Junos Security

12.a

Lab Diagrams

Worldwide Education Services

1194 North Mathilda Avenue

Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net

Course Number: EDU-JUN-JSEC

This document is produced by Juniper Networks, Inc.
This document or any part thereof may not be reproduced or transmitted in any form under penalty of law, without the prior written permission of Juniper Networks
Education Services.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other
countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered
trademarks, or registered service marks are the property of their respective owners.
Junos Security Lab Diagrams, Revision 12.a
Copyright 2012, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History:
Revision 9.aJuly 2009
Revision 10.aMay 2010
Revision 10.b--December 2010
Revision 12.aJune 2012
The information in this document is current as of the date listed above.
The information in this document has been carefully verified and is believed to be accurate for software Release 12.1R1.9. Juniper Networks assumes no
responsibilities for any inaccuracies that may appear in this document. In no event will Juniper Networks be liable for direct, indirect, special, exemplary, incidental
or consequential damages resulting from any defect or omission in this document, even if advised of the possibility of such damages.

Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.
YEAR 2000 NOTICE
Juniper Networks hardware and software products do not suffer from Year 2000 problems and hence are Year 2000 compliant. The Junos operating system has
no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.
SOFTWARE LICENSE
The terms and conditions for using Juniper Networks software are described in the software license provided with the software, or to the extent applicable, in an
agreement executed between you and Juniper Networks, or Juniper Networks agent. By using Juniper Networks software, you indicate that you understand and
agree to be bound by its license terms and conditions. Generally speaking, the software license restricts the manner in which you are permitted to use the Juniper
Networks software, may contain prohibitions against certain uses, and may state conditions under which the license is automatically terminated. You should
consult the software license for further details.
 Management Network Diagram
ge-0/0/0 (on all student devices)

srxA-1 Management
Network
Serial Console
Terminal Connections srxA-2 Student
Server __.__.__.__/__
/ Workstations
.
.

Management Addressing
srxD-2
srxA-1 ____________/___ srxD-1 ___________/___
srxA-2 ____________/___ srxD-2 ___________/___
srxB-1
srxB 1 ____________/___
/ vr-device
vr device ___________/___
/
vr-device srxB-2 ____________/___ Server _______________
srxC-1 ____________/___ Gateway _______________
srxC-2 ____________/___ Term Server _______________

Server Note: Your instructor will provide address and access information.

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Pod A Lab Diagrams

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Labs 17
VLAN Assignments
Hostname VLAN-ID
srxA-1
srxA 1 101 201
101, Internet

srxA-2 102, 202

Host 172.31.15.1

Untrust Zone Untrust Zone

srxA-1 srxA-2
lo0: 192.168.1.1 lo0: 192.168.2.1

ge-0/0/4.101
0/0/4 101 0/0/4 201
(.1) ge-0/0/4.201 ge 0/0/4 102
ge-0/0/4.102 0/0/4 202
(.1) ge-0/0/4.202
Tagged Interface
172.20.101.0/24 172.20.201.0/24 172.20.102.0/24 172.20.202.0/24
(.10) (.10) (.10) (.10)

vr101
101 vr201
201 vr102
102 vr202
202

Juniper-SV ACME-SV Virtual Routers Juniper-WF ACME-WF

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Lab 8

Internet Host 172.31.15.1

Untrust Zone

Cluster-ID 1
ge-0/0/1 fxp1 gge-5/0/1
srxA-1 srxA-2
ge-0/0/2 fab0 fab1 ge-5/0/2
node0 node1

