Quantcast
Channel: All Routing posts
Viewing all articles
Browse latest Browse all 8688

Re: Need An Advice

$
0
0

Exactly but we do not trust the srx stability so we plan to do sth. like the given image below.

 

But there are mainly 3 problems.

 

 

1. Is there any possible way to policy based route the traffic if preferred route is SRX , because we want to send the UDP traffic firstly UDP Firewall 

 

2.  SRX require the pass the return traffic on it. If it returns directly from EX to MX this time srx start dropping incomming traffic.

 

 

3. We do not know what if our config is ok or not Smiley Very Happy

 

 

 

 

IMG_0281.JPG

 

 

 

 

Upstream ISP Connection :

set protocols bgp traceoptions file bgp-trace
set protocols bgp traceoptions file world-readable
set protocols bgp traceoptions flag open
set protocols bgp traceoptions flag state detail
set protocols bgp group UPISP type external
set protocols bgp group UPISP description UPISP
set protocols bgp group UPISP local-address 10.32.35.14
set protocols bgp group UPISP import SPD-IN
set protocols bgp group UPISP export SPD-OUT
set protocols bgp group UPISP peer-as 43391
set protocols bgp group UPISP neighbor 10.32.35.13

set policy-options policy-statement SPD-OUT term F from prefix-list DDOS-PREFIX-LIST
set policy-options policy-statement SPD-OUT term F then community + Firewall
set policy-options policy-statement SPD-OUT term F then accept
set policy-options policy-statement SPD-OUT term 1 from prefix-list SPD-PREFIX-LIST
set policy-options policy-statement SPD-OUT term 1 then accept
set policy-options policy-statement SPD-OUT term 500 then reject

set policy-options policy-statement SPD-IN term 1 then accept



BGP TO SRX & Ex - MX Config



set policy-options policy-statement export_bgp term 1 from protocol static
set policy-options policy-statement export_bgp term 1 from route-filter 185.90.82.0/24 exact
set policy-options policy-statement export_bgp term 1 then accept
set policy-options policy-statement export_bgp term END then reject


set policy-options policy-statement import_bgp term RFC_1918  from route-filter 192.168.0.0/16 exact
set policy-options policy-statement import_bgp term DENY_BOGONS from prefix-list BOGON-LIST
set policy-options policy-statement import_bgp term DENY_BOGONS then reject
set policy-options policy-statement import_bgp term DENY-RFC-1918 from route-filter 10.0.0.0/8 orlonger
set policy-options policy-statement import_bgp term DENY-RFC-1918 from route-filter 172.16.0.0/12 orlonger
set policy-options policy-statement import_bgp term DENY-RFC-1918 from route-filter 192.168.0.0/16 orlonger
set policy-options policy-statement import_bgp term DENY-RFC-1918 then reject
set policy-options policy-statement import_bgp term deny-own-pool from route-filter 185.90.82.0/24 orlonger
set policy-options policy-statement import_bgp term deny-own-pool then reject
set policy-options policy-statement import_bgp term DENY-MORE-THAN-/24 from route-filter 0.0.0.0/0 prefix-length-range /25-/32
set policy-options policy-statement import_bgp term DENY-MORE-THAN-/24 then reject
set policy-options prefix-list BOGON-LIST 0.0.0.0/8
set policy-options prefix-list BOGON-LIST 127.0.0.0/8
set policy-options prefix-list BOGON-LIST 169.254.0.0/16
set policy-options prefix-list BOGON-LIST 192.0.0.0/24
set policy-options prefix-list BOGON-LIST 192.0.2.0/24
set policy-options prefix-list BOGON-LIST 198.18.0.0/15
set policy-options prefix-list BOGON-LIST 198.51.100.0/24
set policy-options prefix-list BOGON-LIST 203.0.113.0/24
set policy-options prefix-list BOGON-LIST 224.0.0.0/4




set interfaces xe-0/0/1 unit 0 family inet address 10.10.10.1/30
set interfaces xe-0/0/2 unit 0 family inet address 10.10.10.13/30

set protocols bgp group internal type internal
set protocols bgp group internal local-address 10.10.10.1
set protocols bgp group internal export export_bgp
set protocols bgp group internal neighbor 10.10.10.2
set protocols bgp group internal neighbor 10.10.10.14

set protocols ospf area 0.0.0.0 interface xe-0/0/1.0
set protocols ospf area 0.0.0.0 interface xe-0/0/2.0

set routing-options autonomous-system 57844
set routing-options router-id 10.10.10.1


SRX Config :

set interfaces xe-1/0/0 unit 0 family inet address 10.10.10.2/30
set interfaces xe-4/0/1 unit 0 family inet address 10.10.10.17/30

set protocols bgp group MXE type internal
set protocols bgp group MXE local-address 10.10.10.2
set protocols bgp group MXE local-preference 100
set protocols bgp group MXE export send-direct
set protocols bgp group MXE neighbor 10.10.10.1
set protocols bgp group MXE neighbor 10.10.10.14

set protocols bgp group Exe type external
set protocols bgp group Exe export send-direct
set protocols bgp group Exe neighbor 10.10.10.18


set policy-options policy-statement send-direct term 1 from protocol direct
set policy-options policy-statement send-direct term 1 then accept


set routing-options autonomous-system 65001
set routing-options router-id 192.168.3.1



Ex Config :

set interfaces xe-0/0/34 unit 7 family inet address 10.10.10.14/30
set interfaces xe-0/0/35 unit 8 family inet address 10.10.10.18/30

set protocols bgp group internal type internal
set protocols bgp group internal export send-direct
set protocols bgp group internal local-preference 300
set protocols bgp group internal neighbor 10.10.10.13


set protocols bgp group SRX type external
set protocols bgp group SRX export send-direct
set protocols bgp group SRX peer-as 65001
set protocols bgp group SRX neighbor 10.10.10.17



set policy-options policy-statement send-direct term 1 from protocol direct
set policy-options policy-statement send-direct term 1 then accept


set routing-options router-id 10.10.10.14

set routing-options autonomous-system 65002
set routing-options static route 185.90.82.0/24
set interface xe-0/0/0 unit 0 family inet address 185.90.82.1/24;





 

 


Viewing all articles
Browse latest Browse all 8688

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>