Verify Default Branch Connectivity

Confirm the DHCP Client on the WAN Interface

Verify that the WAN interface received an IP address from the DHCP service provided by the Internet Service Provider (ISP). In the default configuration, the ge-0/0/0 interface is part of the untrust zone and is set as a DHCP client.

Confirm Internet Connectivity

Confirm Internet access with a successful ping to www.juniper.net.

Verify LAN connectivity. Branch SRX Default Security Policies summarizes the factory default security zones and their behavior. Refer to Branch SRX Factory Defaults for details on the physical connectivity and MAC addresses used by the various LAN devices.

While the port type and count varies between branch SRX models (SRX 300 Series), the factory default configuration results in the same type of connectivity:

• All LAN ports have full Layer 2 connectivity within the trust zone
• Traffic sent from any LAN port is allowed in the untrust zone
• Return traffic from the untrust zone is permitted back to the trust zone
• Traffic that originates in the untrust zone is blocked from the trust zone

Keep these defaults in mind as you continue to verify default connectivity.

Confirm LAN DHCP Server

Verify that the SRX assigns IP addresses to the LAN clients. Recall that in the factory default configuration, a Layer 3 capable Integrated Routing and Bridging (IRB) interface functions as a DCHP server for all LAN ports. Refer to Figure 1 to map the MAC addresses shown in the output to the devices and SRX ports used in our branch office.

The output confirms that the SRX device correctly assigns IP addresses from the default 192.168.2.0/24 address pool to the LAN clients.

Display VLANs

In the factory-default configuration, all LAN ports are in the same VLAN (vlan-trust) with full (unfiltered) Layer 2 connectivity for the shared 192.168.2.0/24 IP subnet. Use the show vlans command to display all VLANs on the device.

The output shows there are two VLANs: the default VLAN, assigned VLAN ID 1, and the vlan-trust VLAN, assigned VLAN ID 3. In the factory-default configuration, no interfaces are associated with the default VLAN. All the LAN ports are associated with the vlan-trust VLAN. Again, all interfaces assigned to the same VLAN have full connectivity at Layer 2.

Verify MAC Address Learning

Issue the show ethernet-switching table command to verify MAC learning in the vlan-trust VLAN.

The output confirms the expected MAC address learning for our LAN clients in the vlan-trust VLAN.

Note:

In a VLAN, MAC address learning occurs anytime a device sends any type of traffic. The SRX learns based on the source MAC address. This learning builds the Ethernet switching table that is used to forward traffic, based on the destination MAC address. Broadcast, unknown unicast, and multicast (BUM) traffic is flooded to all ports in the VLAN. In our case, the use of DHCP to obtain an IP address is enough to trigger the MAC address learning shown.

Confirm LAN Connectivity in the Trust Zone

To confirm LAN connectivity in the trust zone, simply send a ping between LAN clients. Alternatively, you can send pings from the SRX to each LAN client. For verification, log in to an employee device attached to the SRX ge-0/0/2 interface, and test connectivity to both the IRB interface in the SRX, and to the LAN device attached to the SRX's ge-0/0/1 interface. Use the MAC and IP addresses shown in the preceding command output.

First, confirm the employee device interface parameters. Specifically, the MAC and IP addresses:

Next, test the expected LAN connectivity with a ping to the SRX's IRB interface and to the LAN device attached to the ge-0/0/1 interface. As shown above, the LAN device on ge-0/0/1 is assigned IP address 192.168.2.13:

The pings are successful which verifies the expected connectivity for the trust VLAN ports. The added traceroute output confirms the shared IP subnet, and resulting direct connectivity, for the LAN stations. This connectivity will change when you later deploy multiple VLANs and IP subnets to secure local branch connectivity.

Send a ping to an Internet destination from a LAN client. If desired, you can source a ping from the SRX's IRB interface to exercise the same packet flow. The goal is to verify that traffic originating in the trust zone flows to the untrust zone with source NAT . This provides the LAN station with Internet connectivity.

Let's test Internet connectivity from the LAN client attached to the SRX ge-0/0/2 interface by sending a ping to the juniper.net website.

The ping is successful which confirms LAN to WAN connectivity. The output of the show route command confirms that the LAN station sends the test traffic to the SRX as its default gateway.

It's important to note that sending a ping from a LAN station to an Internet destination involves packet flow from the trust zone to untrust zone. The SRX is a flow-based device. A security policy is needed to permit flows between zones. As we noted in Branch SRX Default Security Policies, the factory-default policies allow trust to untrust packet flows.

View the flow session table to confirm that there are active sessions between the LAN clients and the WAN.

The output shows that your test traffic successfully created a flow table entry. A second entry for the same flow confirms that the SRX performed source NAT on the traffic (using 172.16.1.10 from its WAN interface), before sending the ping to the destination at 104.100.54.237 (www.juniper.net). This confirms that the traffic is permitted to flow from the trust zone to the untrust zone with source NAT. Your successful ping from a LAN station to www.juniper.net confirms the expected factory-default LAN-WAN connectivity.

Next, we'll show you how to alter the default LAN connectivity to secure the local branch according to your requirements.