Routing Juniper SRX – Managing Two IP Ranges with One ISP Connection

juniperroutingsrx

We have a straight forward internet connection which has a small /29 IP range. The connection is Ethernet and our default gateway is the first IP in the /29 range.

Our ISP has just given us a secondary IP range, a /28. They have told us that we need to use the first IP of that range as our default gateway.

Now the device it's connected to is a Juniper SRX.

Initially I thought this wouldn't be an issue but it turns out it's more tricky than I thought.

  • I can't just use any of the new IP addresses on the existing untrust interface because traffic isn't routed back to the correct gateway.
  • I can use a virtual router as the networks both come in over the same Ethernet cable and are plugged into a single interface

I was thinking that maybe I need to use source or policy based routing.

Does anyone have any ideas? Should I go back to them and ask for them to just route the new /28 subnet to IP address of the SRX in the original /29? Is PBR/SBR the way to go?

The only thing I know about their config is that the device is a Cisco and has the following config snippet

interface FastEthernet1/0/2
description *** Link into customer LAN ***
no switchport
ip address 1.0.0.145 255.255.255.240 secondary
ip address 1.0.0.121 255.255.255.248

#ping 8.8.8.8 source 1.0.0.145

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 1.0.0.145 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/26 ms

Best Answer

As @stevieb said, a link subnet and two routes is the correct path, but few ISPs do that these days. (esp. in a co-lo, which is what this looks like)

As the gateway for both networks is the same interface on the same device, there should be no issue with sending traffic from either subnet to either gateway. I've had the exact same setup in many data centers, and it was never an issue. If they have something odd set up (ACLs, etc.), then VRF or PBR would be logical solutions. The SRX should have plenty of CPU to do either; personally, I'd do PBR as it's less headache.

Related Topic