To follow up my own post (even more to follow), here is the config you use
on a J-series router to put it in router-mode. Nothing magic, just some
configuration. This will work with SRX as well, there is nothing J-series
specific in here. This config is found in
/etc/config/jsr-series-routermode-factory.conf, and the box I picked it from
was running Junos 10.2R4.8
It is a starting point, you the modify it to your taste. This will give you
(almost) routing properties, with IPsec available.
One of the problems that might hit you if you have lots of unrelated
traffic, is that you run out of sessions. You are still running in flow
mode, there are still sessions created, but you allow any packet to start a
new session. If you have asymmetric flows, the existing flows are never
closed properly, but always time out instead.
/Per
Here is the config:
adm_perw@segotrt01> file show /etc/config/jsr-series-routermode-factory.conf
| no-more
## This configuration is used to transition a box to router mode.
##
system {
syslog {
file messages {
any any;
}
}
services {
telnet;
ssh;
web-management {
http {
interface [ ge-0/0/0.0 ];
}
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
}
}
security {
flow {
allow-dns-reply;
tcp-session {
no-syn-check;
no-syn-check-in-tunnel;
no-sequence-check;
}
}
forwarding-options {
family {
iso {
mode packet-based;
}
inet6 {
mode packet-based;
}
}
}
policies {
default-policy {
permit-all;
}
}
zones {
security-zone trust {
tcp-rst;
host-inbound-traffic {
system-services {
any-service;
}
protocols {
all;
}
}
interfaces {
all;
}
}
}
alg {
dns disable;
ftp disable;
h323 disable;
mgcp disable;
real disable;
rsh disable;
rtsp disable;
sccp disable;
sip disable;
sql disable;
talk disable;
tftp disable;
pptp disable;
msrpc disable;
sunrpc disable;
}
}
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Per Westerlund
Sent: den 3 december 2012 06:57
To: Dale Shaw
Cc: [email protected]
Subject: Re: [j-nsp] SRX, UDP traffic, routing asymmetry
SRX as router with IPsec?
Have you tried Router Context? Most docs talk about J-series, but it works
with SRX as well.
If you need security (as in policies and zones) as well, there is selective
packet mode. I have done some work in that area, and can give details later
(right now I'm off-line and soon asleep).
/Per
Sent from my iPad, please ignore stupid spelling corrections!
3 dec 2012 kl. 04:48 skrev Dale Shaw <[email protected]>:
>
>
> cheers,
> Dale (..on the never-ending quest to make SRXs behave like routers
w/IPsec)
> _______________________________________________
> juniper-nsp mailing list [email protected]
> https://puck.nether.net/mailman/listinfo/juniper-nsp
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
