SRX1500透明模式配置

1、SRX Example -Configure Transparent-Bridging in SRXKB31081 Show Article PropertiesSUMMARY:This article assists in configuring the use of Transparent-Bridging on the SRX320, SRX325, SRX340, SRX345, SRX550HM and SRX-1500 devices.SYMPTOMS:Commit errors when attempting to use VLAN.x interfacesUse of IRB.

2、x interface does not pass transit trafficCAUSE:SRX300 series, SRX550HM and SRX-1500 using Junos 15.1X49 and higher versions support twoLayer-2 modes which use new configuration syntax compared to earlier Junos versions.The layer-2 modes are non-interoperable and impact how IRB.x interfaces are used.

3、Transparent-Bridgingo IRB interface is used as local management interfaceEthernet-Switchingo IRB interface is associated to layer-2 VLANs to allow L3-based routingNOTE : When not explicitly configured, the L2 mode is selected as follows when interfaces are configuredwith family ethernet-switching:15

4、.1X49-D10 - 15.1X49-D40 = Transparent-Bridging15.1X49-D50 and subsequent versions = SwitchingSOLUTION:Verify if device is using ethernet-switching or transparent-bridging mode rootSRX340 show ethernet-switching global-information Global Configuration:MAC aging interval : 0MAC learning : EnabledMAC s

5、tatistics : DisabledMAC limit Count : 0MAC limit hit : DisabledMAC packet action drop: DisabledLE aging time : 1200LE VLAN aging time : 1200Global Mode : Not set, Switching (or) transparent modeNOTE Value of not set appears when no interfaces are configured with family ethernet-switchingAdjust L2 mo

6、de for transparent-bridgingset protocols l2-learning global-mode transparent-bridgeAdding interfaces for transparent-bridgingset interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunkset interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan10set interfaces ge-0/0/

7、2 unit 0 family ethernet-switching interface-mode trunkset interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members vlan10Note: The interface-mode for an interface is by default in access mode, it does not have to be explicitly configured if using untagged traffic.Add irb.0 interface for ma

8、nagement accessset interfaces irb unit 0 family inet address 10.10.10.1/24Add interfaces to zonesset security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ping set security zones security-zone untrust interfaces ge-0/0/2.0Note: Device management allowed servic

9、es for connections to irb.x is based on incoming interface zone allowance of host-inbound-servicesDefine vlan bridge domain and associated device management access set vlans vlan10 vlan-id 10set vlans vlan10 l3-interface irb.0Define security policy for transparent trafficset security policies from-z

10、one trust to-zone untrust policy allow match source-address anyset security policies from-zone trust to-zone untrust policy allow match destination-address anyset security policies from-zone trust to-zone untrust policy allow match application anyset security policies from-zone trust to-zone untrust policy allow then permitSaving configuration to apply changes commitwarning: L2 global mode is changed from switching mode to transparentmode.Please use the command request system reboot on current node or all nodesin case of