Article Detail

Description

Secure wire maps two peer interfaces. It differs from transparent and route modes in that there is no switching or routing lookup to forward traffic. As long as the traffic is permitted by a security policy, a packet arriving on one peer interface is immediately forwarded unchanged out of the other peer interface.

This mapping of interfaces, called secure wire, allows an SRX Series to be deployed in the path of network traffic without requiring a change to routing tables or a reconfiguration of neighbouring devices.

Symptoms

LACP is not supported. Secure wire mappings can be configured for member links of link bundles instead of directly mapping aggregated Ethernet interfaces.
When the ports, or interfaces on SRX Series Firewall are in trunk mode, the device do not transmit the LACP PDUs and fails the LACP.
SRX secure-wire drops LACP PDUs on trunk ports without native VLAN because LACP uses untagged slow protocol frames (ethertype 0x8809). Trunk mode expects tagged frames only untagged traffic gets discarded unless mapped to a native VLAN.

Solution

You must add a native vlan to secure wire interfaces, to bring LACP up.

The following configuration enables LACP negotiation by transparently passing PDUs over individual secure-wire links. SRX secure-wire in trunk mode with native VLAN forwards LACP slow protocol frames (ethertype 0x8809) without participating, allowing the EX ae1 bundles to form despite the per-link wiring.

Topology:

[EX4400] ge-0/0/3 ---> ge-0/0/3 [SRX320] ge-0/0/1 ---> ge-0/0/1 [EX4100]
ge-0/0/4 ---> ge-0/0/4 ge-0/0/2 ---> ge-0/0/2

Configuration:

Model: srx320
Junos: 25.2R1-S2.3

set interfaces ge-0/0/1 native-vlan-id 100
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members v-100
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members v-200

set interfaces ge-0/0/2 native-vlan-id 100
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members v-100
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members v-200

set interfaces ge-0/0/3 native-vlan-id 100
set interfaces ge-0/0/3 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members v-100
set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members v-200

set interfaces ge-0/0/4 native-vlan-id 100
set interfaces ge-0/0/4 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members v-100
set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members v-200

set vlans v-100 vlan-id 100
set vlans v-200 vlan-id 200

set security forwarding-options secure-wire LAG-WIRE-1 interface ge-0/0/1.0
set security forwarding-options secure-wire LAG-WIRE-1 interface ge-0/0/3.0
set security forwarding-options secure-wire LAG-WIRE-2 interface ge-0/0/2.0
set security forwarding-options secure-wire LAG-WIRE-2 interface ge-0/0/4.0

set security zones security-zone EX4100 host-inbound-traffic system-services all
set security zones security-zone EX4100 host-inbound-traffic protocols all
set security zones security-zone EX4100 interfaces ge-0/0/1.0
set security zones security-zone EX4100 interfaces ge-0/0/2.0

set security zones security-zone EX4400 host-inbound-traffic system-services all
set security zones security-zone EX4400 host-inbound-traffic protocols all
set security zones security-zone EX4400 interfaces ge-0/0/3.0
set security zones security-zone EX4400 interfaces ge-0/0/4.0

set security policies global policy ALLOW-PING match source-address any
set security policies global policy ALLOW-PING match destination-address any
set security policies global policy ALLOW-PING match application junos-icmp-ping
set security policies global policy ALLOW-PING then permit

Model: ex4400-48t
Junos: 23.4R2-S4.11

set chassis aggregated-devices ethernet device-count 1

set interfaces ge-0/0/3 ether-options 802.3ad ae1
set interfaces ge-0/0/4 ether-options 802.3ad ae1

set interfaces ae1 native-vlan-id 100
set interfaces ae1 aggregated-ether-options lacp active
set interfaces ae1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ae1 unit 0 family ethernet-switching vlan members v-100
set interfaces ae1 unit 0 family ethernet-switching vlan members v-200

set interfaces irb unit 100 family inet address 3.3.3.2/24
set interfaces irb unit 200 family inet address 2.2.2.2/24

set vlans v-100 vlan-id 100
set vlans v-100 l3-interface irb.100
set vlans v-200 vlan-id 200
set vlans v-200 l3-interface irb.200

Model: ex4100-f-12p
Junos: 22.4R3.25

set chassis aggregated-devices ethernet device-count 1
set interfaces ge-0/0/1 ether-options 802.3ad ae1
set interfaces ge-0/0/2 ether-options 802.3ad ae1
set interfaces ae1 native-vlan-id 100
set interfaces ae1 aggregated-ether-options lacp active
set interfaces ae1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ae1 unit 0 family ethernet-switching vlan members v-100
set interfaces ae1 unit 0 family ethernet-switching vlan members v-200
set interfaces irb unit 100 family inet address 3.3.3.3/24
set interfaces irb unit 200 family inet address 2.2.2.3/24
set vlans v-100 vlan-id 100
set vlans v-100 l3-interface irb.100
set vlans v-200 vlan-id 200
set vlans v-200 l3-interface irb.200

Verification SRX320:

[edit]
root@jtac-SRX320# run show vlans

Routing instance VLAN name Tag Interfaces
default-switch default 1

default-switch v-100 100
ge-0/0/1.0*
ge-0/0/2.0*
ge-0/0/3.0*
ge-0/0/4.0*
default-switch v-200 200
ge-0/0/1.0*
ge-0/0/2.0*
ge-0/0/3.0*
ge-0/0/4.0*

