Part 1: Initial Configuration for Internet Connectivity

This configuration example shows how to deploy a small to mid-size branch office with an SRX Services gateway, EX Series switches, and Mist APs. The example uses two WAN links in Active/Active mode with an LTE backup link. In addition, the Juniper Mist Cloud is used to configure the EX switch and Mist AP as part of wired and wireless assurance, respectively.

The example also shows how to use performance monitoring and policy based routing to provide Application Quality of Experience (AppQoE). AppQoE intelligently prioritizes business critical traffic when one or more links fail.

You’ll need the following hardware and software to configure this example:

• One SRX300 Series device (SRX320, SRX340, SRX345, SRX380) or an SRX5000 Series device (SRX550M): Software version: Junos OS Version 19.4R1 or higher.

  • This example requires installation of an application identification license, and the download and install of the application identification package. See Licenses for SRX Series for more information. Use the show system license and the show services application-identification status commands.

    Note:

    Updates to the Junos OS application signature package is authorized by a separately licensed subscription service. You must install the application identification application signature update license key on your device to download and then install the signature database updates provided by Juniper Networks. When your license key expires, you can continue to use the locally stored application signature package contents but you cannot update the package.

• One EX Series Ethernet switch (EX2300, EX3400, or EX4300): Software version: Junos OS 19.4R1 or higher.

• One or more MIST access points (AP12, AP41, AP43, AP61, or AP32).

• One LTE Mini-PIM for the SRX Services Gateway.

• One SIM card with a subscription for data services.

• A Juniper Mist Cloud login. Create your account at: Juniper Mist Cloud .

In this example, we configure an SRX550 to provide DHCP and SNAT. The SRX provides secure outgoing Internet access for the EX switch, Mist AP, and the on site client devices. The primary link connects to a private WAN network (for example, a Virtual Private LAN Service (VPLS)), the secondary link uses broadband Internet over Ethernet access. The backup link uses an LTE cellular network.

The primary and secondary links operate in Active/Active mode. The LTE modem is not used unless both the primary and secondary links go down.

The EX4300-24P switch used in this example connects to the SRX device and provides the wired Layer 2 functionality (bridging) for the branch. A virtual chassis (VC) of multiple EX2300, EX3400, and EX4300 switches supports higher port density for larger branch locations. For wireless access, we connect a Juniper Mist AP61 access point to the EX switch.

The Juniper Mist Cloud quickly provisions the EX series switch and the Mist AP for the desired branch connectivity once the branch has the required Internet access.

Note:

A range of SRX Services Gateways are supported in this example. We begin with a modified factory default configuration for an SRX550. The factory default configuration can vary between SRX models. The reader must ensure that their SRX configuration matches the specifics of their topology.

The example has three main sections:

• First, you perform initial configuration on the SRX and EX. This configuration provides Internet access to the branch site (with S-NAT) for the EX, the Mist AP, and the branch office's VLANs.

• Next, you use the Juniper Mist Cloud to provision the EX switch and Mist AP to provision the wireless connectivity for branch office's VLANs.

• In the last part you configure the SRX Services gateway to provide Advanced Policy Based Routing (APBR) to support Application Quality of Experience (AppQoE). This configuration maps business traffic to the desired link and implements SLA probes to determine when traffic should fall over to a backup link. This policy also activates the LTE modem when both the primary and secondary links fail to meet the related SLAs.

Figure 1 shows the branch office topology.

Figure 2 shows the management network for the branch office example. In this example we rely on console access. The SRX and EX devices support an Ethernet based management network. The Mist AP can only be managed through the cloud.

Our topology has the following hardware layout on the SRX Series device:

• A minimal baseline configuration is loaded on the SRX. A later section provides the starting baseline.

• Slot 1 on the SRX Series device contains an LTE Mini-PIM.

• Slot 1 of the LTE Mini-PIM has a SIM card installed.

• The ge-0/0/3 interface connects to the primary WAN link.

• The ge-0/0/2 interface attaches to the broadband Internet link.

• The interface cl-1/0/0 identifies the slot for the modem Mini-PIM.

• The link over the cellular network terminates on interface dl0.0.

• The ge-0/0/2 interface receives its IP address, network mask, and default gateway via DHCP. You configure a static IP address and a default route on the Private WAN interface (ge-0/0/3) that is compatible with the WAN provider.

• The cellular service provider assigns the IP address, network mask, and default gateway to the LTE interface (cl-1/0/0).

On the EX switch, we have the following layout:

• A factory default configuration is loaded and modified with a root password to allow the default configuration to commit.

• Interface ge-0/0/1 on the EX switch connects to interface ge-0/0/4 of the SRX.

• The Mist access point ETH0 interface connects to ge-0/0/5 of the EX switch.

On the Mist AP, we have the following layout:

• The access point ETH0 interface connects to ge-0/0/5 of the EX switch.

Note:

You must configure and manage the Mist AP through the Juniper Mist Cloud. You configure the Mist AP using the Juniper Mist Cloud in the second part of this example.

