This article provides the configuration needed for adding an SRX device to Sky Enterprise, when the SRX communicates via a custom routing-instance.
Example Topology
[LAN]---------------------------ge-0/0/1 [SRX] ge-0/0/0--------------------------------ISP 192.168.1.0/24 10.1.1.1/24
SRX Configuration
DNS is configured as follows:
set system name-server 8.8.8.8
Configuration from Sky Enterprise, when adding a device is provided below:
set system services ssh protocol-version v2 set system login user skyenterprise class super-user authentication encrypted-password $ABC123 set system services outbound-ssh client skyenterprise-ncd01 device-id srx320-r003-junipernetworks secret <secret> set system services outbound-ssh client skyenterprise-ncd01 services netconf keep-alive retry 3 timeout 5 set system services outbound-ssh client skyenterprise-ncd01 skyent01.juniper.net port 4087 timeout 60 retry 1000 set system services outbound-ssh client skyenterprise-ncd02 device-id srx320-r003-junipernetworks secret <secret> set system services outbound-ssh client skyenterprise-ncd02 services netconf keep-alive retry 3 timeout 5 set system services outbound-ssh client skyenterprise-ncd02 skyent02.juniper.net port 4087 timeout 60 retry 1000
The routing-instance configuration is as follows:
set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.10/24 set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.10/24 set security zones security-zone trust interfaces ge-0/0/1.0 set security zones security-zone untrust interfaces ge-0/0/0.0 set routing-instances custom-vr instance-type virtual-router set routing-instances custom-vr interface ge-0/0/0.0
As you can see in the above configuration, the SRX device is able to reach out to the Internet via a custom routing instance.
However, when the SRX firewall attempts to connect to Sky Enterprise, the Routing Engine generates the request from the default routing instance. Because there is no Internet connectivity via the default routing instance, the connection to Sky Enterprise fails.
When each device attempts to communicate to Sky Enterprise, it will send the connection from the default routing table (inet.0). This is expected behavior.
If your default routing instance does not have an interface or does not have Internet connectivity via inet.0, as a workaround, you can create a loopback interface to source the packet and route it to the custom routing instance.
A sample configuration is as follows:
Configuring the interface
set interfaces lo0 unit 0 family inet address 192.168.10.1/24
Assigning security zones
set security zones security-zone trust interfaces lo0.0
Adding a route in inet.0 to use custom-vr.inet.0
set routing-options static route 0.0.0.0/0 next-table custom-vr.inet.0
Policy statements to import routes from the default routing instance to a custom routing instance
set policy-options policy-statement master-to-custom term 1 from instance master set policy-options policy-statement master-to-custom term 1 then accept set routing-instances custom-vr routing-options instance-import master-to-custom
NAT configuration
When a license update request is generated by the Routing Engine (RE), it will use the loopback IP address as the source. Hence, a source NAT is required to translate this to an IP address that is routed over the Internet.
set security nat source rule-set interfacebasednat from zone junos-host set security nat source rule-set interfacebasednat to routing-instance custom-vr set security nat source rule-set interfacebasednat rule 1 match destination-address 0.0.0.0/0 set security nat source rule-set interfacebasednat rule 1 then source-nat interface
With the above change, you will see the following route in inet.0:
root> show route 0.0.0.0 inet.0: 11 destinations, 12 routes (11 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0 *[Static/5] 5d 19:23:31 to table custom-vr.inet.0 custom-vr.inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0 *[Static/5] 5d 19:23:31 > to 10.1.1.1 via ge-0/0/0.0
Confirming Connectivity with Sky Enterprise
You can verify connectivity by looking at the Sky Enterprise device list. If successful, it will show the device as being "Online"
You can verify connection from the device by issuing the command "show system connections | match 4087"
root@s10-23> show system connections | match 4087 tcp4 0 0 192.168.1.1.56945 xx.xx.xx.21.4087 ESTABLISHED tcp4 0 0 192.168.1.1.62095 xx.xx.xx.108.4087 ESTABLISHED root@s10-23>
2021-01-16: Added note to not use a martian route for lo0.0. 2020-02-23: Changed passwords. 2020-01-12: Added note regarding not using martian routes for lo0 interface.