Post on 07-Jun-2022
A�dvanced Junos Security
1.2.b
Worldwide Education Services
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Course Number: EDU-JUN-AJSEC
Lab Diagrams
This document is produced by Juniper Networks, Inc.
This document or any part thereof may not be reproduced or transmitted in any form under penalty of raw, without the prior written permission of Juniper Networks Education Services.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Ju nos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Advanced Junos Security Lab Diagrams, Revision 12.b
Copyright© 2013 Juniper Networks, Inc. All rights reserved.
Printed in USA.
Revision History:
Revision 10.a--March 2011
Revision 12.a-June 2012
Revision 12.b-June 2013
The information in this document is current as of the date listed above.
The information in this document has been carefully verified and is believed to be accurate for software Release 12.1X44-D10.4. Juniper Networks assumes no responsibilities for any inaccuracies that may appear in this document. In no event will Juniper Networks be liable for direct, indirect. special, exemplary, incidental, or consequential damages resulting from any defect or omission in this document. even if advised of the possibility of such damages.
Juniper Networks reserves the right to change, modify, transfer. or otherwise revise this publication without notice.
YEAR 2000 NOTICE
Juniper Networks hardware and software products do not suffer from Year 2000 problems and hence are Year 2000 compliant. The Junos operating syster, has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.
SOFTWARE LICENSE
The terms and conditions for using Juniper Networks software are described in the software license provided with the software, or to the extent applicable, in an agreement executed between you and Juniper Networks, or Juniper Networks agent. By using Juniper Networks software, you indicate that you understand and agree to be bound by its license terms and conditions. Generally speaking, the software license restricts the manner in which you are permitted to use the Juniper Networks software, may contain prohibitions against certain uses, and may state conditions under which the license is automatically terminated. You should consult the software license for further details.
Ma
na
ge
me
nt
Ne
two
rk D
iag
ram
ge
-0/0
/0
(o
n a
ll s
tud
en
t d
evi
ces)
Stu
den
t W
ork
sta
tio
ns
Ma
na
ge
me
nt
Ad
dre
ssin
g
srxA
-1
srxD
-1
--
srxA
-2
srxD
-2
--
srxB
-1
_
vr-d
evi
ce
-
srxB
-2
Serv
er
-
srxC
-1
_
Ga
tew
ay
srxC
-2
_
Term
Serv
er
Serv
er
Note
: Yo
ur
instr
ucto
r w
ill p
rovi
de
ad
dre
ss a
nd
acc
ess
info
rma
tio
n.
Po
d A
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ap
pS
ec
ure
La
b
ge-0
/0
/8
17
2.1
6.1
.1/2
4
ge-0
/0
/9
17
2.1
6.1
0.1
/2
4
srxA
-K
Trus
t Zon
e
VM S
erve
r 17
2.1
6.1
0.1
00
I D
Untru
st Z
one
K=
po
d
....
-(1
or2
)
VM C
lient
17
2.1
6.1
.10
0
-=
---
: VM
Ser
ver's
Dut
ies
I
FTP
Serv
er
Web
Ser
ver
Po
d A
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
La
ye
r 2
Se
cu
rity
La
b
I�
Host
172
.31.
1 5.1
<;::,\o\}
Untru
st Z
one
�
__
_
xA,._ i
_ ___,
/(.1
) vla
n.24
1 17
2.20
.241
.0/2
4sr
-
loO: 1
92.1
68.1
.1 (
. 50)
ge-0
/0/2
17
2.20
.242
.0/2
4vla
n .24
1 7
( 1)
�
.
e, ov
�
172.
20.2
41.0
/24
<1
(.10 )
-1,>� ",(
& -�· q...
,sio
(.'<J
ge-0
/0/1
(.50
)
.§>'e 'O
:;.---q...
l.Y 17
2.20
.242
.0/2
4(.1
0 )
---
-----
=-
' Ju
nipe
r-SV
Virtu
al R
oute
rs
�uni
per-W
F
Po
d A
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Jun
os V
irtu
al
Ro
uti
ng
La
b
172.
20.1
01.0
/24
(.10 )
Juni
per-S
V
x--
[il
Host
172
.31.
15.1
-<>� "-<
<9 · �o
:Y'
, j b
(.�
'-..s>"e9
, Un
trust
Zon
e ,
(2,-0
::Y'a
srxA
-1
(.1) g
e-0/
0/1
172.
19.1
.0/3
0 ge
- 0/0
/1 (
.2)
srxA
-2
(.�lan
.201
......,
-
Inte
rface
ge-
0/0/
4 -
172.
