Skip to content

Instantly share code, notes, and snippets.

@kz0
Forked from njh/juniper-srx.conf
Created August 3, 2020 13:21
Show Gist options
  • Save kz0/170a151a896fca027a55899bd9b41b40 to your computer and use it in GitHub Desktop.
Save kz0/170a151a896fca027a55899bd9b41b40 to your computer and use it in GitHub Desktop.
Juniper SRX configuration for DHCP client (WAN side) and DHCP Server (LAN side)
## Last commit: 2017-07-29 17:20:42 GMT by root
version 12.1X46-D66.1;
system {
host-name cable-router;
domain-name example.com;
time-zone Europe/London;
root-authentication {
encrypted-password "xxx";
}
name-server {
8.8.8.8;
8.8.4.4;
}
name-resolution {
no-resolve-on-input;
}
services {
ssh;
web-management {
http {
interface vlan.0;
}
session {
idle-timeout 60;
}
}
dhcp-local-server {
group dhcp-lan-group {
interface vlan.0;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
ntp {
server uk.ntp.pool.org;
}
}
interfaces {
fe-0/0/0 {
unit 0 {
description "Cable Modem";
family inet {
dhcp-client;
}
}
}
interface-range interfaces-trust {
member fe-0/0/1;
member fe-0/0/2;
member fe-0/0/3;
member fe-0/0/4;
member fe-0/0/5;
member fe-0/0/6;
member fe-0/0/7;
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
vlan {
unit 0 {
family inet {
address 192.168.0.1/24;
}
}
}
}
protocols {
stp;
}
access {
address-assignment {
pool dhcp-lan-pool {
family inet {
network 192.168.0.0/24;
range dhcp-lan-range {
low 192.168.0.50;
high 192.168.0.250;
}
dhcp-attributes {
name-server {
8.8.8.8;
8.8.4.4;
}
router {
192.168.0.1;
}
}
}
}
}
}
security {
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
zones {
security-zone trust {
interfaces {
vlan.0 {
host-inbound-traffic {
system-services {
ping;
dhcp;
http;
https;
ssh;
}
}
}
}
}
security-zone untrust {
interfaces {
fe-0/0/0.0 {
host-inbound-traffic {
system-services {
ping;
dhcp;
}
}
}
}
}
}
}
vlans {
vlan-trust {
vlan-id 3;
l3-interface vlan.0;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment