Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Verify Default Branch Connectivity

First, let's verify the default WAN and LAN connectivity on the SRX.

Verify WAN Connectivity

Confirm the DHCP Client on the WAN Interface

Verify that the WAN interface received an IP address from the DHCP service provided by the Internet Service Provider (ISP). In the default configuration, the ge-0/0/0 interface is part of the untrust zone and is set as a DHCP client.

Confirm Internet Connectivity

Confirm Internet access with a successful ping to

Verify LAN Connectivity

Verify LAN connectivity. Branch SRX Default Security Policies summarizes the factory default security zones and their behavior. Refer to Branch SRX Factory Defaults for details on the physical connectivity and MAC addresses used by the various LAN devices.

Figure 1: Branch SRX Default Security Policies Branch SRX Default Security Policies

While the port type and count varies between branch SRX models (SRX 300 Series), the factory default configuration results in the same type of connectivity:

  • All LAN ports have full Layer 2 connectivity within the trust zone
  • Traffic sent from any LAN port is allowed in the untrust zone
  • Return traffic from the untrust zone is permitted back to the trust zone
  • Traffic that originates in the untrust zone is blocked from the trust zone

Keep these defaults in mind as you continue to verify default connectivity.

Confirm LAN DHCP Server

Verify that the SRX assigns IP addresses to the LAN clients. Recall that in the factory default configuration, a Layer 3 capable Integrated Routing and Bridging (IRB) interface functions as a DCHP server for all LAN ports. Refer to Figure 1 to map the MAC addresses shown in the output to the devices and SRX ports used in our branch office.

The output confirms that the SRX device correctly assigns IP addresses from the default address pool to the LAN clients.

Display VLANs

In the factory-default configuration, all LAN ports are in the same VLAN (vlan-trust) with full (unfiltered) Layer 2 connectivity for the shared IP subnet. Use the show vlans command to display all VLANs on the device.

The output shows there are two VLANs: the default VLAN, assigned VLAN ID 1, and the vlan-trust VLAN, assigned VLAN ID 3. In the factory-default configuration, no interfaces are associated with the default VLAN. All the LAN ports are associated with the vlan-trust VLAN. Again, all interfaces assigned to the same VLAN have full connectivity at Layer 2.

Verify MAC Address Learning

Issue the show ethernet-switching table command to verify MAC learning in the vlan-trust VLAN.

The output confirms the expected MAC address learning for our LAN clients in the vlan-trust VLAN.


In a VLAN, MAC address learning occurs anytime a device sends any type of traffic. The SRX learns based on the source MAC address. This learning builds the Ethernet switching table that is used to forward traffic, based on the destination MAC address. Broadcast, unknown unicast, and multicast (BUM) traffic is flooded to all ports in the VLAN. In our case, the use of DHCP to obtain an IP address is enough to trigger the MAC address learning shown.

Confirm LAN Connectivity in the Trust Zone

To confirm LAN connectivity in the trust zone, simply send a ping between LAN clients. Alternatively, you can send pings from the SRX to each LAN client. For verification, log in to an employee device attached to the SRX ge-0/0/2 interface, and test connectivity to both the IRB interface in the SRX, and to the LAN device attached to the SRX's ge-0/0/1 interface. Use the MAC and IP addresses shown in the preceding command output.

First, confirm the employee device interface parameters. Specifically, the MAC and IP addresses:

Next, test the expected LAN connectivity with a ping to the SRX's IRB interface and to the LAN device attached to the ge-0/0/1 interface. As shown above, the LAN device on ge-0/0/1 is assigned IP address

The pings are successful which verifies the expected connectivity for the trust VLAN ports. The added traceroute output confirms the shared IP subnet, and resulting direct connectivity, for the LAN stations. This connectivity will change when you later deploy multiple VLANs and IP subnets to secure local branch connectivity.

Verify LAN to WAN Connectivity with Source NAT

Send a ping to an Internet destination from a LAN client. If desired, you can source a ping from the SRX's IRB interface to exercise the same packet flow. The goal is to verify that traffic originating in the trust zone flows to the untrust zone with source NAT . This provides the LAN station with Internet connectivity.

Let's test Internet connectivity from the LAN client attached to the SRX ge-0/0/2 interface by sending a ping to the website.

The ping is successful which confirms LAN to WAN connectivity. The output of the show route command confirms that the LAN station sends the test traffic to the SRX as its default gateway.

It's important to note that sending a ping from a LAN station to an Internet destination involves packet flow from the trust zone to untrust zone. The SRX is a flow-based device. A security policy is needed to permit flows between zones. As we noted in Branch SRX Default Security Policies, the factory-default policies allow trust to untrust packet flows.

View the flow session table to confirm that there are active sessions between the LAN clients and the WAN.

The output shows that your test traffic successfully created a flow table entry. A second entry for the same flow confirms that the SRX performed source NAT on the traffic (using from its WAN interface), before sending the ping to the destination at ( This confirms that the traffic is permitted to flow from the trust zone to the untrust zone with source NAT. Your successful ping from a LAN station to confirms the expected factory-default LAN-WAN connectivity.

Next, we'll show you how to alter the default LAN connectivity to secure the local branch according to your requirements.