Layer 2 Interfaces on Security Devices

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure a Layer 2 logical interface as a trunk port:

1. Configure the logical interface.

   content_copy zoom_out_map

   [edit interfaces ge-3/0/0]
   user@host# set unit 0 family ethernet-switching interface-mode trunk vlan members 1–10 
   

2. Specify a VLAN ID for untagged packets.

   content_copy zoom_out_map

   [edit interfaces ge-3/0/0]
   user@host# set vlan-tagging native-vlan-id 10
   

3. If you are done configuring the device, commit the configuration.

   content_copy zoom_out_map

   [edit]
   user@host# commit
   

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 10
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members 10
set protocols l2-learning global-mode transparent-bridge
set interfaces irb unit 10 family inet address 10.10.10.1/24
set security zones security-zone L2 interfaces ge-0/0/1.0
set security zones security-zone L2 interfaces ge-0/0/0.0
set vlans vlan-10 vlan-id 10 
set vlans vlan-10 l3-interface irb.10 
set interfaces ge-0/0/2 unit 0 family inet address 192.0.2.1/24
set interfaces ge-0/0/3 unit 0 family inet address 192.0.2.3/24
set security policies default-policy permit-all
set security zones security-zone L2 host-inbound-traffic system-services any-service
set security zones security-zone L2 host-inbound-traffic protocols all
set security zones security-zone L3 host-inbound-traffic system-services any-service
set security zones security-zone L3 host-inbound-traffic protocols all
set security zones security-zone L3 interfaces ge-0/0/2.0
set security zones security-zone L3 interfaces ge-0/0/3.0

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure Layer 2 and Layer 3 interfaces:

1. Create a Layer 2 family type to configure Layer 2 interfaces.

   content_copy zoom_out_map

   [edit interfaces]
   user@host# set ge-0/0/0 unit 0 family ethernet-switching interface-mode access
   user@host# set ge-0/0/0 unit 0 family ethernet-switching vlan members 10
   user@host# set ge-0/0/1 unit 0 family ethernet-switching interface-mode access
   user@host# set ge-0/0/1 unit 0 family ethernet-switching vlan members 10 
   

2. Configure Layer 2 interfaces to work under transparent-bridge mode.

   content_copy zoom_out_map

   [edit protocols]
   user@host# set l2-learning global-mode transparent-bridge
   

3. Configure an IP address for the IRB interface.

   content_copy zoom_out_map

   [edit interfaces]
   user@host# set irb unit 10 family inet address 10.10.10.1/24
   

4. Configure Layer 2 interfaces.

   content_copy zoom_out_map

   [edit security zones security-zone L2 interfaces]
   user@host# set ge-0/0/1.0
   user@host#  set ge-0/0/0.0
   

5. Configure VLAN.

   content_copy zoom_out_map

   [edit vlans vlan-10]
   user@host# set vlan-id 10
   user@host# set l3-interface irb.10
   

6. Configure IP addresses for Layer 3 interfaces.

   content_copy zoom_out_map

   [edit interfaces]
   user@host# set ge-0/0/2 unit 0 family inet address 192.0.2.1/24
   user@host# set ge-0/0/3 unit 0 family inet address 192.0.2.3/24
   

7. Configure the policy to permit the traffic.

   content_copy zoom_out_map

   [edit security policies]
   user@host# set default-policy permit-all
   

8. Configure Layer 3 interfaces.

   content_copy zoom_out_map

   [edit security zones security-zone]
   user@host# set L2 host-inbound-traffic system-services any-service
   user@host# set L2 host-inbound-traffic protocols all
   user@host# set L3 host-inbound-traffic system-services any-service
   user@host# set L3 host-inbound-traffic protocols all
   user@host# set L3 interfaces ge-0/0/2.0
   user@host# set L3 interfaces ge-0/0/3.0
   

Results

From configuration mode, confirm your configuration by entering the show interfaces, show security policies, show vlans, and show security zones commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

