Solved

Really strange network problem after Juniper SRX install

Posted on 2010-08-14
10
1,922 Views
Last Modified: 2012-05-10
Two nights ago we removed a Juniper Netscreen SSG 5 and replaced it with a Juniper SRX 210. The company that performed the install tested everthing on their computers and the internet was accessible for them on our network so they called it a night and went home.

When we got in yesterday, some websites were available and some weren't. Strangely microsoft.com wasn't available. This made us think Conficker worm or DNS problem. After checking for both of these issues and determining that this wasn't the cuase, we thougtht that perhaps the problem was corrupted ARP tables on the Juniper or our switches. We rebooted every device on the system including all servers and networking infrastructure.

After all this the same random sites were not available.

The strange thing in all of this is that any device that was placed on the network prior to the Junpier SRX install is not able to access the random sites I noted above. The two computer consultants whose computers had never logged into our network until after the Juniper box was installed could access any site they wanted.

We are totally stumped. We can access some websites but in other cases we can't.

Any suggestions would be really appreciated
0
Comment
Question by:lowrycito
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
10 Comments
 
LVL 24

Expert Comment

by:rfc1180
ID: 33438385
run a 60 second ping test to the default gateway

ping -n 60 192.168.1.1

then a 60 second test to google.com

ping -n google.com

Also a pathping to google.com

output results  of the statistics at the end of the test (Do not include all 60 counts of each ping test, just the statistics).

Also, do you have a network diagram?
What is directly connected on the untrust side of the SRX (What type of Internet connectivity do you have)

Billy
0
 

Author Comment

by:lowrycito
ID: 33438592
Stats for Default Gateway:

Ping statistics for 10.10.0.1:
    Packets: Sent = 60, Received = 60, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

Stats for Google:

Ping statistics for 66.102.7.99:
    Packets: Sent = 60, Received = 60, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 16ms, Maximum = 19ms, Average = 16ms
Stats for ping -n google.com

Stats for yahoo

Ping statistics for 67.195.160.76:
    Packets: Sent = 60, Received = 58, Lost = 2 (3% loss),
Approximate round trip times in milli-seconds:
    Minimum = 91ms, Maximum = 96ms, Average = 91ms

I included yahoo.com becuase this is a website we can ping but we can't access in IE or Firefox or any other browser but the outside consultants could.

The only thing connected to the untrust zone on the Juniper is a Bonded T1 from our telco.

John
0
 
LVL 24

Expert Comment

by:rfc1180
ID: 33438599
what were you using before the migration to the SRX, the SSG5 does not have any modular slots, what did you have the bonded T1 connected to before?

Billy
0
Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

 

Author Comment

by:lowrycito
ID: 33438603
the T1 is connected to the SRX box via ethernet coming from an Adtran the telco put in place. It is connected exactly the same as it was before on the SSG.

What I can't figture out is why the network consultants could connect to our network and have no problems connecting to any website but we can't.
0
 
LVL 24

Expert Comment

by:rfc1180
ID: 33438617
>he T1 is connected to the SRX box via ethernet coming from an Adtran the telco put in place. It is connected exactly the same as it was before on the SSG.

cool,

Check to see if you are using a proxy in IE or any other browers, is the ssg5 still connected to the network, or did the consultants disconnect it from the network?

can you connect direct to the trust port of the SRX and access the Internet?

Do you have a network diagram?
0
 
LVL 4

Expert Comment

by:Valutus
ID: 33440417
That sounds like an MTU issue... Can you post the SRX210 config?  
0
 

Expert Comment

by:boogeymann
ID: 33449787
Post your srx config please.  Is the SSG still connected to the network?
Can you see the connection in the logs of the srx firewall?
0
 

Accepted Solution

by:
lowrycito earned 0 total points
ID: 33450287
Turned out it was a bad SRX...JTAC RMAed the device.
0
 
LVL 24

Expert Comment

by:rfc1180
ID: 33450595
>Turned out it was a bad SRX...JTAC RMAed the device.
Nice, glad to hear you found out what the issue was
0
 

Expert Comment

by:Aodh
ID: 37380205
Hi,
I also had this issue with some of the websites mentioned above and others.  It turned out that it was the MSS size that was causing the issue.  Once this was reduced to 1350 all was well again
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ISP Change 14 70
Stack 2x HP ProCurve 5406zl Switches 9 16
Layer 3 switch recommendation 15 58
IP Jumping 6 20
The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question