20.2
01.0
/24
(.10 ) AC
ME -
S V
.....___ V
irtua
l Rou
ter s
-+
172.
20.1
02.0
/24
172.
20.2
02.0
/24
(10)
(.10)
'
Juni
per-W
FAC
ME-
WF
Po
d A
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 1
-3
)
vlan .
101 /
172.
20.1
01.0
/24
(.10 )
Jun
ipe
r-S
Y
srxA
-1
10.0
.1.0
/24
! �-
�,
-<.>� '-<
c9 ·� · q_..
\Yo
Host
172
.31.
15.1
r.-2,;
<S'°<9 , o
rg_..
a
srxA
-2
-in
terfa
ce g
e-0/
0/4
-_,..
v la
n .10
2 A
1 )'\.
v lan.
2 02
/
"
\ lr '>
n1
I ---
R
ters
I ·· ....
" ·---
Virt
ua
l o
u
172.
20.1
02.0
/24
(.10 )
Jun
ipe
r-W
F
172.
20.2
02.0
/24
(.10 )
�
AC
ME
-WF
Po
d A
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 4
-5
)
srxA
-1
(.10)
Juni
per-S
V
o\'':Jo
,.., \.<oru
ntru
st Z
one
:'\ v
· \.
(.1)
ge-0
/0/2
10
.0.1
.0/2
4
vlan.
201
ACM
E-SV
1Pv6
Su
bn
et
Ad
de
d
-<'.>< ·.z
e Un
trust
Zon
e �"2 g,..
-5>o
g_e-0
/0/2
(.1
29)
srxA
-2
(.1
\ ,r
,
vla
n.20
2
172.
20.2
02.0
/24
(.10)
Juni
per-W
F AC
ME-
WF
Po
d A
Ne
two
rk D
iag
ram
: H
ub
-an
d-S
po
ke
IPs
ec
VP
Ns
La
b
..
�
,.,.
�
,_..,,
,..___
A-1
Spo
ke Ho
sts
Spok
e 1
192.
171.
10.3
Spok
e 2
192.
171.
10.4
Spok
e 3
192.
171.
10.5
Spok
e 2 A
-1
stO:
10.
10.1
0.4/
24
loO: 1
92.1
68.1
0.4
Spok
e 3 A
-1
Spok
e 1A
-1
stO:
10.
10.1
0.3/
24
loO:
192
.168
.10.
3
stO:
10.
10.1
0.5/
24 I
I
loO: 1
92.1
68.1
0.5
Non
Juno
s /
De
vice
srxA
-1
stO:
10.
10.1
0.1/
24
I loO
: 192
.168
.10.
1 K_
1 )
(. 10)
1 .
. .. ·�
I-
Lo
ca
1-v
t<
172.
20.1
00.0
/24 _
__
_
--
·
...
.
·--
A-2
Spo
ke Ho
sts;
Spok
e 1A
-2
stO:
10.
10.1
0.6/
24
loO:
192
.168
.10.
6 Sp
oke
1 19
2.17
1.10
.6
Spok
e2
192.
171.
10.7
Spok
e3
192.
171.
10.8
Spok
e 2 A
-2
stO:
10.
10.1
0.7 /
24
loO: 1
92.1
68.1
0. 7
Spok
e3 A
-2
li ls
tO: 1
0.10
.10.
8/24
loO
: 192
.168
.10.
8
"N
onJu
nos
Devic
e
srxA
-2
stO:
10.
10.1
0.2/
24
I, _
__ , .
..... l
(. iO )
Ull
loO: 1
92.1
68.1
0.2
I
I LU
t;cH
- vn
fi.
72.2
0.20
0.0/
24
Po
d A
Ne
two
rk D
iag
ram
: C
on
fig
uri
ng
Gro
up
VP
Ns
La
b L
ab
srxA
-1
Key S
erve
r lo
O: 1
92.1
68.1
1.3
I
loO:
192
.168
.11.
1
172
.20.
101.
0/2
4
(.10
)
Juni
per-S
V
.,..
-In
terfa
ce ge
-0/0
/4 -
172
.20.
201
.0/2
4
(.10 )
ACM
E-S V
..___
Vi rt
u al R
oute
rs -
,,,.
srxA
-2
loO:
192
.168
.11.
2
172
.20.
102
.0/2
4 17
2.2
0.2
02.0
/24
(.10 )
(.1
0)'
Jun i
per-W
F AC
ME-
WF
Po
d A
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ad
va
nc
ed
IP
se
c V
PN
So
luti
on
s L
ab
rl��
;I-V
�R1
Loca
l-VR
(.10)
\
J;,< · ·
::Z eI (.1
0)
�<
172.
20.1
00.0
/24
0
0 �
I'
�
172.
20.1
00.0
/24
Untru
st Zo
ne �
.
�
srxA
-1
Acqu
ired
Zone
st
O: 1
0.10
.10.
1/24
(.1
) GRE
: 11.
11.1
1.1/
30
SriV"\
--
stO:
10_
10_1
0_2 1
24 V
Acqu
ired
Zone
GRE:
11.
11.1
1.2/
3or(
.1)
loO:
192
.168
.1.1
loO
: 192
.168
.2.1
vla
n.10
1 7T
I)\:
vlan.
201
._
_ _
. _
·-.•
/
,
-mt
erra
ce g
e-u/
U/4
_vla
n.10
2 7
T.Ii\:vla
n.20
2 /
"
172.
20.1
01.0
/24
172.
20.2
01.0
/24
172.
20.1
02.0
/24
(.10)
(.10 �
L
(.10)
....-
--
-.
I"
'"
n1
I I
vr1 O
?
I
Juni
per-S
V I
.. -,,
� I ..___
.
--+ I
··---
I Vi
rtual
Rou
ters
-Ju
nipe
r-WF
172.
20.2
02.0
/24
(.10)
'
ACM
E-W
F
Po
d A
Ne
two
rk D
iag
ram
: P
erf
orm
ing
Se
cu
rity
Tro
ub
lesh
oo
tin
g T
ech
niq
ue
s L
ab
srxA
-1
-In
terfa
ce ge
-0/0
/ 4 -
172.
20.1
01.0
/24
172.
20.2
01.0
/24
(.10)
Juni
per-S
V
(.10) AC
ME-
SV
..___ V
irtua
l Rou
ters
-...
srxA
-2
172.
20.1
02.0
/24
(10)
Juni
per-W
F
(J�
lan.
202
172.
20.2
02.0
/24
(.10)
�
ACM
E-W
F
fl)
E ftl ..
ftl ·-
Q
.D ftl ....
m
,, 0 a.
Po
d B
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ap
pS
ec
ure
La
b
ge-0
/0/8
172.1
6.1
.1/2
4
ge-0
/0/9
172.1
6.1
0.1
/24
1-1· -
- '---
r. �· !
•
�)j
srxB
-K
Trus
t Zon
e
VM
Ser
ver
172.1
6.1
0.1
00
Un
trus
t Zon
e
_ K
= p
od.....
�
--
--
(1 o
r 2
)
·D· :,
:l
'lV
M C
lien
t 17
2.1
6.1
.10
0 � -·
= --
"''" V
M S
erve
r's
Dut
ies
FTP
Ser
ver
Web
Ser
ver
Po
d B
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
La
ye
r 2 S
ecu
rity
La
b
srxB
-1
�a\�
p
t{g
141)
vlan
.24 3
loO: 1
92.1
68.1
.1! (
.50)
ge-0
/0/2
vla
n.24
3 7r:'�
ff�- �
:V�
/
.
.
�-v
172.
20.2
43.0
/24
<J
(.10)
E [il
Untru
st Z
one
172.
20.2
43.0
/24
172.
20.2
44.0
/24
-1� "-<& · �
o
:::---u> o
Host
172
.31.
15.1
(.-?) �6)
'0 rq_. u>
ge-0
/0/1
(.50
) sr
xB-2
vla
n.24
4 (. :7"
loO: 1
92.1
68.2
.1
'},_/
fil )
vla
n.24
4
n�69'
,
�.
,
/
rt?'Q
17
2.2 0
.244
.0/2
4 c>J
(.1
0)
.....--
-....
Juni
per-S
Y Vi
rtual
Rou
ters
--
--
--
--
--
�Ju
nipe
r-WF
Po
d B
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Jun
os
Vir
tua
l R
ou
tin
g L
ab
vlan.
103
172.
20.10
3.0/
24(.1
0)
Juni
per-S
Y
r--
�
Host
172
.31.
15.1
\:'V'
C)\o�
untru
st Z
one
fl,
�
-<>..?
"-<c9 ""<
o :;;,--.s>o
(...?;
'�
Untru
st Z
one
'-.:: �
o
:;;,--1.Y
srxB
-1(.1
) ge-
0/0/
1 17
2.19
.1.0
/30
ge-0
/0/1
(.2
) sr
xB-2
172.
20.2
03.0
/24
(.10) AC
ME-
SV
-In
terfa
ce g
e-0/
0/4
-17
2.20
.104.
0/24
/(.1
0 )
.___
�
Virtu
al Ro
uter
s -
,,,,. L.:.::...J
Ju
nipe
r-WF
172.
20.2
04.0
/24
(.10
)'
ACM
E-W
F
Po
d B
Ne
two
rk D
iag
ram
: A
dva
nce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 1
-3
)
srxB
-1
10.0
.1.0
/24
1�-
�
-<.>� '-<
& · �o /"
u> o
Host
172
.31.
15.1
(.-2) � 61
'0 �q_,
\Y
srxB
-2
7V
•
Publ
ic-Fa
cing
Zone
· x
,�
vlan.
103
/ ( .1
),vla
n.20
3 _
_ _
___
. _ vla
n.10
4 (.1
),vla
n.20
4 /
·
"\.
-m
terra
ce ge
-u/U
/4 -
.,,
, 17
2.20
.103
.0/2
4 17
2.20
.203
.0/2
4 17
2.20
.104
.0/2
4 17
2.20
.204
.0/2
4
,...__....
_(.-,10
)(.1
0 )\.
/(.1
0)
( . ....
10_) _
_ __�
r:=l
Juni
per-S
V
I .. -
w
I I
.. --.
I....._
__
..... ............._
Virt
ual R
oute
rs,,,,.
Ju
nipe
r-WF
ACM
E-W
F
Po
d B
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 4
-5
)
srxB
-1
�
\':>()
l\,�y
">,<o
-y U
ntru
st Z
one
:'\'1,.·
">,
( .1)
ge-0
/0/2
10
.0.1
.0/2
4
vlan.
203
1Pv6
Su
bne
t
Ad
de
d
-<;:>.;,
·-Ia
Untru
st Z
one �
< g,.. ao
ge-0
/0/2
(.1
29)
srxB
-2
vlan.
204
(.10)
Juni
per-S
V AC
ME-
SV
Juni
per-W
F AC
ME-
WF
Po
d B
Ne
two
rk D
iag
ram
: H
ub
-an
d-S
po
ke
IPs
ec
VP
Ns
La
b
I .
•--
I B-
1 Sp
oke
Host
s,
Spok
e 1
192.
171.
20.3
Spok
e 2
192.
171.
20.4
Spok
e 3
192.
171.
20.5
Spok
e 1
B-1
stO:
10.
10.2
0.3/
24
loO:
192
.168
.20.
3
Spok
e2
B-1
stO:
10.
10.2
0.4/
24
loO: 1
92.1
68.2
0.4
Spok
e3
B-1
St0:
10.
10.2
0.5/
24 I
i
loO: 1
92.1
68.2
0.5
Non
Juno
s /
De
vice
srxB
-1
stO:
10.
10.2
0.1/
24
I loO
: 192
.168
.20 .
1 1.{:,1
)(. l
O )I •
__ _
, .,...
I--
LU
1..c:1
1-v
n
-17
2.20
.100
.0/2
4 __
_ ....
Spok
e 1
B-2
stO:
10.
10.2
0.6/
24
loO:
192
.168
.20.
6
l
..
--
B-2
Spok
e Ho
sts
Spok
e 1
192.
171.
20.6
Spok
e 2
192.
171.
20.7
Spok
e3
192.
171.
20.8
'N
onJu
nos
Devic
e
srxB
-2
stO:
10.
10.2
0.2/
24
_ 1
__
_ ,
"
..,
!(.lO
) (.!l,
I loO
: 192
.168
.20.
2 I
I L
Uli
ar·
vn
�
17
2.20
.200
.0/2
4
'
Po
d B
Ne
two
rk D
iag
ram
: C
on
fig
uri
ng
Gro
up
VP
Ns
La
b
srxB
-1
loO: 1
92.1
68.2
1.1
7'.
vlan.
103
172.
20.1
03.0
/24
172.
20.2
03.0
/24
( .10)
(.�
Key S
erve
r loO
: 192
.168
.21.
3
-In
terfa
ce g
e-0/
0/4
-
srxB
-2
loO: 1
92.1
68.2
1.2
172 .
20.1
04.0
/ 24
/( .1
0)
172.
20.2
04.0
/ 24
( .10)
�
Juni
per-S
V �
..___ V
irtua
l Rou
ters__
_ ........ I v
r104
I
-Ju
nipe
r-WF
ACM
E-W
F
Po
d B
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ad
va
nce
d I
Pse
c V
PN
So
luti
on
s L
ab
Loca
l-VR
(.10 )
c/
�o
'),.<r>'>--
· ,y
'i o\
'?> 11
2.20
.100
.0;2
4 �e-o
l .--
--
-:.-�
--..,'(:?
Untru
st Zo
ne
srxB
-1
Acqu
ired
Zone
st
O: 1
0.10
.20.
1/24
(.1) G
RE: 1
1.11
.21.
1/30
lo
O: 1
92.1
68.1
.1
172.
20.1
00.0
/24
srxB
-2
stO:
10.
10. 2
0.2 /
24 11',
c qui
red
Zone
GRE:
11.
11.2
1.2/
30r (
.1)
loO: 1
92.1
68.2
.1
vlan.1
03 7
(.1),
vlan.
203
,,
'--
:nts
ifacs
gs-
0/0/
4 -
,,.
vlan .1
04/
(.1)�
1 an.
204
I
'
172.
20.1
03.0
/24
(.10 )
Juni
per-S
V
172.
20.2
03.0
/24
(.10)\.
� ---
Virtu
al R
oute
rsAC
ME-
SV
172.
20.1
04.0
/24
(10 )
17
2.20
.204
.0/2
4 (.1
0 )'
Po
d B
Ne
two
rk D
iag
ram
: P
erf
orm
ing
Se
cu
rity
Tro
ub
les
ho
oti
ng
Te
ch
niq
ue
s L
ab
srxB
-1
srxB
-2
vlan.
103
-In
terfa
ce ge
-0/0
/4 -
172.
20.1
03.0
/24
172.
20.2
03.0
/24
172.
20.1
04.0
/24
172.
20.2
04.0
/24
(.10
)
Juni
per-S
V
(.10)
(.1
0)
'----
::-:::-:--
..___ V
irtua
l Rou
ters
Juni
per-W
F AC
ME-
SV
(.10)
�
ACM
E-W
F
Cl)
E ca ..
'OI ca ·-
Q
.a ca ...
c.,
,, 0 A.
Po
d C
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ap
pS
ec
ure
La
b
ge-0
/0/8
17
2.16
.1.1
/24
ge-0
/0/9
17
2.16
.10.
1/24
srxC
-K
Trus
t Zon
e
VM S
erve
r 17
2.16
.10.
100
1--
--
--
10
Untr
ust Z
one
K=
po
d
......
-(1
or2
)
VM C
lient
17
2.16
.1.1
00
I "
"
1
VM S
erve
r's D
utie
s
FTP
Ser
ver
Web
Ser
ver
Po
d C
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
La
ye
r 2
Se
cu
rity
La
b
r::::,\�
e;r::::,\
srxC-
1 /t
.1 ) vl
an.2
45
loO: 1
92.1
68 1
1r=::::::::::
::::::::=
�vla
n.24
57
'-.
··
(.50 )
ge-0
/0/ 2
_/(.
1) "-
�
172
20
6),,..
..
24
5.0/
24
�
I .. 1s
I� I Ju
nipe
r-SV
Untru
st Z
one
172.
20.2
45.0
/24
172.
20.2
46.0
/24
Virtu
al R
oute
rs -
-l� "-l& · �
o
:;.--.s> o
Host
172
.31.
15.1
(.,?; �
(9'0 /"g.....
,S>
ge-0
/0/1
(.50
) sr
xC-2
vlan
.246
(.o/
1 lo. 0:
192
.168
.2.1
·"(1,
/..
A,1�
1an.
246
1,e/o/ ,
.,. "
/
e;r::::,\r::::,
17
2 .20
.246
.0/2
4 ¢o
(.1
0 )
----
Juni
per-W
F
Po
d C
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Jun
os V
irtu
al
Ro
uti
ng
La
b
vlan
.105
172.
20.1
05.0
/24
(.10)
Juni
per-S
V
srxC
-1
(.1) g
e-0/
0/1
�-
,�
E �
In
tern
et
172.
19.1
.0/3
0
-<,>� "-<
<9 - �· q....
-s>o
Host
172
.31.
15.1
(.<,)
,��
Untru
st Z
one
, -q....
0 :,,'a
ge-0
/0/1
(.2
) sr
xC-2
-In
terf a
ce g
e-0/
0/4
---+
vla
n .10 67'.
1)\..
vlan
. 206
172.
20.2
05.0
/24
172.
20.1
06.0
/24
172.
20.2
06.0
/24
(.10)
..___
,_A_C_M
_E_-S_V__.
Virtu
al R
oute
rs,,,.....
(10)
(.10)
Juni
per- W
FAC
ME-W
F
Po
d C
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 1
-3
)
I �
-<,>� "-<
& · -20
::.---
\Yo
Host
172
.31.
