This article provides information on how to configure VLAN re-tagging on the SRX Stand-alone device, which is running in bridging mode.

To re-tag the packets from Vlan 100 to Vlan 200 ingressing into ge-0/0/0. Once these packets are re-tagged, they will be sent out via ge-0/0/1.

interfaces {
    ge-0/0/0 {
        unit 0 {
            family bridge {
                interface-mode trunk;
                vlan-id-list 200;
                vlan-rewrite {
                    translate 100 200;
                }
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family bridge {
                interface-mode trunk;
                vlan-id-list 200;
            }
        }
    }
}
security {
    policies {
        default-policy {
            permit-all;
        }
    }
    zones {
        security-zone trust {
            interfaces {
                ge-0/0/0.0;
            }
        }
        security-zone untrust {
            interfaces {
                ge-0/0/1.0;
            }
        }
    }
}
bridge-domains {
    v200 {
        domain-type bridge;
        vlan-id 200;
    }
}

• The packet comes in via ge-0/0/0 with VLAN 100 and gets translated to VLAN 200. Once translated, it can be sent out via ge-0/0/1.
• This mechanism works in the reverse direction as well. If a packet comes into ge-0/0/1 with VLAN 200 and wants to go out via ge-0/0/0, VLAN will be reverse translated from VLAN 200 to VLAN 100; prior to being sent out via ge-0/0/0.
• Security Policies and Security Zone will be defined normally, as they should be, even with the L3 mode.
• The default policy is permit-all , which is present just for the sake of simplicity.