1

I really need some help trying to figure some "basic" routing. My brain is fried from being sick for a week and I'm not thinking clearly.

Picture below describes my "setup". I'm trying to accomplish routing a user from their workstation to the Juniper SSG520 and then "OUT" through the internet connection. I can't move the connection as it is physically located where the user's switch is.

Here's what I CAN do at this point:

  • I can ping from the Juniper SSG520 eth3/3 to 6x.xxx.253.116 from 6x.xxx.253.114
  • I can ping from the x450 in the top right to 6x.xxx.253.112 from 6x.xxx.253.116

What I CANNOT DO:

  • I cannot ping from the SSG520 eth3/3 to 6x.xxx.253.112 from 6x.xxx.253.114 (basically from the Juniper box to the gateway.

I've tried changing port 1 in the x450 VLAN 666 as tagged but when I do that then I can't even ping from the Juniper SSG520 eth3/3 to the VLAN on the x450 (6x.xxx.253.116).

I need to route traffic out the eth3/3 interface on the SSG520 THROUGH the 2 x450 Switches and out the internet connection. The caveat is that the 2 x450 switches are connected via fiber over distance and have tagged VLANs in them for the routing.

Thoughts?

http://img251.imageshack.us/img251/7752/drawing1.jpg

Jeff Atwood
  • 13,174
  • 20
  • 75
  • 93
TheCleaner
  • 32,822
  • 1
    This is not a routing problem - you're pinging between systems in the same broadcast domain.

    I don't see what could be the problem, but try looking at the traffic, see if the Juniper gets ARP responses from the gateway, and check if traffic on other VLANs can travel over the fiber trunk.

     – Max Alginin Oct 15 '09 at 20:43
  • Could you provide another diagram showing what you are trying to do with only IP information on it? (i.e. without the switches?) If I understand correctly, you want the user workstation to use the SSG as its default gateway (using private IP addressing?), and then for the SSG to forward traffic to your ISP using the public /29 they have provided? – Murali Suriar Oct 18 '09 at 12:43
  • Murali, yes that is exactly it. I can provide another diagram but think of it like this. My ONLY issue is that I want to extend an untrust port on the SSG to the ISP's biscuit jack (think long cable), but it HAS TO go through 2 switches to get there. – TheCleaner Oct 19 '09 at 13:10

3 Answers3

0

I think the issue is that you have disabled IPForwarding for VLAN 666 on 253.116, so the packets coming back from 253.112 do not get forwarded to 253.114 via port 1 on 253.116

Scott Lundberg
  • 2,384
  • I've tried enabling IPForwarding and it didn't change anything. I'm not trying to route between VLANs so I think that is why it didn't matter. – TheCleaner Oct 15 '09 at 19:53
  • Is the Juniper box VLAN aware? If so, it will not read packets coming into it on VLAN 666 since that port is untagged on the juniper side... – Scott Lundberg Oct 15 '09 at 20:58
0

You could also consider upgrading from ScreenOS to JunOS if you don't need any of the legacy ScreenOS bits.

Also remember you may need to enable ICMP to the device itself.

LapTop006
  • 6,506
0

I ended up resolving this. The issue was in the tagging. I had tagged the end ports on each side which wasn't required.

TheCleaner
  • 32,822