I'm a newbie to Juniper and SRX. We have just setup a cluster with 2 Juniper SRX 220 devices and I’m just struggling to setup reth interfaces. The Juniper's have to 2 uplinks to a Cicso ASA. At the moment interface ge-0/0/0, ge-3/0/0 and ge-0/0/1, ge-/0/01 are connected to the ASA. I have setup a VLAN 's 192 and added the reth1 interface to this VLAN. I can ping the reth1 interface but cannot ping interface on the ASA interface at the other end. Please can someone advise what i have done wrong. Config below.
chassis {
cluster {
reth-count 2;
redundancy-group 0 {
node 0 priority 100;
node 1 priority 1;
}
redundancy-group 1 {
node 0 priority 100;
node 1 priority 1;
preempt;
interface-monitor {
ge-3/0/1 weight 255;
ge-0/0/1 weight 255;
}
}
}
}
interfaces {
interface-range interfaces-fwtransit {
member ge-0/0/0;
member ge-3/0/0;
unit 0 {
family ethernet-switching {
vlan {
members fwtransit;
}
}
}
}
ge-0/0/1 {
gigether-options {
redundant-parent reth1;
}
}
ge-0/0/3 {
unit 0 {
family inet {
address 10.100.0.252/24;
}
}
}
ge-3/0/1 {
gigether-options {
redundant-parent reth1;
}
}
fab0 {
fabric-options {
member-interfaces {
ge-0/0/5;
}
}
}
fab1 {
fabric-options {
member-interfaces {
ge-3/0/5;
}
}
}
reth0 {
vlan-tagging;
redundant-ether-options {
redundancy-group 1;
}
}
reth1 {
vlan-tagging;
redundant-ether-options {
redundancy-group 1;
}
unit 192 {
description untrust;
vlan-id 192;
family inet {
address 192.168.2.252/24;
}
}
}
vlan {
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
unit 162 {
family inet {
address 172.31.254.3/24;
}
}
unit 192 {
family inet {
address 192.168.2.3/24;
}
}
}
}
routing-options {
static {
route 10.100.0.0/24 next-hop 10.100.0.1;
}
}
protocols {
stp;
}
security {
zones {
security-zone trust {
interfaces {
ge-0/0/3.0 {
host-inbound-traffic {
system-services {
ping;
https;
ssh;
}
}
}
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
ping;
}
}
interfaces {
vlan.162;
vlan.192;
}
}
}
}
vlans {
fwtransit {
vlan-id 162;
l3-interface vlan.162;
}
web_dmz {
vlan-id 192;
l3-interface vlan.192;
}
}
Please check that you have configured the correct policies with: - show configuration security policies
You can configure a policy with:
and try to ping the ASA-Interface by specifying the source Interface: - ping x.x.x.xinterface ge-0/0/0
maybe you also want to define a loopback Interface and add this Interface to your: "trust"-security-zone