[edit]
root@jtac-SRX320# run show security forward-options secure-wire
Logical System Secure wire Interface Link Interface Link

root-logical-system LAG-WIRE-1 ge-0/0/1.0 up ge-0/0/3.0 up
root-logical-system LAG-WIRE-2 ge-0/0/2.0 up ge-0/0/4.0 up

Total secure wires: 2

[edit]

root@jtac-SRX320# run request pfe execute command "show usp secure-wire all" target fwdd
================ master ================
SENT: Ukern command: show usp secure-wire all

LSYS id & Name Secure-wire id & Name IF1 Name IF2 Name Ready
----------------------- ------------------------------------ ------------------ ------------------ ------
0 root-logical-system 3 LAG-WIRE-1 ge-0/0/1.0 ge-0/0/3.0 Yes
0 root-logical-system 4 LAG-WIRE-2 ge-0/0/2.0 ge-0/0/4.0 Yes

[edit]
root@jtac-SRX320# run request pfe execute command "show usp interface secure-wire all" target fwdd
================ master ================
SENT: Ukern command: show usp interface secure-wire all

LSYS id & Name Interface Name PIID State Peer Name PIID State
------------------ ------------------ ------ ----- ------------------ ------ -----
0 root-logical-s ge-0/0/1.0 87 up ge-0/0/3.0 89 up
0 root-logical-s ge-0/0/2.0 88 up ge-0/0/4.0 90 up
0 root-logical-s ge-0/0/3.0 89 up ge-0/0/1.0 87 up
0 root-logical-s ge-0/0/4.0 90 up ge-0/0/2.0 88 up

Verification EX4400:

root@jtac-EX4400# run show interfaces terse | match ae
ge-0/0/3.0 up up aenet --> ae1.0
ge-0/0/4.0 up up aenet --> ae1.0
ae1 up up
ae1.0 up up eth-switch

root@jtac-EX4400# run show interfaces terse | match irb
irb up up
irb.100 up up inet 3.3.3.2/24
irb.200 up up inet 2.2.2.2/24

root@jtac-EX4400# run show lacp statistics interfaces
Aggregated interface: ae1
LACP Statistics: LACP Rx LACP Tx Unknown Rx Illegal Rx
ge-0/0/3 37 37 0 0
ge-0/0/4 37 37 0 0


root@jtac-EX4400# run show lacp interfaces
Aggregated interface: ae1
LACP state: Role Exp Def Dist Col Syn Aggr Timeout Activity
ge-0/0/3 Actor No No Yes Yes Yes Yes Fast Active
ge-0/0/3 Partner No No Yes Yes Yes Yes Fast Active
ge-0/0/4 Actor No No Yes Yes Yes Yes Fast Active
ge-0/0/4 Partner No No Yes Yes Yes Yes Fast Active

LACP protocol: Receive State Transmit State Mux State
ge-0/0/3 Current Fast periodic Collecting distributing
ge-0/0/4 Current Fast periodic Collecting distributing

root@jtac-EX4400# run ping 3.3.3.3
PING 3.3.3.3 (3.3.3.3): 56 data bytes
64 bytes from 3.3.3.3: icmp_seq=0 ttl=64 time=18.975 ms
^C
--- 3.3.3.3 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 18.975/18.975/18.975/0.000 ms

{master:0}[edit]
root@jtac-EX4400# run ping 2.2.2.3
PING 2.2.2.3 (2.2.2.3): 56 data bytes
64 bytes from 2.2.2.3: icmp_seq=0 ttl=64 time=14.001 ms
^C
--- 2.2.2.3 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 14.001/14.001/14.001/0.000 ms

Verification EX4100:

root@jtac-EX4100-F-12P-r008# run show interfaces terse | match ae1
ge-0/0/1.0 up up aenet --> ae1.0
ge-0/0/2.0 up up aenet --> ae1.0
ae1 up up
ae1.0 up up eth-switch

{master:0}[edit]
root@jtac-EX4100-F-12P-r008# run show interfaces terse | match irb
irb up up
irb.100 up up inet 3.3.3.3/24
irb.200 up up inet 2.2.2.3/24

{master:0}[edit]
root@jtac-EX4100-F-12P-r008# run show vlans

Routing instance VLAN name Tag Interfaces
default-switch default 1

default-switch v-100 100
ae1.0*
default-switch v-200 200
ae1.0*

root@jtac-EX4100-F-12P-r008# run show lacp interfaces
Aggregated interface: ae1
LACP state: Role Exp Def Dist Col Syn Aggr Timeout Activity
ge-0/0/1 Actor No No Yes Yes Yes Yes Fast Active
ge-0/0/1 Partner No No Yes Yes Yes Yes Fast Active
ge-0/0/2 Actor No No Yes Yes Yes Yes Fast Active
ge-0/0/2 Partner No No Yes Yes Yes Yes Fast Active
LACP protocol: Receive State Transmit State Mux State
ge-0/0/1 Current Fast periodic Collecting distributing
ge-0/0/2 Current Fast periodic Collecting distributing

root@jtac-EX4100-F-12P-r008# run show lacp statistics interfaces
Aggregated interface: ae1
LACP Statistics: LACP Rx LACP Tx Unknown Rx Illegal Rx
ge-0/0/1 816 816 0 0
ge-0/0/2 817 815 0 0

Modification History

01/26/2026 Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/security-secure-wire.html