Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

How to Configure a Switch Proxy Server

This chapter provides information about configuring the Switch Proxy server for a Juniper Mist™ Edge appliance.

Mist Edge Switch Proxy Overview

The switch proxy service in Juniper Mist™ Edge enables you to proxy all the data packets received from the Juniper EX series switches to the Juniper Mist™ cloud. You can benefit from this service when switches are behind an HTTP proxy or a firewall with port 2200 blocked. If a firewall exists between the Juniper Mist Edge device and the switch, you need to allow outbound access on TCP port 2222 (configurable) to the management port of the switch.

The following image illustrates the connectivity between a Juniper Mist Edge device, Juniper EX series switches, and the Juniper Mist cloud.

Configure a Switch Proxy

This topic describes how to enable the switch proxy service on Juniper Mist™ Edge and configure EX series switches to allow the cloud connection through Juniper Mist Edge.

Following are the prerequisites to configure the switch proxy service:

  • Claim and configure Juniper Mist Edge. See Deploy Juniper Mist Edge at the Organization Level.

  • Configure the Juniper Mist Edge out-of-band management (OOBM) interface with a static IP address.

  • Juniper Networks EX Series switches must connect to a DNS server. Juniper Networks also recommends that you connect the switches to a network time protocol (NTP) server. The switch must connect to the Juniper Mist™ cloud architecture over the Internet. If a firewall exists between the cloud and the switch, you need to allow outbound access on TCP port 2200 to the management port of the switch.

You can configure a switch proxy at the organization level or the site level. In a site-level switch proxy configuration, you can configure each site to proxy to a different Juniper Mist Edge device. However, for an organization-level configuration, you can configure only one Juniper Mist Edge device to use the switch proxy service.

The process includes two main steps:

  • Configure the switch proxy service at the site or organization level to instantiate and run the mxocproxy service on the given Juniper Mist Edge device.

  • Copy the switch configuration blob from the dashboard and paste it into the switch console.

To configure the Juniper Mist Edge devices to run the switch proxy and EX switches to communicate to the switch proxy device using Juniper Mist Edge:

  1. In the left menu of the Juniper Mist portal, select Organization>Site Configuration. Select a site. Or, select Organization>Settings.
  2. In the Switch Management pane:
    1. Under Switch Proxy, select Enable option button.
    2. Enter Proxy Host.
      This address will be the Juniper Mist Edge OOBM IP address.
    3. Enter Proxy Port. The default is 2222.
    4. Click clipboard icon to copy the commands and paste it on switch CLI.
    Configure the EX series switches with copied commands. You can check the sample blob (Proxy IP and host differs based on your configuration):
  3. Enter commit to save the configuration.
    After the commands are entered, the switch starts forwarding the management data to the Juniper Mist Edge on port 2200.

Configure a Switch Proxy Using the API

You can configure the switch proxy on Juniper Mist Edge appliance using the API instead of the Mist portal, if you prefer.

For a site-level API endpoint, you use this string: API endpoint: /api/v1/sites/{{SITE-ID}}/setting. Following is the API payload:

Troubleshoot a Switch Proxy

You can troubleshoot the switch proxy server to verify whether the proxy service is running on the Juniper Mist Edge or to verify the status of the switch.

To troubleshoot a switch proxy server:

  1. Check to make sure that the out-of-band-management (OOBM) interface is configured with a static IP address.
  2. Check the Mist Edge inventory page to make sure that the Switch proxy called mxocproxy service is running on Juniper Mist Edge.
  3. Verify the connection status on the switch.
    user@host> show system connections | grep 2200
  4. Verify the firewall configuration and logs. You can see if the port is allowed andif there are any logs identifying it as blocked connection.