Or this can be a good opportunity for the EX or proxy to send back an icmp redirect (sometimes they are useful) back to the hosts in order to find the correct gateway for a given destination. my suggestion is having the proxy be the gateway and provide the proxy with a next hop of the EX for inter-vlan traffic. if your proxy is a *nix variant you can check if redirects are enabled with "sysctl -a | grep -i redirect" I think most are by default.
> I wish it were. This is all traffic except for local traffic. Any > explanation for why the ex4200 doesn't have the except keyword? > > On Mar 20, 2009, at 6:55 PM, Nilesh Khambal wrote: > >* Are using proxy just for http and https? Is so, then can you be *>* specific in the filters with protocol and ports. You can add a *>* default accept at the end of the filter to accept all other traffic *>* that does not match http or https. Traffic accepted by default *>* accept will get routed using inet.0 routing table. *>* *>* This way you don't have to use "except" in filter terms. *>* *>* Thanks, *>* Nilesh *>* *>* Cord MacLeod wrote: *>>* That would be great, and I thought of it just after I sent the *>>* email. There's one big thing I'm missing though... except. *>>* From an m7: *>>* Possible completions: *>>* <[Enter]> Execute this command *>>* except Match address not in this prefix *>>* From an ex4200: *>>* <[Enter]> Execute this command *>>* In other words, all of my traffic would hit this proxy and it *>>* would break routing between the vlans if I use policy based *>>* routing and can't use except. *>>* On Mar 20, 2009, at 6:37 PM, Nilesh Khambal wrote: *>>>* Can you try policy based routing using input firewall filter on *>>>* EX? This was you can redirect the traffic to another forwarding- *>>>* instance where your proxy resides. You will also have to take *>>>* care of reverse routing from the proxy forwarding instance back *>>>* to inet.0 on EX so that return traffic can go back to client VLANs. *>>>* *>>>* Thanks, *>>>* Nilesh. *>>>* *>>>* Cord MacLeod wrote: *>>>>* I feel silly for asking this, but apparently my brain isn't *>>>>* working today. *>>>>* I've got some machines in a public vlan, 100 and some RFC 1918 *>>>>* machines on another vlan, 120. I redistribute 0.0.0.0 in ospf *>>>>* through my network down to these EX4200's that the machines are *>>>>* hanging off of. Is there a way for my RFC 1918 machines to *>>>>* default to different next hop (proxy machine) when not *>>>>* attempting to route between vlans so they can hit outside. The *>>>>* way we do it now is changing the default gateway on the *>>>>* machines. I'd like to perform this automatically on the *>>>>* ex4200s if possible. *>>>>* Any ideas? *>>>>* _______________________________________________ *>>>>* juniper-nsp mailing list juniper-nsp at puck.nether.net <https://puck.nether.net/mailman/listinfo/juniper-nsp> *>>>>* https://puck.nether.net/mailman/listinfo/juniper-nsp *>>* . * -- Sergio Danelli _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
