Solved

Really strange network problem after Juniper SRX install

Posted on 2010-08-14
10
1,909 Views
Last Modified: 2012-05-10
Two nights ago we removed a Juniper Netscreen SSG 5 and replaced it with a Juniper SRX 210. The company that performed the install tested everthing on their computers and the internet was accessible for them on our network so they called it a night and went home.

When we got in yesterday, some websites were available and some weren't. Strangely microsoft.com wasn't available. This made us think Conficker worm or DNS problem. After checking for both of these issues and determining that this wasn't the cuase, we thougtht that perhaps the problem was corrupted ARP tables on the Juniper or our switches. We rebooted every device on the system including all servers and networking infrastructure.

After all this the same random sites were not available.

The strange thing in all of this is that any device that was placed on the network prior to the Junpier SRX install is not able to access the random sites I noted above. The two computer consultants whose computers had never logged into our network until after the Juniper box was installed could access any site they wanted.

We are totally stumped. We can access some websites but in other cases we can't.

Any suggestions would be really appreciated
0
Comment
Question by:lowrycito
10 Comments
 
LVL 24

Expert Comment

by:rfc1180
Comment Utility
run a 60 second ping test to the default gateway

ping -n 60 192.168.1.1

then a 60 second test to google.com

ping -n google.com

Also a pathping to google.com

output results  of the statistics at the end of the test (Do not include all 60 counts of each ping test, just the statistics).

Also, do you have a network diagram?
What is directly connected on the untrust side of the SRX (What type of Internet connectivity do you have)

Billy
0
 

Author Comment

by:lowrycito
Comment Utility
Stats for Default Gateway:

Ping statistics for 10.10.0.1:
    Packets: Sent = 60, Received = 60, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

Stats for Google:

Ping statistics for 66.102.7.99:
    Packets: Sent = 60, Received = 60, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 16ms, Maximum = 19ms, Average = 16ms
Stats for ping -n google.com

Stats for yahoo

Ping statistics for 67.195.160.76:
    Packets: Sent = 60, Received = 58, Lost = 2 (3% loss),
Approximate round trip times in milli-seconds:
    Minimum = 91ms, Maximum = 96ms, Average = 91ms

I included yahoo.com becuase this is a website we can ping but we can't access in IE or Firefox or any other browser but the outside consultants could.

The only thing connected to the untrust zone on the Juniper is a Bonded T1 from our telco.

John
0
 
LVL 24

Expert Comment

by:rfc1180
Comment Utility
what were you using before the migration to the SRX, the SSG5 does not have any modular slots, what did you have the bonded T1 connected to before?

Billy
0
 

Author Comment

by:lowrycito
Comment Utility
the T1 is connected to the SRX box via ethernet coming from an Adtran the telco put in place. It is connected exactly the same as it was before on the SSG.

What I can't figture out is why the network consultants could connect to our network and have no problems connecting to any website but we can't.
0
 
LVL 24

Expert Comment

by:rfc1180
Comment Utility
>he T1 is connected to the SRX box via ethernet coming from an Adtran the telco put in place. It is connected exactly the same as it was before on the SSG.

cool,

Check to see if you are using a proxy in IE or any other browers, is the ssg5 still connected to the network, or did the consultants disconnect it from the network?

can you connect direct to the trust port of the SRX and access the Internet?

Do you have a network diagram?
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 4

Expert Comment

by:Valutus
Comment Utility
That sounds like an MTU issue... Can you post the SRX210 config?  
0
 

Expert Comment

by:boogeymann
Comment Utility
Post your srx config please.  Is the SSG still connected to the network?
Can you see the connection in the logs of the srx firewall?
0
 

Accepted Solution

by:
lowrycito earned 0 total points
Comment Utility
Turned out it was a bad SRX...JTAC RMAed the device.
0
 
LVL 24

Expert Comment

by:rfc1180
Comment Utility
>Turned out it was a bad SRX...JTAC RMAed the device.
Nice, glad to hear you found out what the issue was
0
 

Expert Comment

by:Aodh
Comment Utility
Hi,
I also had this issue with some of the websites mentioned above and others.  It turned out that it was the MSS size that was causing the issue.  Once this was reduced to 1350 all was well again
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Suggested Solutions

The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now