Proxy arp

Hi all,

Proxy arp is something that not all people understand well. Some devices are able to do it, other not, and other do it automatic (sometimes), etc....

Here i will give a brief overview of how juniper firewalls handle proxy arp:

As most of you know there are 5 solutions to do NATTING in juniper firewalls:

MIP: one to one (bi-directional)
DIP: many to one (uni-directional)
VIP: one to many (uni-directional)
Destination NAT (policy): one to one, one to many (uni-directional)
Source NAT (policy): many to one, one to one (uni-directional)

So this is a overview of the natting, know when will the firewall to proxy arp for these NAT addresses?

Yes:

-MIP
-VIP

No:

-Dest nat

So you see that when using Destination nat you will have problem. Solution to solve this problem, ... place a static arp entry on higher level router, or when not in same network has the interface ... place a route to cluster ip of the juniper firewall.

Sometimes this isn't a solution, because the upstream router isn't managed by yourself. This means you need to be able to do proxy arp on firewall for these NAT addresses.

Well there is a hidden command "set arp nat-dst", which will do proxy arp for NAT addresses in a certain situation!!

When will he do it or not:

• The Destination NAT policy must be configured using the same source and
destination Layer 3 security zone. However, traffic that matches the policy
can then be sent to any Layer 3 security zone.

• The device does not respond to an ARP request if the Destination NAT IP is
in the same incoming subnet as a secondary IP address.
• In an HA environment, the device only supports the Destination NAT ARP
capability if using NSRP Active/Passive on interfaces that reside in VSD ID
0.
• In ScreenOS 5.0r7 and below, the device does not respond to an ARP request
for a Destination NAT IP that is in the same subnet as the incoming
interface for a Destination NAT policy.

Hope this helps you all.

NSM Error ( Failed during updating License info)

Hi,

While playing a bit with NSM (Netscreen Security Manager), i found a nice bug!

you can't use some chars in the name of the firewall members:

for example: _ and [ or ], possible there are more!

the error you will see when trying to do a update is:

Error Code:

Error Text:
Exception caught during Update Device:

Failed during updating License info

Error Details:
Failed to process the database query. No record matched the query and nothing has been done.

Hope this help some of you!

Comparing WAN Accelleration Products (Juniper WXC vs Riverbed vs Bluecoat)

Hey All,

For some weeks now i am busy with a project that includes Juniper Firewalls (with VPN's), Bluecoat (WAN ACC), Juniper WXC (WAN ACC), Juniper NSM (Management station), Juniper CMS (WAN Management station).

The Firewall/VPN part was difficult, because at HQ they had 2 ISP, but also at the remote side they had 2 ISP. The customer asked full redundancy (so we needed to create 4 VPN tunnel from remote to HQ). This i did before so wasn't to hard! (just play around with Vrouters and everything is up and running).

The real hard part was which WAN Accellerator will they take! So the customer start testing together with me.

Products we tested:

Bluecoat
Juniper WXC
Riverbed

We provider the tests for Bluecoat and Juniper, After these test we saw that on a satelite link bluecoat wasn't doing well (especially when using http!)

Personal i had the feeling that bluecoats proxy kicked in here and didn't do alot of WAN Accell. We also called bluecoat and they came over to do some tweaking, and saw that the customer his webpages wheren't cacheable (and this is the reason it didn't work that well)

After the bluecoat test, they tested Riverbed (which wasn't that bad, and better then Bluecoat).
The last test we came again with Juniper WXC and it seems that this was the fastes solution.

So because of the outstanding Juniper FW/VPN concept (vrouter and routing based vpn's) and the good performance of Juniper WXC, the customer choosed us to build there international Network.

JNCIS-FWV (Juniper Firewall/VPN products and ScreenOS software)

Hi All,

I did my JNCIS-FWV exam today (this shouldn't be to hard, because i work for more then 8 years with these Firewall.)

Passed the exame with 92%.

We needed this exam for the Partner level again. Hope i can get some time now to prepare for the JNCIE-ER (and maybe will do some other exams in between (what do you think about the M/T track :))

Juniper Partner Level Exams

hey all,

So it has been a long time you heared from me... Been busy with some big projects. I also needed to do all those partner exams again for our Partner Level.

Here the list of exams i did: (there pretty easy if you have worked with those products)

JNSS (Pre-Sales) and JNSA (Sales)

Juniper Networks Enterprise Routing Sales Associate – JNSA-R
Juniper Networks Enterprise Routing Sales Specialist – JNSS-R
Juniper Networks Advanced Security Sales Associate 2007 - JNSA-S
Juniper Networks Advanced Security Sales Specialist 2007 - JNSS-S
Juniper Networks Data Center Acceleration Sales Specialist – JNSS-DX
Juniper Networks Access Control Sales Specialist 2007 - JNSS-AC
Juniper Networks Access Control Sales Associate 2007 - JNSA-AC

JNCIS-ER (Juniper Networks Certified Internet Specialist)

Hi All,

So we did the JNCIS-ER exams today, and ...... YES we passed again.

This was the first exam I was afraid of, all this because I didn't have real life practical experience. (only in a lab).

But the score was fantastic (96%)

Now i will prepare myself for the JNCIE-ER exam (this will take some time, because i need to do some other exams also (To keep the company there Partner level: JNCIS-FWV, all the Sales and Presales exams (JNSS/JNSA for all products).

Will keep you all up to date!

Preparing for JNCIS-ER

Hi All,

So i passed the first Certification for the Enterprise Routing Track of juniper. The next step is to get the JNCIS-ER certification so i can do the JNCIE-ER Lab exams.

Because i passed the JNCIA-ER, i got a extra Free Voucher. For this exam i will study the Advanced Juniper Networks Routing in the Enterprise student courseware and lab guides.

Today i booked the exam (will be 28/09/07 at 11:00 AM)