[edit]
user@host# show interfaces
    ge-0/0/0 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members 10;
                }
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members 10;
                }
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family inet {
                address 192.0.2.1/24;
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family inet {
                address 192.0.2.3/24;
            }
        }
    }
    irb {
        unit 10 {
            family inet {
                address 10.10.10.1/24;
            }
        }
    }
[edit]
user@host#  show security policies
default-policy {
    permit-all;
}
[edit]
user@host# show vlans
    vlan-10 {
        vlan-id 10;
        l3-interface irb.10;
    }
[edit]
user@host#  show security zones
    security-zone L2 {
        host-inbound-traffic {
            system-services {
                any-service;
            }
            protocols {
                all;
            }
        }
        interfaces {
            ge-0/0/1.0;
            ge-0/0/0.0;
        }
    }
    security-zone L3 {
        host-inbound-traffic {
            system-services {
                any-service;
            }
            protocols {
                all;
            }
        }
        interfaces {
            ge-0/0/2.0;
            ge-0/0/3.0;
        }
    }

If you are done configuring the device, enter commit from configuration mode.

Purpose

Verify that the Layer 2 and Layer 3 interfaces and Layer 2 and Layer 3 zones are created.

Action

From operational mode, enter the show security zones command.

user@host> show security zones
 Security zone: HOST
  Send reset for non-SYN session TCP packets: Off
  Policy configurable: Yes
  Interfaces bound: 0
  Interfaces:

Security zone: L2
  Send reset for non-SYN session TCP packets: Off
  Policy configurable: Yes
  Interfaces bound: 2
  Interfaces:
    ge-0/0/0.0
    ge-0/0/1.0

Security zone: L3
  Send reset for non-SYN session TCP packets: Off
  Policy configurable: Yes
  Interfaces bound: 2
  Interfaces:
    ge-0/0/2.0
    ge-0/0/3.0

Security zone: junos-host
  Send reset for non-SYN session TCP packets: Off
  Policy configurable: Yes
  Interfaces bound: 0
  Interfaces:

Meaning

The output shows the Layer 2 (L2) and Layer 3 (L3) zone names and the number and names of Layer 2 and Layer 3 interfaces bound to the L2 and L3 zones.

Purpose

Verify that the Layer 2 and Layer 3 sessions are established on the device.

Action

From operational mode, enter the show security flow session command.

user@host> show security flow session 
Session ID: 1, Policy name: default-policy-logical-system-00/2, Timeout: 58, Valid
  In: 10.102.70.75/54395 --> 228.102.70.76/9876;udp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 1209, Bytes: 1695018,
  Out: 228.102.70.76/9876 --> 10.102.70.75/54395;udp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,

Session ID: 2, Policy name: default-policy-logical-system-00/2, Timeout: 58, Valid
  In: 10.102.70.19/23364 --> 228.102.70.20/23364;udp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 401, Bytes: 141152,
  Out: 228.102.70.20/23364 --> 10.102.70.19/23364;udp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,

Meaning

The output shows active sessions on the device and each session’s associated security policy.

• Session ID 1—Number that identifies the Layer 2 session. Use this ID to get more information about the Layer 2 session such as policy name or number of packets in and out.

• default-policy-logical-system-00/2—Default policy name that permitted the Layer 2 traffic.

• In—Incoming flow (source and destination Layer 2 IP addresses with their respective source and destination port numbers, session is ICMP, and the source interface for this session is ge-0/0/0.0).

• Out—Reverse flow (source and destination Layer 2 IP addresses with their respective source and destination port numbers, session is ICMP, and destination interface for this session is ge-0/0/1.0).

• Session ID 2—Number that identifies the Layer 2 session. Use this ID to get more information about the Layer 2 session such as policy name or number of packets in and out.

• default-policy-logical-system-00/2—Default policy name that permitted the Layer 2 traffic.

• In—Incoming flow (source and destination Layer 2 IP addresses with their respective source and destination port numbers, session is ICMP, and the source interface for this session is ge-0/0/0.0,).

• Out—Reverse flow (source and destination Layer 2 IP addresses with their respective source and destination port numbers, session is ICMP, and destination interface for this session is ge-0/0/1.0,).