SRX STP

In smaller sites when rolling out low end SRXs, it's not uncommon for them to be connected to Cisco switches that may be running multiple VLANs

How can we connect up our SRXs to Cisco switches without stuffing up spanning tree on the core Cisco switch and still prevent loops? Lets see what happens when we aim to work with that situation from a spanning tree (STP) perspective.

SRX UTM: Enhanced Web Filtering - Redirect

Hi Folks,

I was recently asked in regards to Enhanced Web Filtering...

Is there any way to remove the "CATEGORY: Enhanced_Social_Networking_and_Personal_Sites REASON:BY_PRE_DEFINED" message?

And by the way to the person who posted that, your email shows up to me as noreply-comment@blogger.com. So doesn't show on the blog as a comment and I cant reply. Google "noreply-comment@blogger.com". You will find out how to fix. 

 

Anyway the answer is yes! There is a way to solve the issue.

We will test 3 scenarios while trying to access Playboy.

SRX APPLICATION FIREWALL

Today we will look at running an Application Firewall (AppFW) on the SRX. 

This is different to the normal firewalling in that we are not filtering based on TCP/UDP ports but instead filtering on application signatures that can detect applications whether or not they are not running on the standard ports expected.Further even when we are running on the standard ports, through the signatures we can detect and block access to specific services without you having to worry about blocking all access to a certain IP on a certain port. Eg. We could block access to Facebook Farmville without having to know the either the IP of Facebook or having to block all of Facebook. I will try and show some examples of this functionality. 

SRX ADSL - NZ

I recently installed an SRX in NZ so I though I'd put up here the working ADSL config for our cousins across the pond...

Telecom NZ - PPPOA

at-1/0/0 {
        mtu 1540;
        encapsulation atm-pvc;
        atm-options {
            vpi 0;
        }
        dsl-options {                  
            operating-mode auto;
        }
        unit 0 {
            encapsulation atm-ppp-vc-mux;
            vci 0.100;
            ppp-options {
                pap {
                    default-password "!9$uQQhy76fg543es8XYoZGq.P5QF9A"; ## SECRET-DATA
                    local-name "whoareu.xadsl@xtra.co.nz";
                    local-password "%9$q.Qnkn8765sgvq8LVbs24aDi"; ## SECRET-DATA
                    passive;
                }
            }
            family inet {
                negotiate-address;
            }
        }
    }

routing-options {
    static {
        route 0.0.0.0/0 next-hop at-1/0/0.0;

SRX GLOBAL ADDRESS BOOK

Lets have a look today at the issue of using the WebUI with the Global address book.

When I say Global address book, I mean using creating addresses on the SRX in this way...

root# set security address-book ?
Possible completions:
  <book-name>          Address book name
  global               Default global address book name

Example of address with the Global Address book..

security {
    address-book {
        global {                       
            address aaaa 1.1.1.1/32;
            address bbbb 2.2.2.2/32;
        }
    }

These Global addresses form a common address pool that should be available for use in any zone as opposed to the old way of creating separate address books under each zone.

JUNOS ANNOTATE

A great way to add your own comments to any part of a Junos config.

Let say we have this DHCP config...

services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.7;
            }
            https {
                system-generated-certificate;
                interface vlan.7;
            }
        }
        dhcp {
            pool 10.1.1.0/24 {
                address-range low 10.1.1.101 high 10.1.1.254;
                default-lease-time 86400;
                domain-name company.com;
                router {
                    10.1.1.1;
                }
            }

And we wish to place some kind of comment on the DHCP pool as there is no description statement associated with DHCP.

SRX ADSL

Here is a couple of SRX ADSL configs to 2 different ISPs.
Both these configs have been tested to actually work.

1) Telstra  - PPPOA

    at-1/0/0 {
        mtu 1540;
        encapsulation atm-pvc;
        atm-options {
            vpi 8;
        }
        dsl-options {
            operating-mode auto;
        }
        unit 0 {
            encapsulation atm-ppp-vc-mux;
            vci 8.35;
            ppp-options {
                chap {
                    default-chap-secret "$9$78fgoJGD.fT3JtuBIcS"; ## SECRET-DATA
                    local-name "yourname@direct.telstra.net";
                    passive;
                }
            }
            family inet {
                negotiate-address;
            }
        }
    }

routing-options {
    static {
        route 0.0.0.0/0 next-hop at-1/0/0.0

2) Netspace - PPPOE

at-1/0/0 {
        mtu 1492;
        encapsulation ethernet-over-atm;
        atm-options {
            vpi 8;
        }
        dsl-options {
            operating-mode auto;
        }
        unit 0 {
            encapsulation ppp-over-ether-over-atm-llc;
            vci 8.35;
        }
    }
    pp0 {
        unit 0 {
            point-to-point;
            ppp-options {
                pap {
                    default-password "$9$CYEtAOwKvLXNdpqvLx92g5Qz"; ## SECRET-DATA
                    local-name "yourname@netspace.net.au";
                    local-password "$9$vMwMxdoraUDHq7XaUjhTQRhc"; ## SECRET-DATA
                    passive;
                }
            }
            pppoe-options {
                underlying-interface at-1/0/0.0;
                idle-timeout 0;
                auto-reconnect 2;
                client;
            }
            family inet {
                negotiate-address;
            }
        }
    }

routing-options {
    static {
        route 0.0.0.0/0 next-hop pp0.0