We configure two security zones on the SRX device, a trusted security zone named trust and an untrusted security zone named untrust. By having interfaces in different security zones, we separate traffic and mitigate risks to the corporate intranet. Security zones are used to implement clear and simplified security policies. We host interfaces with access to the Internet in the untrust zone. The private WAN link and other internal interfaces on the corporate Intranet are in the trust zone. While five VLANs exist, only three can be routed out of the branch site. You also configure a restricted and default VLAN. The VLANs are as follows:

• VLAN 1 is the default VLAN on the SRX device. This setting matches the SRX to the factory default VLAN on the EX switch.

• The IoT devices use VLAN 20. IoT devices are commonly used for lighting and HVAC controllers.

• The surveillance cameras use VLAN 30.

• Wired corporate devices use VLAN 40.

• VLAN 99 functions as a restricted VLAN for all unused wired ports, and for ports that use dynamic profiling. The SRX device does not have this VLAN configured. The result is a non-routable VLAN with only site-local scope.

  Dynamic profiling is used in this example. Unconfigured ports start in VLAN 99. The switch port is reconfigured for the associated VLAN when the Juniper Mist Cloud recognizes the device.

See Figure 3 and Table 1 for information on the interfaces, security zones, and security policies that are configured on the SRX for this example.

Table 1 details the SRX security policy and the expected behavior for traffic flows between the trusted and untrusted zones.

Table 1: Security Policies for Zones

From Zone	To Zone	Security Policy Behavior to Allow Traffic
trust	trust	No
untrust	untrust	No
trust	untrust	Yes
untrust	trust	Trust-initiated only.

Table 2 lists the VLAN and the IP address information for the interfaces on the SRX.

Table 2: Interface VLANs and Their IP Addressing

Interface	VLAN ID	IP Address	Network Mask
cl-1/0/0	—	Assigned by service provider	—
ge-0/0/2	—	172.16.1.10 (DHCP)	255.255.255.0
ge-0/0/3	—	192.168.220.2	255.255.255.0
ge-0/0/4.0	1	192.168.1.1	255.255.255.0
ge-0/0/4.20	20	10.10.20.1	255.255.255.0
ge-0/0/4.30	30	10.10.30.1	255.255.255.0
ge-0/0/4.40	40	10.10.40.1	255.255.255.0

Table 3 lists the VLANs, usage, and port type used in this example. All other ports on the SRX Series device and EX switch are untagged VLAN ports.

Table 3: VLAN Usage

VLAN	VLAN ID	Name	SRX to EX Port Type	Usage
vlan1	1	Default	untagged/native	Used by the SRX device, the EX switch, and access points for management.
vlan20	20	IoT	tagged	Used by IoT devices.
vlan30	30	Security	tagged	Used by surveillance cameras.
vlan40	40	Corporate	tagged	Used by employees.
vlan99	99	Restricted	Tagged	Default for all other ports. Supports dynamic profiling to reassign recognized devices to a routable VLAN.

Ensure that your SRX Services Gateway has a functional baseline that is compatible with the example topology. The factory default settings may vary by SRX model. A number of SRX devices support this example. Given this variance, it is easier to document the solution by assuming the functional baseline shown below.

Follow these steps to load your SRX baseline configuration.

1. After saving your existing configuration, delete it to start fresh for this example:

2. Assign a strong root password. The one shown below is for documentation purposes only!

3. Copy and paste the below baseline configuration commands into a text editor and modify as needed to suit your environment. Load your edited commands into the CLI using the load set terminal configuration mode command.

4. Commit the baseline configuration:

Tip:

When making changes to system authentication or to management access, consider using commit confirmed. The configuration will automatically roll back restoring remote access your changes result in isolation from the device.

The starting baseline provides this functionality:

• A system hostname and root user authentication.

• We retain the factory default settings for the LTE Mini-PIM (cl-1/0/0) and the dl0.0 dialer interfaces.

• You configure a publicly accessible domain name and NTP server, along with the local time zone.

• You modify the default system logging stanza to include session related information. Details about blocked and accepted sessions are useful if you need to debug connectivity issues on an SRX Services Gateway.

• Basic security zone settings with definition of the trust and the untrust zones. We use source NAT as part of this example. The factory default NAT rule is left in the baseline to save some typing later.

1. Create the VLANs for the four types of branch office devices that connect to the corporate intranet. You also create an infrastructure VLAN that is used to support DHCP based address assignment to the EX switch and Mist AP. The ge-0/0/4 interface is assigned to the infrastructure VLAN. See Table 3.

2. Configure the ge-0/0/4 interface used to provide DHCP services to the EX switch and Mist AP. This configuration sets the interface as a trunk with flexible VLAN tagging to support a mix of untagged and tagged traffic. In this example VLAN 1 is used as a native VLAN that does not carry a VLAN tag.

