You can put two or more logical interface from one routing-instance jut into one security zone and control the flow traffic through security policy such as "set security policy from-zone vr1 to-zone vr1 ... ".
The security zone concept is just for management purpose and has nothing to do with the security policy implementation. LSYS in JUNOS 11.2 is first come to SRX HE not SRX branch. On Sat, Jul 23, 2011 at 1:13 AM, Farid Bouzemarene < [email protected]> wrote: > Just as a reminder : LSYS ( screenos vsys equivalent ) are arriving in 11.2 > on srx .... > > > > ----- Message d'origine ----- > De : Ben Dale [[email protected]] > Envoyé : 22.07.2011 22:11 ZE10 > À : Richard Zheng <[email protected]> > Cc : [email protected] > Objet : Re: [j-nsp] srx advice > > > > Hi Richard, > > Depending on your topology you can scale this out by having a common > "Untrust" zone for all customers (which is has interfaces in the inet.0 > instance) and simply leaking routes (interface(s), default or otherwise) > into specific customer VRs. > > Cheers, > > Ben > > On 22/07/2011, at 5:54 PM, Richard Zheng wrote: > > > Hi, > > > > I am trying to compare different models of srx. The application is to > setup > > virtual firewalls for several customers. The virtual router instance > should > > do it. The maximum number of security zones seems to be the limitation of > > srx. For example, SRX220 has maximum 24 zones and 15 virtual routers. > > Considering one virtual router needs at least 2 zones, one trusted and > one > > untrusted, how can you get more than 12 virtual routers with 24 zones? > > > > Am I missing something here? > > > > Thanks, > > Richard > > _______________________________________________ > > juniper-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/juniper-nsp > > > > > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > -- BR! James Chen _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
