Are 2 juniper SRX 550 Firewalls a good solution for a small company ( 40 ppl ) with AWS uplink

Hi,

I am fairly new to the Juniper scene and I would like to get a second/third opinion on the matter. I've been tasked with choosing the right equipment for the following scenario :

We need two routers/firewalls to do :

- vlan routing ( we are not going to make the switches do the routing, tho they are Cisco 3560E and 3750E swtiches that are quite capable of handling the task ), there are 8 vlans in total, 4 of which are actually routable.

- Statefull firewall . I am coming from Cisco and I have a bone to pick with the way the ACLs are stated, also a lot of the coders that are in the company will have access to the firewall, so they could run their own services and so on. I need a solution with clean and structured ACLs, the guys are familiar with iptables and from what I've seen the Junos way of ACLs looks a bit like iptables.

- AWS Ipsec Tunnel. We have a 200Mbit uplink and the majority of it will be dedicated to AWS traffic. This means that the devices should be capable of handling the encrypted traffic. I've read that the SRX 550s can handle up to 1Gbit but in real world i trickles down to ~200Mbits, which is perfect for us. Also the SRX series from Juniper are one of the suggested AWS solution in the Amazon tuts.

- The devices should support some kind of high-availability solution. We would buy a pair for redundancy.

We have a mostly Cisco oriented network as far as devices go. But we would like to change it up a bit. So that's why ASAs are not an option, or Meraki. Right now the role of the hardware devices I would like to buy is "played" by a virtual router and it gets the job done. I would prefer it tho to have a hardware solution with HA and easier management and I would love not to worry about a VM going down and all my vlan routing and AWS uplink going down with it.

Reasons I've selected the Juniper SRX550s :

- they are cheap ( we are going to use 2nd hand equipment )

- they come with 4gb of ram ( I would have to deal with bgp, as far as AWS goes, but not an entire table, but more ram is always good to have )

- 2 PSUs and HA options

- Bandwidth and performance seems to suffice what we need at the moment ( If it can handle 200Mbit Ipsec that's more than enough )

- Modularity - I can later add some more interfaces if need be ( tho I don't see that happening, if there is an upgrade it would be 10g and that wont cut it, but it's not happening any time soon )

- At first glance the way it handles ACLs seems better than Cisco's ACLs . As far as GUIs go I have no idea ...

​

Any input or even suggestions for other devices are welcomed.

Thank you in advance.

Looking for firmware Huawei NE20E-S4

Hi,

Who has the latest firmware for Huawei NE20E-S4 for me?

NE20E-S V800R010C10SPC500 and/or the newest patch NE20E-S V800R010SPH052

Free network simulator with changeable TCP

I am wondering if there is any free network simulation software that has the option of changing TCP type from TCP Renoe, to Tahoe, Illinois, etc...I am aware of the existence of free network simulators such as Imunes, ns3, and others, but I can't figure out if they have what I need.

This is needed for a project we are doing in one of our classes, and I'd like to do some extra work, and show how each algorithm influences the behaviour of the network, instead of just writing what I've found in books and online.

Thanks for your help in advance.

How far away is your main comms/server room?

We put together an emergency IT bag recently, and it's already come in very handy day-to-day, because our comms/server room is a decent walk away from the IT office. A few floors across and up 5 stories. Takes 5-10 minutes to get there, depending if you get stopped on the way! Nothing more frustrating than arriving at the comms room only to realise you need the labeller in your desk drawer! Everything is in the bag now, so it's a great time saver.

Got me thinking though; how far away is your comms room? And at what stage does it become a hindrance and potentially dangerous to not be close to it?

Granted, a lot of our stuff is remote, and I know somebody is going to respond with "2000KM"! But in a previous job the comms room was literally next door, and on more than one occasion we were able to react quickly to an issue due to an audible sound from the comms room. Again, I accept proper monitoring would have negated this, but it just feels "safer" being able to quickly enter the comms room. Any thoughts?

Disaster Recovery Suggestions

We have total 4 sites geographically located i.e 1 HQ and 3 Remote Branches. Each site have 400-500 endpoints and hosting apps & db servers & internet services locally.My objective is to build a centralised DR site to serve as offsite backup and being able to failover to the secondary site in disaster recovery situation minimising the impact to our computing services in the event we lose datacenter.

I would like to have some suggestions on what solutions, infrastructure, WAN link I could possibly use and how I would proceed.

What would you do with 4x 10g switches

I decommisioned and managed to get two Arista and two cisco L3 1/10g capable 48 ports, cisco nexus 5596up and cisco4900M L3 swiches for free. I was wondering what could you do with them. I was thinking to start a community driven non profit IXP, donate to local freenet ISP or use them for community lab.

Any other ideas where it can be used for community work for benefit of normal people like giving internet access or help in research without bearing more cost to myself.

