Hi,
Ok so BGP has come up and i`m seeing active routes in the table but i cannot get any traffic to pass through the router itself e.g. ping or see any devices at either end. I have at the moment set all zones to all with all services to allow apart from the default global which is set to deny.
Config:
## Last commit: 2017-09-05 13:23:52 UTC by root
version 12.1X44-D40.2;
system {
host-name DC-MPLS-01;
root-authentication {
encrypted-password
}
name-server {
192.168.50.80;
192.168.50.81;
192.168.50.89;
}
login {
user administrator {
uid 2000;
class super-user;
authentication {
encrypted-password
}
}
}
services {
ssh;
telnet;
web-management {
http;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
description "LAN HQ";
family inet {
address 192.168.50.4/22;
}
}
}
ge-0/0/2 {
description "WAN MPLS";
unit 0 {
family inet {
address 172.0.0.6/30;
}
}
}
ge-0/0/3 {
description "UNUSED LAN";
unit 0 {
family inet {
address 10.1.1.1/24;
}
}
}
lo0 {
unit 0 {
family inet {
address 172.0.0.6/32;
}
}
}
}
snmp {
community public {
authorization read-only;
}
}
routing-options {
static {
route 172.0.0.0/30 next-hop 172.0.0.5;
}
router-id 172.0.0.6;
autonomous-system 65000;
}
protocols {
bgp {
group MPLS {
type external;
description "BT MPLS PEER";
export export-LAN;
peer-as 2856;
neighbor 172.0.0.5 {
local-address 172.0.0.6;
hold-time 90;
}
}
}
}
policy-options {
policy-statement export-LAN {
from {
protocol [ direct local ];
interface ge-0/0/0.0;
}
then accept;
}
policy-statement jweb-policy-default-route {
from {
route-filter 0.0.0.0/0 exact;
}
then accept;
}
policy-statement jweb-policy-direct {
from {
protocol direct;
interface ge-0/0/2.0;
}
then accept;
}
policy-statement jweb-policy-rip {
from protocol rip;
then accept;
}
}
security {
address-book {
Test {
description test;
address 1.1.1.1 {
description test;
1.1.1.1/32;
}
attach {
zone UnTrust;
}
}
}
policies {
from-zone Trust to-zone UnTrust {
policy Trust-Untrust {
description Trust-Untrust;
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
count;
}
}
}
from-zone UnTrust to-zone Trust {
policy Untrust-Trust {
description Untrust-Trust;
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
count;
}
}
}
default-policy {
deny-all;
}
}
zones {
security-zone Trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
lo0.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone UnTrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/2.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
}
}
Cheers,