(.1) (.1)
reth0 reth1
reth0 Network reth1 Network
172.20.10.0/24 Trust Zone 172.30.10.0/24
VLAN 221 ( 2)
(.2) ( 2)
(.2) VLAN 231

vr221
vr22v vr231

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Pod B Lab Diagrams

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Labs 17
VLAN Assignments
Hostname VLAN-ID
srxB-1
srxB 1 103 203
103, Internet

srxB-2 104, 204

Host 172.31.15.1

Untrust Zone Untrust Zone

srxB-1 srxB-2
lo0: 192.168.1.1 lo0: 192.168.2.1

ge-0/0/4.103 0/0/4 203

0/0/4 103 (.1) ge-0/0/4.203 g 0/0/4 104
ge-0/0/4.104 0/0/4 204
(.1) ge-0/0/4.204
Tagged Interface
172.20.103.0/24 172.20.203.0/24 (see VLAN Assignments table) 172.20.104.0/24 172.20.204.0/24
(.10) (.10) (.10) (.10)

vr103
103 vr203
203 vr104
104 vr204
204

Juniper-SV ACME-SV Virtual Routers Juniper-WF ACME-WF

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Lab 8

Internet Host 172.31.15.1

Untrust Zone

Cluster-ID 1
ge-0/0/1 fxp1 gge-5/0/1
srxB-1 srxB-2
ge-0/0/2 fab0 fab1 ge-5/0/2
node0 node1

(.1) (.1)
reth0 reth1
reth0 Network reth1 Network
172.20.20.0/24 Trust Zone 172.30.20.0/24
VLAN 222 ( 2)
(.2) ( 2)
(.2) VLAN 232

vr222
vr22v vr232

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Pod C Lab Diagrams

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Labs 17
VLAN Assignments
Hostname VLAN-ID
srxC-1
srxC 1 105 205
105, Internet

srxC-2 106, 206

Host 172.31.15.1

Untrust Zone Untrust Zone

srxC-1 srxC-2
lo0: 192.168.1.1 lo0: 192.168.2.1

ge-0/0/4.105 0/0/4 205

0/0/4 105 (.1) ge-0/0/4.205 ge 0/0/4 106
ge-0/0/4.106 0/0/4 206
(.1) ge-0/0/4.206
Tagged Interface
172.20.105.0/24 172.20.205.0/24 (see VLAN Assignments table) 172.20.106.0/24 172.20.206.0/24
(.10) (.10) (.10) (.10)

vr105
105 vr205
205 vr106
106 vr206
206

Juniper-SV ACME-SV Virtual Routers Juniper-WF ACME-WF

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Lab 8

Internet Host 172.31.15.1

Untrust Zone

Cluster-ID 1
ge-0/0/1 fxp1 gge-5/0/1
srxC-1 srxC-2
ge-0/0/2 fab0 fab1 ge-5/0/2
node0 node1

(.1) (.1)
reth0 reth1
reth0 Network reth1 Network
172.20.30.0/24 Trust Zone 172.30.30.0/24
VLAN 223 ( 2)
(.2) ( 2)
(.2) VLAN 233

vr223
vr22v vr233

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Pod D Lab Diagrams

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Labs 17
VLAN Assignments
Hostname VLAN-ID
srxD-1
srxD 1 107 207
107, Internet

srxD-2 108, 208

Host 172.31.15.1

Untrust Zone Untrust Zone

srxD-1 srxD-2
lo0: 192.168.1.1 lo0: 192.168.2.1

ge-0/0/4.107
0/0/4 107 0/0/4 207
(.1) ge-0/0/4.207 g 0/0/4 108
ge-0/0/4.108 0/0/4 208
(.1) ge-0/0/4.208
Tagged Interface
172.20.107.0/24 172.20.207.0/24 (see VLAN Assignments table) 172.20.108.0/24 172.20.208.0/24
(.10) (.10) (.10) (.10)

vr107
107 vr207
207 vr108
108 vr208
208

Juniper-SV ACME-SV Virtual Routers Juniper-WF ACME-WF

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net
 Network Diagram: Lab 8

Internet Host 172.31.15.1

Untrust Zone

Cluster-ID 1
ge-0/0/1 fxp1 gge-5/0/1
srxD-1 srxD-2
ge-0/0/2 fab0 fab1 ge-5/0/2
node0 node1

(.1) (.1)
reth0 reth1
reth0 Network reth1 Network
172.20.40.0/24 Trust Zone 172.30.40.0/24
VLAN 224 ( 2)
(.2) ( 2)
(.2) VLAN 234

vr224
vr22v vr234

2012 Juniper Networks, Inc. All rights reserved. Worldwide Education Services www.juniper.net