How to create layer 2 trunk port and access vlans on a Juniper SRX

Introduction

Creating vlans on a Juniper SRX is not as straight forward if you’re used to Cisco gear for example. In this article I hope to explain how to create:

      • One port as a trunk port
      • Other ports as access port
      • Add a mgmt L3 interface

Creating the trunk port

Let’s first create the trunk port. The interface fe-0/0/0 is used as a uplink port to another switch, and this ports carriers multiple tagged vlans. And it carriers only tagged vlans. No untagged vlan is allowed on this port.

To configure the port as a trunk port, the  port-mode has to be set to “trunk” and the allowed vlans needs to be configured. In this case the tagged vlan id’s are: 100,102:

set interfaces fe-0/0/0 description UPLINK-BB-SLV-LAN-P1.0.12
set interfaces fe-0/0/0 unit 0 family ethernet-switching port-mode trunk
set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan members vlan-100

Note that the vlan names are used, which at this point still needs to be created. It’s also possible to specify the vlanid here:

set interfaces fe-0/0/0 description UPLINK-BB-SLV-LAN-P1.0.12
set interfaces fe-0/0/0 unit 0 family ethernet-switching port-mode trunk
set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan members 102
set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan members 100

Create the vlans

Creating the vlans is straightforward:

set vlans vlan-100 vlan-id 100
set vlans vlan-102 vlan-id 102

Create the access ports

Creating the access ports is just like creating a trunk port, accept the port-mode is set to .. yes you guessed it.. ‘access‘.  So let’s assume we want to set the ports fe0/0/01 – fe0/0/7 as access ports with vlan 102.

set interfaces fe-0/0/1 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/1 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/2 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/2 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/3 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/3 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/4 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/4 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/5 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/5 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/6 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/6 unit 0 family ethernet-switching vlan members vlan-102
set interfaces fe-0/0/7 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/7 unit 0 family ethernet-switching vlan members vlan-102

However, this is a lot of typing. With junos it’s possible to use an interface range configuration. This is somewhat different to Cisco’s IOS or IOS-XE.

To use a interface range, first create a interface range name. For example ‘access-ports’. Then the name ‘access-ports’ can be used to add members. Next the properties of the interfaces can be assigned.

This might sound complex, but it’s quite simple and easy to use (and powerful):

set interfaces interface-range access-ports member "fe-0/0/[1-7]"
set interfaces interface-range access-ports unit 0 family ethernet-switching port-mode access
set interfaces interface-range access-ports unit 0 family ethernet-switching vlan members vlan-102

Assign the interfaces to the vlans

In the last step, the interfaces needs to be assigned to the vlans. So to assign the trunk port and access port to vlan 102 we need to do the following:

set vlans vlan-102 interface fe-0/0/0.0
set vlans vlan-102 interface fe-0/0/1.0
set vlans vlan-102 interface fe-0/0/2.0
set vlans vlan-102 interface fe-0/0/3.0
set vlans vlan-102 interface fe-0/0/4.0
set vlans vlan-102 interface fe-0/0/5.0
set vlans vlan-102 interface fe-0/0/6.0
set vlans vlan-102 interface fe-0/0/7.0

Note: the interfaces added are added by using the unit number, which is 0 here.

The above could be done in one command: simply by using the previous defined interface range ‘access-port’:

set vlans vlan-102 interface access-ports

When the an interface range is used, the trunk ports needs to be added as well:

set vlans vlan-102 interface fe-0/0/0.0

At this point the configuration can be committed:

commit

At this point, the layer 2 configuration is complete. The most easiest way to check if everything works is to look at the mac table. The command to do this is:

show ethernet-switching mac-learning-log

If everything is well it’s shows the learned mac addresses.

Create a Layer 3 management interface

To manage the SRX, it might be handy to have management vlan. In this case vlan id 100 is used.

To add a layer 3 vlan interface the next configuration is needed:

First create the vlan interface:

set interfaces vlan unit 100 family inet address 10.90.0.14/24

Next the interface can be added to the vlan 100:

set vlans vlan-100 l3-interface vlan.100

To activate to configuration don’t forget to do a commit:

commit

Password recovery on SRX 100

Password recovery on Juniper SRX 100

One day when I arrived at the office I did find a little blue box on my desk, which turned out to be a Juniper SRX 100 firewall. While looking at this tiny device I remembered that a colleague of my told me he would give a Juniper SRX to me.

And since I really like hardware, even the small boxes 🙂 I’m very pleased he brought this SRX, and give it to me.. So a big thanks!

Up for a challenge

At the end of the day, well actually later that evening, after I had something to eat, it was time to power the SRX on. The original adapter was missing, but since I got a box full of adapters , finding the right adapter shouldn’t be a problem. And sure enough.. after a while I came up with an adapter which delivers 12V and 1.5A.

The adapter has its ground (-) on the outerside, and the plus (+) on the middle pin.

The SRX needs 12V and 1A, so this adapter will do just fine. After searching for a console cable (a standard Cisco console cable just works) I connected the SRX, plugged in the console and power, and switched the device on.

After a few moments I was greeted with a banner, telling me the device once belonged to Ziggo. And that also told me right away that a simple password recovery is not going to work.

The SRX has a reset button, which can be used to reset the password..  However through a configuration setting this button can be disabled.. And since this device once belong to Ziggo, I know for sure that they disabled this button. Of course I tried the reset button.. and yes.. it did nothing at all.

So how to get into this device….

Using an USB device

Their is only one way around this.. and that is: installing / upgrading the SRX. This can be done by putting a Junos image (.tgz file) on a USB device, or putting the image on a tftp server.

The first problem is: how to get a Junos file.. Well I don’t have a support contract with Juniper.. so I had to google for a while but finally found a torrent file.

This is however not recommended, for one: it’s illegal. And two: the image can be tempered with, and could hide some nasty stuff.  I don’t like the illegal stuff, and in my lab I can perfectly live with the possible security risk.

Anyway, once I got the software I formatted a USB stick, and copied the junos image. After inserting the usb stick in the SRX 100 I interrupted the boot sequence. This can be done by hitting the spacebar while connected to the serial console at boot time.

Once the boot process was interrupted I was looking for a command “install”. Unfortunately this command was not present in the u-shell.

So I rebooted pressing the reset button while booting, and this activated a second boot partition. This version had the install command.

From there I tried o load the image from the USB stick.. but that didn’t work. Well not to worry.. I got a tftp server.. Copied over the junos image to my tftp server and started a install by tftp..

 

And that worked 🙂 After completing the upgrade.. I can logging with the root user and no password.