3. Configure an IP subnet for each VLAN on the SRX trunk interface as per Table 2.

4. Configure a DHCP address pool used to assign IP addresses to the EX switch and Mist AP. Configure the interface ge-0/0/4.0 to be a DHCP Server

5. Create a DHCP server and an IP address pool for assigning to devices on vlan20. Configure the interface ge-0/0/4.20 to be a DHCP Server address

6. Create a DHCP server and an IP address pool for assigning to devices on vlan30. Configure the interface ge-0/0/4.30 to be a DHCP Server address

7. Create a DHCP server and an IP address pool for assigning to devices on vlan40. Configure the interface ge-0/0/4.40 to be a DHCP Server address

8. Place the ge-0/0/3 and the ge-0/0/4 interfaces in the trust zone. The ge-0/0/4 interface functions as a trunk. Be sure to include all of the configured logical units.

   Note:

   Recall in this example the baseline SRX configuration has a trust zone set to allow all host inbound protocols and services. If desired you could restrict the host inbound services to just DHCP and ICMP. This permits DHCP address assignment and subsequent ping testing between the EX switch and the SRX Services Gateway.

9. Place the ge-0/0/2 interface used to access the broadband Internet in the untrust zone.

10. Configure the ge-0/0/3 interface that connects to the private WAN provider. Include a description to indicate its role as the link to the private WAN used primarily for business critical traffic.

11. You configure a static default route for the private WAN link that points to the private WAN for non-local traffic. This route has a modified preference to ensure it is less preferred than the default route learned via DHCP on the broadband Internet link. The modified preference causes the SRX to route unclassified traffic over the broadband Internet link when its operational. If desired you could set a preference of 12 to make the two default routes equal costs and then load balance unclassified traffic.

12. Place the ge-0/0/2 interface into the untrust zone.

13. Configure the ge-0/0/2 interface that connects to the broadband Internet provider. Include a description to indicate its role as the broadband Internet link, and configure the interface to be a DHCP client. This interface receives both an IP address and a default route via the Internet provider’s DHCP server.

14. Configure the untrust zone to support DHCP and ping. DHCP based address assignment is used on the broadband Internet link.

    Note:

    The untrust interfaces receive a default route via DHCP or via the cellular service provider for the LTE link.

15. You configure a NAT policy for traffic flowing between interfaces in the trust zone. The policy supports VLAN traffic on the private WAN link. The SRX starting baseline includes a factory default NAT rule for traffic between the trust and the untrust zones. This default policy supports VLAN traffic sent to the broadband Internet or the LTE interfaces.

16. Create an address book and security policy to permit traffic between the trusted and untrusted zones. Be sure to include the network subnets for all four VLANs, and to include the supported applications in the policy. You permit all applications as long as the traffic originates from one of the VLANs at the branch site.

17. Configure the modem interface (LTE-MPIM) and activate the slot with the SIM card inserted.

    Note:

    The SRX baseline retained some of the modem interface settings from a factory default configuration.

18. Configure the dialer interface. Be sure to remove the factory default always-on dialer option from the configuration. We expect dial on demand activation of the LTE link only when both the private WAN and the broadband Internet links are down.

    Note:

    We retain some of the factory default dialer settings in the SRX starting baseline configuration. You make sure to remove the always-on dialer option from the starting baseline. It causes no harm to try to remove a configuration statement that does not exist. Explicitly deleting this option prevents unwanted activation of the LTE modem link. Activating the LTE modem often has a billing impact.

19. Commit the configuration on the SRX device.

20. Set the Access Point Name (APN) for the SIM in the modem (LTE-MPIM).

In this section you load and commit a factory default configuration on the EX switch. This configuration results in an IRB interface configured as a DHCP client with all switch ports belonging to the default VLAN (VLAN ID 1). With this configuration, both the EX switch and the Mist AP are able to obtain a DHCP assigned address from the SRX. The IP address comes from the 192.168.1.2-254/24 address pool.

Note:

If desired, you can zeroize the EX switch rather than load a factory default. A root password is not required when you zeroize the device. If you opt for the zeroize method you will see zero touch provisioning (ZTP) messages on the console. You might want to enter configuration mode and issue the delete chassis auto-image-upgrade followed by a commit to prevents these messages.

Regardless of method used, later when under control of the Juniper Mist Cloud a root password will be (re)configured.

1. Access the EX switch using the console and load the a factory default configuration.

2. Assign a strong root password. The one shown below is for documentation purposes only!

3. Commit the modified factory default configuration:

   Note:

   After loading a factory default the previously assigned hostname remains in effect until you reboot the EX switch.

At this point the SRX should have connectivity over both the private WAN and the broadband Internet providers. In addition, it should have assigned IP addresses to the EX switch and the Mist AP from the 192.168.1.0/24 address pool. The DCHP configuration provided to the EX and AP includes a domain name server and a default route.

You configure SNAT for traffic between the trust and the untrust zones, as well as for traffic between interfaces in the trust zone.

• Purpose
• Action
• Meaning

• Purpose
• Action
• Meaning

• Purpose
• Action
• Meaning