close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

Full Stack Design for SRX Series Firewalls

date_range 28-Jan-25

The Juniper® SD-WAN driven by Mist AI™ Full Stack design example is a follow-up to the Mist WAN Assurance deployment for SRX Series Firewalls. For more details, see WAN Assurance Configuration Overview.

Overview

With this configuration example, you’re expanding network capabilities by integrating Mist APs and Juniper EX Switches. This full stack example shows you how to set up your Juniper SD-WAN SRX Series WAN edge devices in concert with Juniper EX Series Switches deployed in wired assurance. This brings all your network devices into a cohesive onboarding, monitoring, and troubleshooting dashboard.

The example begins at the highest level of WAN assurance, focusing on SRX Series Firewalls. We assume that you already deployed SRX Series Firewall in a hub and spoke network. The SRX Series Firewall serves as the WAN edge device and foundation for building out your entire network.

For this full-stack design, you'll need at least one Juniper EX Switch to onboard into the Mist cloud. If you plan to do advanced testing with virtual circuits, two EX Switches is ideal. Additionally, you can incorporate a Mist AP into the setup to enhance the wireless capabilities of the network. Integrating APs and switches into your LAN network for management by Mist allows effortless monitoring and control of WAN edge devices, switches, and APs via the Juniper Mist portal dashboard.

Figure 1 shows the Full Stack Juniper Mist WAN Assurance topology used in this example.

Figure 1: Juniper® Mist Validated Design - Mist WAN Assurance with Wireless and Wired Assurance

Requirements

To get started, you’ll need to alter some of the interfaces configured on SRX Series Firewall for WAN deployment. In this example, we'll change interfaces using WAN edge templates. You can find the details on WAN edge templates here: Configure WAN Edge Templates for SRX Series Firewalls.

In addition, this example uses:

Desktop3 VM (VLAN1077) - Operates as a viewer for the Raspberry Pi, the wireless client. Alternatively, you could use a local notebook.
Desktop1 VM (VLAN1099) - Connected to the interface ge-0/0/0 of the new branch switch.

Create a New Spokes Configuration Template

To create a new spokes configuration quickly and efficiently, you can clone the template for an existing spoke and then make the necessary changes. It makes things much easier.

In the Juniper Mist™ portal, click Organization > WAN > WAN Edge Templates.
Figure 2: Navigate to WAN Edge Template

Note:
You can create a template by importing the shared JSON file also.

A list of existing templates, if any, appears.
Figure 3: List of WAN Edge Templates

Create a spoke template by cloning an existing spoke template.
Click More and select Clone.
Figure 4: Selecting Clone Option for Template
Enter the name as Spokes-with-Switch and click Clone.
Figure 5: Saving Cloned Template

Tip:
Refresh your browser after cloning. This ensures objects displayed are truly refreshed.

Edit the LAN Interface

On the LAN interface configuration section, edit the existing interface (LAN1).
Figure 6: LAN Interface Configuration on Template

Change the name of LAN1 interface as SPOKE-LAN1 and apply following changes:
Figure 7: Modify LAN Interface Configuration
- Interface—ge-0/0/5, ge-0/0/6.
- Port Aggregation—Enable.
- Enable Force Up—Enable. We recommend this configuration when the switch has no dedicated OOB interface in the LAG and using in-band managed interface. This setting prevents the switch from losing the connection to the Juniper Mist Cloud
- AE Index—0 (as there is no LAG port enabled).
Continue to configure the SPOKE-LAN1 interface:
Figure 8: Modify LAN Interface Configuration
- Untagged VLAN—Yes. This setting enables VLAN access/native to handout DHCP-leases to the switch. Otherwise, set the site variable {{SPOKE_LAN1_VLAN}} to “0” to have the same results.
- DHCP—Server
- IP Start—{{SPOKE_LAN1_PFX}}.100
- IP End—{{SPOKE_LAN1_PFX}}.199
- Gateway—{{SPOKE_LAN1_PFX}}.1
- DNS Servers—8.8.8.8, 9.9.9.9
Figure 9shows the LAN interface you modified.
Figure 9: Summary of LAN Interface
Click Save to save your changes.
Figure 10: Saving WAN Edge Template