How to check the module of an interface in nexus 7000?

Hi, I'm currently preparing for a Nexus I/O module replacement and I just want to know which module is being used of a specific interface?

​

1. From Show vdc member - We can based on the interface naming convention right? In where, in Ethernet X/Y the X the module?
2. Show inventory - I think we can also use this to locate the module of an interface.

​

But do we have a detailed show command on interface level or module level. Though I'm still searching the correct command on Cisco docs. Thanks

ISP router security and IPv6/ICMP

We're finally getting around to polishing up the IPv6 side of the network. We have been running dual-stack for the past four years. IPv6 felt like more of a lab experiment than a production ready network. That is all changing. We've been adding lots of IPv6 peers, new IPv6 DHCP servers (PD), new IPv6 DNS recursors, pdns LUA scripted PTR and AAAA for our /36, and lots of FTTP access and residential gateway testing on IPv6 underway.

Now here's my question(s), what should be happening at the ISP router security level? We currently have ACLs that basically only permit BGP and ICMP echo (with CPP). These were basically a copy paste of the IPv4 rules. With IPv6's heavy reliance on ICMP, should the ICMP rules be opened up a bit for the router too? Or is this basically a host issue only? To be clear, the ACLs I am referring to are only for traffic with a destination address of the router. Otherwise all traffic is passing straight through on the data plane.

Any other special IPv6 router security considerations outside of ICMP?

We're in a Cisco environment, but I think these questions are general and apply to everyone no matter the vendor.

Issue with CISCO SB RV340 Failover to 4G LTE with a Verizon/Novatel USB730L

( Background, CCNA, trained on CCNP but didn't take exam. I come from enterprise networking working on 2960X's, 4500X's, integrated service routers, etc and these small business appliances I never seem to have luck with, and I hate GUI's because I can't view the config as easily. I've had a Cisco 4507R+E I decommissioned with an uptime over 900 days. Is there some major disconnect between Cisco Ent and Cisco SB? )

​

I currently have an RV340 at this site, has done us okay so far until now besides the inter-vlan routing glitch with the latest firmware. The RV325 just seemed much more reliable but is limited on features.

​

We have an extremely unreliable cable provider at this site that often goes down for several hours during the weekend or after 5PM, one of those rural cable companies. (They just now rolled out DOCSIS 3.0 and bumped customers from 8/1.5 to 35/5 megabit, while some customers are still only offered 1.5/0.1 megabit "Lite" internet)

​

I have purchased and added a Novatel/Verizon USB730L Global 4G LTE Modem with Unlimited Data, 4G speeds up to 15GB, not bad for a fail-over.

​

The RV340 sees the modem on USB2, connects to the LTE network, and even pulls a public IP address. By default the modem required SIM PIN (1111) and was performing NAT, but I disabled that. The modem works 100% fine on my laptop.

​

Sometimes the routing table shows the USB2 sometimes it does not but it is always metric 4 along with the WAN1 entry and the WAN1 subnet entry. All VLAN metrics are 0.

​

Everything looks fine, the USB2 light is green, then I unplug WAN1 to test. USB2 blinks green a few times, then goes out, then comes back amber. I check the RV340 and it no longer is connected to the modem. I plug WAN1 back in and it comes back, and USB2 light eventually goes back to green.

​

Can anyone provide guidance if I am doing something wrong? I have tried enabling "Network Service Detection" on both, and then just the WAN, and then just the USB2, no dice.

​

Even if I configure the opposite with USB2 as priority 1 on Multi-WAN, it gets skipped as it disconnects and fails over to WAN1.

​

If this is an issue with the RV340 I'm going to be livid, the modem is listed on the compatibility matrix?

​

It works fine on my laptop if I plug the USB directly in.

​

Last resort I'm going to try and get it working as the primary WAN on an RV325 then run double NAT and plug it into WAN2 on the RV340, I would be really disappointed in this RV340 if I had to do this but a colleague said that he's had to do it on every RV340/USB fail-over he's set up.

​

Let me know if you guys need screenshots, but I've followed just about every other setup I can find online down to a "T" and it has made no progress.

​

Any help would be so much appreciated at this point as we have signed a 2-year contract for this 4G stick and currently it is useless, and this is the cable companies most unreliable time of the year they claim due to "temperature changes throwing off our routing"... what.....

​

I attached screenshots on my CISCO post here: https://community.cisco.com/t5/small-business-routers/issue-with-rv340-failover-to-4g-lte-with-a-verizon-novatel/td-p/3938109

Packet Tracer - error trying to HSRP

Getting invalid input detected when I try to declare the standby version when trying to configure the HSRP for my uni assignment. Never used packet tracer before so I've probs missed something obvious, anyone know why it's invalid input. Version 7.2.1 Imgur pic