15.1
(.'S) �
- o
:::.---q,,
a
srxC
-1
I \ . .LJ
ge-u
/U/"L
10
.0.1
.0/2
4
7· "\'""
<::::::::::__
Pu
blic-
Faci
ng Zo
ne
.-vla
n.10
5 /
( .1)\
vlan.
205
.......
_.. v
lan.
106
/
· ·
'\.
-in
terfa
ce ge
-0/0
/4 �
.,,
172.
20.1
05.0
/ 24
172.
20.2
05.0
/24
172.
20.1
06.0
/24
172.
20.2
06.0
/24
(.10 )
(.1
0i\.
/(.1
0 )
Juni
per-S
V
. .. ,, n
5 i
_R
ters
I
v, ,v
__J
. ----
Virtu
al
ou
Juni
per-W
F
(.10 )
�
ACM
E-W
F
Po
d C
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 4
-S
l -
-.
srxC
-1
Juni
per-S
V
�
\'?,C)\-'>
Y
\-<o.;,,
Unt
rust
Zon
e:'\'1,
· \,
( .1
) g
e-0
/0
/2
1
0.0
.1.0
/24
vlan.
205
ACM
E-SV
1Pv6
Su
bne
t
Ad
de
d
-Z,>s?
·.ze
Untru
st Z
one �
� g,, \Yo
ge-0
/0
/2
(.
12
9)
srxC
-2
(.1
,,
vlan.
20S
17
2.2
0.2
06
.0/2
4
(.1
0)
Juni
per-W
FAC
ME-
WF
Po
d C
Ne
two
rk D
iag
ram
: H
ub
-an
d-S
po
ke
IPs
ec
VP
Ns
La
b
--�
-
·-
��---
: C-
1Spo
ke Ho
sts
Spo
ke 1
192.
171.
30.3
Spo
ke 2
192.
171.
30.4
Spo
ke 3
192.
171.
30.5
Spo
ke 1
C-1
stO:
10.
10.3
0.3/
24
loO: 1
92.1
68.3
0.3
Spo
ke 2
C-1
stO:
10.
10.3
0.4/
24
loO: 1
92.1
68.3
0.4
Spo
ke 3
C-1
stO:
10.
10.3
0.5/
24 I
I
loO: 1
92.1
68.3
0.5
.
Non
Juno
s /
De
vice
srxC
-1
stO:
10.
10.3
0.1/
24
I loO:
192
.168
.30 .
1 lf:_
1)(. 1
0 )1 1
--
-•
\
In
I
172.
20.1
00.0
/24}
LU
l.icH
-m
I
i ,
C-2 S
poke
Host
s ---
: S
poke
1 C-
2 st
O: 1
0.10
.30.
6/24
loO
: 192
.168
.30.
6 S
poke
1 19
2.17
1.30
.6
Spo
ke 2
192.
171.
30.7
Spo
ke 3
192.
171.
30.8
.
Spo
ke 2
C-2
stO:
10.
10.3
0.7 /
24
loO: 1
92.1
68.3
0.7
Spo
ke3
C-2
'I: ls
tO: 1
0.10
.30.
8/24
loO
: 192
.168
.30.
8
"N
onJu
nos
Devic
e
srxC
-2
stO:
10.
10.3
0.2/
24
.
1 �M
, \I
D
l (.i O
)(. 1:},
I loO
: 192
.168
.30.
2 I
I L
u1..,
ar
vn
l1
172.
20.2
00.0
/24
Po
d C
Ne
two
rk D
iag
ram
: C
on
fig
uri
ng
Gro
up
VP
Ns
La
b
srxC
-1
Key S
erve
r loO
: 192
.168
.31.
3
loO: 1
92.1
68.3
1.1
vlan.
105
172.
20.1
05.0
/24
(.10 )
Juni
per-S
V
7X
-In
terfa
ce g
e-0/
0/ 4
-17
2.20
.205
.0/2
4 (.1
0)
ACM
E-SV
..___
Virt
ual R
oute
rs
srxC
-2
loO: 1
92.1
68.3
1.2
/;'\.
�;
(.1) x
lan.
206
172.
20.1
06.0
/24
172.
20.2
06.0
/24
(.10)
(.1
0)'
Juni
per-W
F AC
ME-
WF
Po
d C
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ad
va
nc
ed
IP
se
c V
PN
So
luti
on
s L
ab
Loca
l-VR
(.10 )
Loca
l-VR
(.10 )
c/
=>C)
'),.<c,'>-.
