for the following setup:

ge0/0 ISP1

ge0/1 Customer1

ge0/2  ISP2

ge0/3 Customer2

Traffic from customer1 over isp1 (interface nat), traffic from customer2 over isp2 (interface nat).

Customer 2 needs to be limited on 50Mbits.

Both ISP connections are in zone untrust (does this matter?).

Problem now is customer2 has no internet access at all.

Im I doing this right?

version 12.1R3.5;
system {
    host-name srx220;
    root-authentication {
        encrypted-password ""; ## SECRET-DATA
    }
    name-server {
        1.2.3.4;
        1.2.3.4;
    }
    login {
        user X {
            full-name X;
            uid 2000;
            class super-user;
            authentication {
                encrypted-password ""; ## SECRET-DATA
            }
        }
    }
    services {
        ssh;
        telnet;
        web-management {
            https {
                system-generated-certificate;
                interface [ vlan.0 ge-0/0/0.0 ];
            }
        }
        dhcp {
            router {
                192.168.1.1;
            }
            pool 192.168.1.0/24 {
                address-range low 192.168.1.2 high 192.168.1.254;
            }
            propagate-settings ge-0/0/0.0;
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }                               
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        server 1.2.3.4;
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address 100.100.100.100/28;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 192.168.100.254/24;
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family inet {
                address 200.200.200.200/30;
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family inet {
                filter {
                    input FBF_customer2;
                }
                policer {
                    input policer-50m;
                    output policer-50m;
                }
                address 192.168.200.254/24;
            }
        }
    }
    ge-0/0/4 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    ge-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    vlan {                              
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 100.100.100.99;
    }
}
protocols {
    stp;
}
security {
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }                   
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
            rule-set customer2-untrust {
                from zone customer2;
                to zone untrust;
                rule customer2-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone customer2 to-zone untrust {
            policy customer2-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;             
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
                ge-0/0/1.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ssh;
                            https;
                        }
                    }
                }
                ge-0/0/2.0;
            }
        }
        security-zone customer2 {
            interfaces {
                ge-0/0/3.0;
            }
        }
    }
}
firewall {
    policer policer-50m {
        logical-interface-policer;
        if-exceeding {                  
            bandwidth-limit 50m;
            burst-size-limit 52m;
        }
        then discard;
    }
    policer policer-25m {
        logical-interface-policer;
        if-exceeding {
            bandwidth-limit 25m;
            burst-size-limit 25m;
        }
        then discard;
    }
    filter FBF_customer2 {
        term 1 {
            from {
                source-address {
                    192.168.200.0/24;
                }
            }
            then {
                routing-instance vr_customer2;
            }
        }
    }
}
routing-instances {
    vr_customer2 {
        instance-type forwarding;
        routing-options {
            static {
                route 0.0.0.0/0 next-hop 200.200.200.199;
            }
        }
    }
}
vlans {
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}

as you can see. with FBF, there are no interfaces in the VR, so it cannot resolve the direct routes associated with the ge0/3 interface. You just need to set up a rib group to share interface routes into the vr- routing instance. You can use rib groups or instance-import. Instance -import is easier. There are many examples of setting up rib groups in this forum. 

set routing-options rib-groups cust2-to-inet import-rib [inet.0 vr_customer2.inet.0]

set routing-options interface-routes rib-group inet cust2-to-inet

You MUST use inet.0 as one of the routing instances as indicated.

 INSTANCE-IMPORT works same way (use one or the other)

set policy-options policy-statement CUST2-import from instance master 

set policy-options policy-statement CUST2-import then accept

set routing-instance vr_customer2 routing-options instance-import CUST2-import

It matter that both the interfaces 0/0 and 0/2 are in the untrust zone, because you have no control over which path the traffic coming back in will take. Lets say the destination host also has connectivity to the same two ISP, the return traffic can use either of the interfaces and packet will be dropped if it is returned on the interface in another zone.

yo may also want to adjust your firewall filter to account for other traffic not belonging to cusomer 2. But if only that subnet os on ge0/3 then ok. Typically another term else-accept then accept.

BTW, you could improve on it by using two vr for both customers and making each ISP backup for the other customer. If you want.

Make sure policer is correct. got to go now.

Thanks for clearing that up Lyndidon.

Your comment led me to this configuration. Still feels like im doing something wrong here, outgoing traffic is now using the right interface, but I can not ping the second, where I can ping the first.

(after the CPE there is only one fiber uplink so failover won't help - thanks, though).

interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address X.X.X.X/28;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family inet {
                address X.X.X.X/24;
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family inet {
                address X.X.X.X/30;
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family inet {
                filter {
                    input FBF_customer2;
                }
                policer {
                    input policer-50m;
                    output policer-50m;
                }
                address 10.0.0.254/24;
            }
        }
    }
routing-options {
    static {
        route 0.0.0.0/0 next-hop X.X.X.X;
    }
}
protocols {
    stp;
}
policy-options {
    policy-statement customer2-import {
        from instance master;
        then accept;
    }
}
security {
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
            rule-set customer2-untrust {
                from zone customer2;
                to zone customer2-untrust;
                rule customer2-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone customer2 to-zone customer2-untrust {
            policy customer2-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone customer2 {
            policy trust-to-customer2 {
                match {
                    source-address any;
                    destination-address any;
                    application junos-ping;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ssh;
                            https;
                            ping;
                        }
                    }
                }
            }
        }
        security-zone customer2 {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/3.0;
            }
        }
        security-zone customer2-untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/2.0 {
                    host-inbound-traffic {
                        system-services {
                            https;
                            ssh;
                            ping;
                        }
                    }
                }
            }
        }
    }
}
firewall {
    policer policer-50m {
        logical-interface-policer;
        if-exceeding {
            bandwidth-limit 50m;
            burst-size-limit 52m;
        }
        then discard;
    }
    policer policer-25m {
        logical-interface-policer;
        if-exceeding {
            bandwidth-limit 25m;
            burst-size-limit 25m;
        }
        then discard;
    }
    filter FBF_customer2 {
        term 1 {
            from {
                source-address {
                    10.0.0.0/24;
                }
            }
            then {
                routing-instance vr_customer2;
            }
        }
    }
}
routing-instances {
    vr_customer2 {
        instance-type forwarding;
        routing-options {
            static {
                route 0.0.0.0/0 next-hop x.x.x.x;
            }
            instance-import customer2-import;
        }
    }
}