close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

Configure Networks for SRX Series Firewalls

date_range 06-Feb-25

Networks are sources of the request in your Juniper WAN Assurance design. On the Juniper® SRX Series Firewall, networks create Address books used as the source for Security Policies and Advanced Policy Based Routing (APBR) Policies.

Networks enable you to define groups of users. In a WAN design, you need to identify the sources accessing your applications over the LAN segment and set up the users. Users are source addresses, which you can use later in the application policies.

Once you have created networks in the Juniper Mist™ cloud portal, you can use networks across the entire organization in the portal. WAN Assurance design uses networks as the source in the application policy.

To configure networks:

In the Juniper Mist cloud portal, click Organization > WAN > Networks.
A list of existing networks, if any, appears.

Click Add Networks in the upper right corner.

The Add Network window appears. Table 1 summarizes the options you can set in a network.

Table 1: Network Options
Fields	Description
Name	Enter a unique name for the network. The name can contain alphanumeric characters, underscores, and hyphens, and must be less than 32 characters long.
Subnet IP Address	Enter the network IP address. You can either use absolute values (example: 192.0.2.0) or use variables (example:{{SPOKE_LAN1_PFX}}.0 ).
Prefix Length	Enter the length of the address prefix, from 0 through 32. You can also use variables for prefix length. Example: {{PFX1}}
VLAN ID	(Optional) Enter the VLAN ID that is associated with the network. If your device is using an untagged interface, you should use 1 as the VLAN ID instead of the variable.
Source NAT Pool Prefix	(Optional) Enter IPv4 prefix for source NAT. Source NAT translates the source IP address of the traffic (which is a private IP address), to a public IP address.
Access to Mist Cloud	Check this option to allow other devices within the defined network to connect to the Mist cloud for management through the SRX Series Firewall. WAN Edge devices have built-in policies for connecting to Mist cloud services using WAN interfaces. Giving access to Mist cloud using this option will permit the network to use the built-in policies for connecting to Mist. Use case example: Management LAN networks for Mist-managed devices.
Advertise to the Overlay	Check the option to advertise the network to the hub devices through the overlay tunnels. When you select this option, the system displays following additional options for advertising: Advertise to Other Spokes—Network to advertise the network prefix to other spokes (default option). If you want the network to advertise the prefix only to hubs (not other spokes), disable the default option. Advertise to Hub LAN BGP Neighbor—Network to advertise the network prefix to any LAN BGP neighbor at the hub (default option). If you do not want to advertise, disable the default option. Advertise to Hub LAN OSPF Neighbor (SRX Only)—Network to advertise the network prefix to any LAN OSPF neighbor at the hub (default option). If you do not want to advertise, disable the default option. Override Prefix to Advertise— Enable this option when the prefix to advertise to the Hubs is not the original network but a different prefix. This is typically used when enabling NAT options. When you select this option, enter IP Address and Prefix Length. The portal also displays following route summarization options: Hub Overlay Summarization—Enable the network to summarize the network prefix advertised to the overlay. For example: Juniper Mist portal can summarize 192.168.1.0/24 to 192.168.0.0/16. This feature limits the number of BGP updates received by a hub from each spoke and sent by the hub back to all the other spokes. Hub LAN BGP Summarization—Enable the network to summarize the network prefix advertised to the LAN BGP neighbor. For example: Juniper Mist portal can summarize 192.168.1.0/24 to 192.168.0.0/16. Hub LAN OSPF Summarization—Enable the network to summarize the network prefix advertised to the LAN OSPF neighbor. For example: Juniper Mist portal can summarize 192.168.1.0/24 to 192.168.0.0/16. Route Summarization—Summarize local routes towards overlay. You can specify the IP addresses and prefix length of the summarized routes. For Session Smart Routers support summarization when the network is attached to the spoke only.
Networks Donot directly attached (SSR Only)	Select the networks that are not directly connected networks that arrive on this network assigned to a LAN.
Users	(Optional) Additional networks or users. Example: remote networks or users connected to the main network. Click the Add User option and enter the Name and IP Prefix of the additional user.
Static NAT	(Optional) Perform a one-to-one static mapping of the original private host source address to a public source address. Click the Add Static NAT option and enter the Name , Internal IP, External IP and select option to apply to outgoing traffic on Underlay or Overlay. Enter WAN Name for SRX Series Devices.
Destination NAT	(Optional) Translate the destination IP address of a packet. Click the Add Destination NAT option and enter the Name , Internal IP Internal Port, External IP, External Port and select option to apply to outgoing traffic on Underlay or Overlay. Enter WAN Name for SRX Series Devices.

Complete the configuration according to the details available in Table 2.

In this task, you use the variables for both the subnet IP address and prefix length fields to configure three networks: SPOKE-LAN1, HUB1-LAN1, and HUB2-LAN1.

Table 2: Network Configuration Example
Fields	Network 1	Network 2	Network 3
Name	SPOKE-LAN1	HUB1-LAN1	HUB2-LAN1
Subnet IP Address	{{SPOKE_LAN1_PFX}}.0	{{HUB1_LAN1_PFX}}.0	{{HUB2_LAN1_PFX}}.0
Prefix Length	24	24	24
VLAN ID	{{SPOKE_LAN1_VLAN}}	{{HUB1_LAN1_VLAN}}	{{HUB2_LAN1_VLAN}}
Access to Mist Cloud	Checked	Checked	Checked
Advertised via Overlay	Checked	Checked	Checked
Users	Name=All IP-Prefixes=10.0.0.0/8	-	-

Note:

The user "All" with IP prefix 10.0.0.0/8 serves as a wildcard for all the future LAN segments in the range. The SRX Series Firewall in hubs can use the same username (All) and IP prefix (10.0.0.8) to identify all spoke LAN interfaces using a single rule.

Note:

When you use variables, do not assume that the system imports all LAN segments on the hub site automatically. Sometimes, the system may apply an Any netmask, which has a wide scope and may generate security issues.

Click Add.
Figure 1 shows the list of newly created networks.

Figure 1: Networks Summary

Site Variables

You can configure the site variables on a per-site basis. Site variables allow you to use the same network definition with different values for each site without having to define multiple networks. Variables have the format {{variable_name}}. Defining networks with variables is common practice in WAN edge template configuration.

Tip: When working on configuration screens, look for the VAR indicators. Fields with this indicator allow site variables.

The fields with this label also display the matching variables (if configured) as you start typing a specific variable in it. This field lists variables from all sites within the organization.

The organization-wide list of variables can be viewed using GET /api/v1/orgs/:org_id/vars/search?var=*. This list is populated as variables are added under site settings.

Figure 2 shows two samples of configuring a network using absolute values and site variables.

Figure 2: Configuring Networks with Absolute Values and Variables

You can define the site variables in the Organization > Admin> Site Configuration pane.

Figure 3: Site Variables Settings Pane

This task uses variables for the VLAN ID and subnet IP address. Site variables that contain the first three octets substitute the subnet IP address variable values as shown in Figure 4.

Figure 4: Site Variables Displayed on the Site Configuration Page

arrow_backward PREVIOUS Configure Applications for SRX Series Firewalls

NEXT arrow_forward Configure Application Policies on SRX Series Firewalls

English

keyboard_arrow_right

Juniper Mist WAN Assurance Configuration Guide

Configure Networks for SRX Series Firewalls

Stay in touch