This article describes how to connect a Juniper SRX as a spoke to an SSR appliance acting as the hub in a Mist WAN environment.

SVR is not supported when using an SRX as a spoke to an SSR hub. However, the SRX can be connected to the SSR using a router-to-router connection with traffic steering.

The configuration requires the following:

1. Establish an IPsec VPN between the SSR and SRX
   • Configure a Custom Secure Edge Connector on the SSR.
   • Use the Custom Secure Edge Connector to establish an IPsec VPN between the WAN endpoints of the SSR hub and the SRX spoke.
   • This provides the required connectivity between the two devices.
2. Configure BGP between the SSR and SRX
   • Create a separate BGP group on the SSR hub and on the SRX.
   • Configure the BGP session to advertise and receive routes between the two devices.
   • In the BGP group configuration, set the Path to Sec Tunnel.
   • Specify the name of the corresponding Secure Edge Connector.

Configuration References

Custom Secure Edge Connector

For information on configuring a Custom Secure Edge Connector, refer to the Juniper documentation:

Configure a Custom Secure Edge Connector

BGP Configuration Using Sec Tunnel

For information on configuring BGP with the Sec Tunnel path, refer to the BGP configuration documentation:

BGP Configuration in Mist WAN

Under Peering Network, select Sec Tunnel and specify the appropriate Secure Edge Connector.

Summary

The supported approach is:

SRX Spoke ↔ IPsec VPN / Custom Secure Edge Connector ↔ SSR Hub

Once the IPsec tunnel is established, BGP over the Sec Tunnel can be used to exchange routes between the SRX and SSR.