I treated myself with a juniper srx220 and an ex4200 for my homelab. I was googleing but couldn’t really find anyone who wrote how to configure the srx 220 after a factory reset via cli as an internet gateway. Here is my config for JUNOS 12.1X44-D45.2 after the factory reset.<\/p>\n
1. login into your srx via serial cable (the username is root without a password)<\/p>\n
login:\r\n<\/pre>\n2. go into cli mode<\/p>\n
root@core% cli\r\n<\/pre>\n3. go into edit mode<\/p>\n
root@core> edit\r\nEntering configuration mode\r\n\r\n[edit]\r\nroot@core#\r\n<\/pre>\n4. Now we can begin with the General config. First lets set the root password<\/p>\n
root@core# set system root-authentication plain-text-password\r\n<\/pre>\n5. Next set the host name, name server and ntp for the router<\/p>\n
root@core# set system host-name core\r\nroot@core# set system name-server 192.168.1.3 (this is my nameserver)\r\nroot@core# set system name-server 8.8.8.8 (in case my nameserver fails)\r\nroot@core# set system ntp server 66.219.116.140\r\n<\/pre>\n6. Create an admin user<\/p>\n
root@core# set system login user ldomb uid 1500\r\nroot@core# set system login user ldomb class super-user\r\nroot@core# set system login user ldomb authentication plain-text-password<\/pre>\n7. Configure the uplink for the internet provider. I don't have a static ip so we will configure dhcp<\/pre>\nroot@core# set interfaces ge-0\/0\/0 description Internet_Uplink\r\nroot@core# set interfaces ge-0\/0\/0 unit 0 family inet dhcp update-server\r\n<\/pre>\n8. We do not need to create a vlan as the factory default created the mgmt vlan vlan.0 for us with tag id 3. But ping on the ge-0\/0\/0.0 interface was not enabled so I will enable that. <\/p>\n
\r\nroot@core# set security zones security-zone untrust interfaces ge-0\/0\/0.0 host-inbound-traffic system-services ping\r\n<\/pre>\n9. Lets check if we got a dhcp address from the cable modem<\/p>\n
\r\nroot@core> show system services dhcp client \r\nLogical Interface name ge-0\/0\/0.0\r\n Hardware address 10:0f:7f:db:23:00\r\n Client status bound\r\n Address obtained 69.194.42.6\r\n Update server enabled\r\n Lease obtained at 2015-06-19 22:24:17 UTC\r\n Lease expires at 2015-06-20 04:24:17 UTC\r\n\r\nDHCP options:\r\n Name: router, Value: [ 69.194.40.1 ]\r\n Code: 1, Type: ip-address, Value: 255.255.252.0\r\n Name: name-server, Value: [ 167.206.245.135, 167.206.245.136 ]\r\n Name: server-identifier, Value: 167.206.195.54\r\n<\/pre>\n10. Lets modify the default dhcp scope as its set from .2-254. <\/p>\n
\r\nroot@core# set system services dhcp pool 192.168.1.0\/24 address-range low 192.168.1.100\r\nroot@core# set system services dhcp pool 192.168.1.0\/24 address-range low 192.168.1.150\r\n<\/pre>\n11. The default route was not set in my case so I set it<\/p>\n
\r\nroot@core# set system services dhcp pool 192.168.1.0\/24 router 192.168.1.1\r\n<\/pre>\n12. We do not need to configure anything else as the dhcp settings are already propagated. <\/p>\n
13. You should now be able to see dhcp clients if you provided them a lease. <\/p>\n
\r\nroot@core> show system services dhcp binding \r\nIP address Hardware address Type Lease expires at\r\n192.168.1.100 c8:0a:a9:b0:90:20 dynamic 2015-06-20 20:53:43 UTC\r\n<\/pre>\n14. For dynamic dns with dyndns.org add the following config<\/p>\n
\r\nroot@core# set system services dynamic-dns client rotehuet.my-host.com server dyndns\r\nroot@core# set system services dynamic-dns client rotehuet.my-host.com username ilove\r\nroot@core# set system services dynamic-dns client rotehuet.my-host.com password \"opensource\"\r\nroot@core# set system services dynamic-dns client rotehuet.my-host.com interface ge-0\/0\/0.0 \r\n<\/pre>\n15. Check if it worked<\/p>\n
\r\nroot@core> show system services dynamic-dns client detail \r\n\r\nHostname : rotehuet.my-host.com\r\nServer : members.dyndns.org\r\nLast response: nochg \r\nLast update : 2015-06-19 22:24:34 UTC\r\nUsername : ilove \r\nInterface : ge-0\/0\/0.0 \r\nAgent : ddns-0.1 JUNOS [Model #] (Firmware version)\r\n<\/pre>\n18. To be able to refer to the destination host we need to create an address book entry<\/p>\n
\r\nroot@core# set security zones security-zone trust address-book address dobby 192.168.1.40\/32\r\n<\/pre>\n17. I also want to be able to forward all incoming traffic from ge-0\/0\/0.0 port 2222 to my internal ip 192.168.1.40 port 22. Create the dst nat pool<\/p>\n
\r\nroot@core# set security nat destination pool trust-192_168_1_40 address 192.168.1.40\r\nroot@core# set security nat destination pool trust-192_168_1_40 address port 22\r\n<\/pre>\n18. Edit the nat destination address and port. <\/p>\n
\r\nroot@core# set security nat destination rule-set on_ge0_0_0 from interface ge-0\/0\/0.0\r\nroot@core# set security nat destination rule-set on_ge0_0_0 rule 1 match destination-address 0.0.0.0\/0\r\nroot@core# set security nat destination rule-set on_ge0_0_0 rule 1 match destination-port 2222\r\nroot@core# set security nat destination rule-set on_ge0_0_0 rule 1 then destination-nat pool trust-192_168_1_40\r\n<\/pre>\n19. Then set the rule set on the interface and make sure you add drop-untranslated prevents you from forwarding unwanted ports
\nand addresses.<\/p>\n\r\nroot@core# set security policies from-zone untrust to-zone trust policy on_ge0_0_0 match source-address any\r\nroot@core# set security policies from-zone untrust to-zone trust policy on_ge0_0_0 match destination-address dobby\r\nroot@core# set security policies from-zone untrust to-zone trust policy on_ge0_0_0 match application any\r\nroot@core# set security policies from-zone untrust to-zone trust policy on_ge0_0_0 then permit destination-address drop-untranslated\r\n<\/pre>\n20. Make sure you didn’t do a mistake and do a simulate commit<\/p>\n
\r\nroot@core# commit check\r\nconfiguration check succeeds\r\n\r\n[edit]\r\n<\/pre>\n21. Commit your change<\/p>\n
\r\nroot@core# commit\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"I treated myself with a juniper srx220 and an ex4200 for my homelab. I was googleing but couldn’t really find anyone who wrote how to configure the srx 220 after a factory reset via cli as an internet gateway. Here is my config for JUNOS 12.1X44-D45.2 after the factory reset. 1. login into your srx…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[1],"tags":[40,41],"class_list":["post-1072","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-juniper-srx-220-dynamic-dns-dyndns","tag-srx220"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/1072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1072"}],"version-history":[{"count":17,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/1072\/revisions"}],"predecessor-version":[{"id":1093,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/1072\/revisions\/1093"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}