Solved

Configuring Virtual IP addresses on Juniper SSG

Posted on 2010-11-11
7
1,576 Views
Last Modified: 2012-05-10
I have a client that is moving away from a DS3 to a TW Telecom circuit. They specified they were told they no longer needed a router. The current configuration has a Cicso 6501 router going to the Juniper SSG 140. The new circuit is simply a switch at the customers location. Is it possible to create two virtual interaces and route between them to accomplish this. Would the config be similar to the one below:

set int e0/2.10 ip 10.10.20.94/30   (interface for ISP)
set int e0/2.10 route
set int e0/2.20 ip 192.168.10.97/28 (customer firewall side)
set int e0/2.20 route
set route 0.0.0.0/0 interface ethernet0/2.10 gateway 10.10.20.93

I am more accustom to having both the router and then the Juniper device.
0
Comment
Question by:Rodney Barnhardt
  • 4
  • 3
7 Comments
 
LVL 1

Expert Comment

by:jsd9
Comment Utility
It sound like what you are trying to do is VLAN trunking on your ethernet 0/2.  You can run 2 sub-interfaces on one physical interface with VLAN trunking or tagging.  

Here is an example of a configuration I am using:


set zone id 100 "Internal1"
set zone id 101 "Internal2"

set interface "ethernet0/1.102" tag 102 zone "Internal1"
set interface "ethernet0/1.105" tag 205 zone "Internal2

set interface ethernet0/1.102 ip 10.10.102.0/24
set interface ethernet0/1.102 route
set interface ethernet0/1.105 ip 10.10.105.0/24
set interface ethernet0/1.105 route


I set my zones up in the first two commands.  The next 2 commands may the interface to the zone name.  The tag IDs are the VLAN numbers.  This interface
connects to a Cisco switch that is setup as a VLAN trunk, trunking VLANS 102 and 105.

0
 
LVL 32

Author Comment

by:Rodney Barnhardt
Comment Utility
Yes, this may be what I am looking for. I do have a question though. The switch I am connecting to is provided by TW telecom to connect to, so I do not know that it is set up as a VLAN trunk. Basically, the IT director was told there would be no need for a router. However, they provided two sets of IP's. One with a CIDR of 30 (now presumably a router) and the other with a CIDR of 28 (the external IP's for services). Would this still work not knowing how TWC configures their end?
0
 
LVL 1

Expert Comment

by:jsd9
Comment Utility
If  the switch you are connecting to belongs to your ISP, you may not be able to share e0/2 with both the external and internal connection.  Their switch would need to support trunking and they would need to provide you wtih an additional port off their switch that would carry the internal connection to your LAN.  You could possible insert a switch of your own in between the firewall and their switch.  This switch would have a trunk port to e0/2 to our firewall, carrying both VLANs.  Then that switch would have one port going to your ISP switch and one port or many ports going to your internal LAN.  These ports would not be trunk ports, but would be access ports tagged for the appropriate VLANs.

As for the IP addressing question, it is most likely that the /30 subnet is a transit network between your firewall and the ISP router.  The additional block is probably going to be routed to your firewall.  You can check with the ISP, but this most likely the case.  The have probably given you an address in that /30 to setup on your firewall.  The /28 can than be used as a NAT pool or it can be configured on an internal interface and used as an actual subnet.  NAT however will allow you to conserve the address space and allow for more flexibility in the future when changing public IPs.  
0
Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

 
LVL 32

Author Comment

by:Rodney Barnhardt
Comment Utility
Well, if I am going to go to the trouble of adding a switch, I might as well place my own router. I have extra routers due to company downsizing. Typically, with our DS3, we had our own router that interfaced to the ISP with our /30 IP, then used the /28 for MIP\VIP's on our SSG. I guess we will just go with that same set up. TWC told the director we would just connect to our firewall without anyone asking specific questions.
0
 
LVL 1

Expert Comment

by:jsd9
Comment Utility
if you have a free interface on your firewall, you could separate out the 2 networks.  That way you could just connect the firewalls ISP facing network to the ISP.   The second interface would connect to your LAN.  I assumed that since you were trying to do it all on one interface, that you are short on firewall interfaces.
0
 
LVL 32

Accepted Solution

by:
Rodney Barnhardt earned 0 total points
Comment Utility
We just installed a router and configured it in between the firewall and the ISP.
0
 
LVL 32

Author Closing Comment

by:Rodney Barnhardt
Comment Utility
We just used a router.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Watchguard Firewall Setup 3 26
Sonicwall Web User login Redirect 9 32
Interface Vlan and No Switchport 7 43
EIGRP Full Mesh 2 28
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now