'�
ria \
'=> 17
2.20
.100
.0/2
4 \...')).
n0
'C)\
172.
20.1
00.0
/24
....--
--=-
�-
."'
Untru
st Z
one
�I sr
xC-1
I
Acqu
ired
Zone
st
O: 1
0.10
.30.
1/24
(.1
) GR
E: 1
1.11
.31.
1/30
loO
: 192
.168
.1.1
,_.;=-
;:i,,f:<1
srxc
_ st
O: 1
0.10
.30.
2/24
I/Ac
quire
d Zo
ne
GRE:
11.
11.3
1.2/
3or(
.1)
loO: 1
92.1
68.2
.1
vlan .
105
?Tii �
lan.
205
-In
terfa
ce g e
-0/ 0
/4 -
-+
v lan .
106 /
(.1),
vlan.
206
172.
20.1
05.0
/24
(.10 )
Juni
per-S
V
172.
20.2
05.0
/24
172.
20.1
06.0
/24
(.10 )\.
/
(.10 )
I \/
r?
m,
II
vr
10
6
I I
··---
I..___ .
...
I -
----
IVi
rtual
Rou
ters
-Ju
nipe
r-WF
172.
20.2
06.0
/24
(.10 )
'
ACM
E-W
F
Po
d C
Ne
two
rk D
iag
ram
: P
erf
orm
ing
Se
cu
rity
Tro
ub
lesh
oo
tin
g T
ech
niq
ue
s L
ab
Juni
per-S
V
� sr �
�
-Int
erfa
c e g e
-0/0
/4 -
-+ v
lan .
100
�1 a
n.20
6
... I __ o_
s---11 ....___
AC
ME-S
V Vi
rtua l
Rou
ters
--+
17
2.2
0.1
06
.0/2
4
17
2.2
0.2
06
.0/2
4
(.1
0)
(.1
0)
Juni
per-W
F AC
ME-
WF
en
E ca ..
'QI) ca ·-
Q
.a ca .... Q
,:s 0 A.
Po
d D
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ap
pS
ec
ure
La
b
ge-0
/0/8
172
.16
.1.1
/24
ge-0
/0/9
172
.16
.10
.1/2
4
srxD
-K
Trus
t Zon
e
VM S
erve
r 172
.16
.10
.10
0
Untru
st Zo
ne
K=
pod
....,
-(1
or2
)
VM C
lient
172
.16
.1.1
00
r VM
Ser
ver·�
Dut
i� I
FTP
Serv
er
Web
Ser
ver
Po
d D
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
La
ye
r 2
Se
cu
rity
La
b
\.:�
c:)'?
p\
f
srxD
-1
loO:
192
.168
.1.1
1 (. 5
0 ) ge
-0/0
/2
vlan.
247 {
1 )�&
-o v�
17
2.20
.247
.0/2
4 <1
(.10 )
r:.--
[fl
Un
tru
st Z
on
e
172.
20.2
47.0
/24
172.
20.2
48.0
/24
-<.>-2
"-<c9 ·-2
· q_..� o
Host
172
.31.
1 5.1
r.-2; <§>"
c9'0 :,.,'q_..
� ge
-0/0
/1 (.
50)
srxD
-2
vlan.
248
(.y lo
O: 1
92.1
68.2
.1
\'>-/
r.1
) vla
n.24
8
,;:,\()
��
"
�
llf,:l)
172.
20.2
48.0
/24
¢J
(.10 )
Jun
ipe
r-S
Y
Vir
tua
l R
ou
ters
-----------==
Jun
ipe
r-W
F
Po
d D
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Jun
os
Vir
tua
l R
ou
tin
g L
ab
vlan
.107
172.
20.1
07.0
/24
(.10 )
Juni
per-S
V
"
�
. ..·
�
Host
172
.31.
15.1
'(� '-<& · "2
0
�I.Y o
(.-0 '.§>"
(9. Un
trust
Zon
e ,
-g.,0
�a
srxD
-1
(.1) g
e -0/
0/1
172 .
19.1
.0/3
0 ge
-0/0
/1 (
.2)
srxD
-2
-In
terfa
ce ge
-0/0
/4 -
172.
20.2
07.0
/24
(.10 )
ACM
E-SV
..___ V
i rtua
l Rou
ters
-,,,,.
172.
20.1
08.0
/24
172.
20.2
08.0
/24
(.10)
(.1
0)�
Juni
per-W
F AC
ME-
WF
Po
d D
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 1
-3
)
srxD
-1
10.0
.1.0
/24
I �
-<>� '-<
& ' "20
/"
.s> o
Host
172
.31.1
5.1
(.� � <S>
- o �g....,S>
srxD
-2
�·�
Publ
ic-Fa
cing Z
one
yi:
vlan.