Assign the New Template to a Site

Scroll to the top of the WAN Edge Templates page and click Assign to Sites under Spokes panel.
Figure 11: Assign Spoke Templates to Sites
In the Assign Template to Sites pane, select spoke1-site template and click Apply.
Figure 12: Select Sites to Assign Spoke Templates
Review the template settings as shown in Figure 13.
Figure 13: Details of WAN Edge Template

Add Your Switch to the Topology

Now it is time to onboard your switch and add it to your infrastructure. For details on how to onboard your switch, refer to the product documentation for your switch in the Juniper TechLibrary.

For details on getting a new cloud-ready EX switch up and running in the Juniper Mist AI cloud portal, see Cloud-Ready EX and QFX Switches with Mist.

To assign a switch to a site:

In the Juniper Mist portal, click Organization > Admin > Inventory.
Figure 14: Navigating to Inventory
In the Inventory page, ensure the inventory view is set to org (Entire Org) and refresh your browser until you see all your devices.
Figure 15: EX Series Switch in Inventory
Select your new switch and click Assign to Site.
On the Assign Switches page:
- Select the spoke1-site.
- Disable Manage configuration with Mist option. You can enable this option at a later stage if required.
Figure 16: Selecting Site for Assigning Switch
Click Assign to Site.
Confirm the changes in the inventory once you assign the device to the site.
You can see spoke1-site under New Site.

Figure 17: Assigned Switch to Site Details
In the Juniper Mist portal, go to Switches and select spoke1-site.
Figure 18: Selecting Assigned Switch for Modification

The page displays the list of switches assigned to the site.
Click the required switch to open the switch configuration page.
Verify the device name, then scroll down to Switch Configuration section and check Enable Configuration Management.
Figure 19: Configuration of Assigned Switch
Under Port Configuration, click Add Port Range.
Figure 20: Port Configuration of Assigned Switch
In the New Port Range page, configure the following options:
- Enable Port Aggregation.
- Set AE Index to 0 to ensure that the AE index is the same on both sides.
- Set the Port IDs as ge-0/0/1 and ge-0/0/2 ( two ports for the LAG).
- Select the existing Configuration Profile as Uplink.
Figure 21: Port Configuration of Assigned Switch
Figure 20 shows the summary of port configuration.
Figure 22: Port Configuration of Assigned Switch
Save your changes.
Figure 23: Save Changes

You’ve now added a Juniper switch to your Mist WAN Assurance deployment.

Optionally, you can confirm your switch has the two links towards SRX Series Firewall using Remote Shell as shown in the following sample:

content_copy zoom_out_map
show lacp interfaces
Aggregated interface: ae0
LACP state: Role Exp Def Dist Col Syn Aggr Timeout Activity
ge-0/0/1 Actor No No Yes Yes Yes Yes Fast Active
ge-0/0/1 Partner No No Yes Yes Yes Yes Fast Active
ge-0/0/2 Actor No No Yes Yes Yes Yes Fast Active
ge-0/0/2 Partner No No Yes Yes Yes Yes Fast Active
LACP protocol: Receive State Transmit State Mux State
ge-0/0/1 Current Fast periodic Collecting distributing
ge-0/0/2 Current Fast periodic Collecting distributing

arrow_backward PREVIOUS High Availability Design for Session Smart Routers

NEXT arrow_forward High Availability Design for SRX Series Firewalls

English

Full Stack Design for SRX Series Firewalls

Overview
Create a New Spokes Configuration Template
Edit the LAN Interface
Assign the New Template to a Site
Add Your Switch to the Topology

keyboard_arrow_right

Juniper Mist WAN Assurance Configuration Guide

Full Stack Design for SRX Series Firewalls

Overview

Requirements

Create a New Spokes Configuration Template

Edit the LAN Interface

Assign the New Template to a Site

Add Your Switch to the Topology

Full Stack Design for SRX Series Firewalls

Stay in touch