107
(.1)
vlan.
207
.._
=+ v
lan.
108
(.1),
vlan
.208
-In
terfa
ce g
e-0/
0/4
-17
2.20
.107
.0/24
17
2.20
.207
.0/2
4 17
2.20
.108
.0/2
4 17
2.20
.208
.0/2
4 (.1
0 )
(. �
/(.1
0 )
(.10 )
'\_
.---
--.
L
r 20 7
I .....___
.
,.. I v r
1 08 I
I vr20
8 I
Juni
p er-S
V Vi
rtual
Rout
ers
-J u
nipe
r-WF
ACM
E-W
F
Po
d D
Ne
two
rk D
iag
ram
: A
dv
an
ce
d N
AT
Imp
lem
en
tati
on
s L
ab
(P
art
s 4
-5
)
srxD
-1
(.10)
Juni
per-S
V
o\'?Jc:,
\-<o�
ntru
st Z
one
i'1-
' '),
( .1)
ge-0
/0/2
vlan.
207
10.0
.1.0
/24
1Pv6
Su
bn
et
Ad
de
d
ACM
E-SV
-<;>� -..:!
&.
Untru
st Z
one
,<g.,.
-Yo
ge-0
/0/2
(.1
29)
srxD
-2
vlan.
208
(.1\
r·..-
��
��
----
,
172.
20.2
08.0
/24
(.10)
Juni
per-W
F AC
ME-
WF
Po
d D
Ne
two
rk D
iag
ram
: H
ub
-an
d-S
po
ke
IPs
ec
VP
Ns
La
b
--
"'"""'
.,.
,_
_,. .....,
-
""-
D-1
Spok
e Ho
sts
i Sp
oke
1 19
2.17
1.40
.3
Spok
e 2
192.
171.
40.4
Spok
e 3
192.
171.
40.5
Spok
e 10
-1
stO:
10.
10.4
0.3/
24
loO: 1
92.1
68.4
0.3
Spok
e 2
D-1
stO:
10.
10.4
0.4/
24
loO:
192
.168
.40.
4
Spok
e 3
D-1
stO:
10.
10.4
0.5/
24 c-i
lo
O: 1
92.1
68.4
0.5
Non
Juno
s /
De
vice
srxD
-1
stO:
10.
10.4
0.1/
24
I loO:
192
.168
.40.
1 K,
1)
(. 10 )
1 , M
aL\
/D
-
172.
20.1
00.0
/2M
L.V
\,Q
,-
Y"
!
,-
-.,,.,..,
.. ..
� _.,,.....,
-"'
D-2
Spok
e Ho
sts
l 1
Spok
e 10
-2
stO:
10.
10.4
0.6/
24
loO: 1
92.1
68.4
0.6
Spok
e 1
Spok
e2
192.
171.
40.6
192.
171.
40.7
Spok
e 3
192.
171.
40.8
Spok
e2
D-2
stO:
10.
10.4
0.7 /
24
loO:
192
.168
.40.
7
Spok
e3 0
-2
t is
tO: 1
0.10
.40.
8/24
lo
O: 1
92.1
68.4
0.8
.:Z;>
<.:za
'N
onJu
nos
D".
·.:?_
Devic
e
<:> &, o
- �
v
�.y
.J
o (.01
srxD
-2
I st
O: 1
0.10
.40.
2/24
I
liJ-O)
(Jl
l lo
O: 1
92.1
68.4
0 2
I "
""
L\/D
I .. w�
· ...
11 1
2.20
.200
.0;2
4
Po
d D
Ne
two
rk D
iag
ram
: C
on
fig
uri
ng
Gro
up
VP
Ns
La
b
srxD
-1
Key
Ser
ver
loO
: 19
2.1
68.4
1.3
loO
: 19
2.1
68.4
1.1
vlan
.107
172.
20.1
07.0
/24
(.10)
Juni
per-S
V
7�
-In
terf
ace
ge-0
/0/4
-
172.
20.2
07.0
/24
(.10)
.___ _
_ ...,
...___ v
· AC
ME-
SV
1rtua
l Rou
ters
srxD
-2
loO
: 19
2.1
68.4
1.2
172
.20.
108
.0/2
4 17
2.2
0.2
08.0
/24
(10
)(.1
0)�
Juni
per-W
F AC
ME-
WF
Po
d D
Ne
two
rk D
iag
ram
: Im
ple
me
nti
ng
Ad
va
nce
d I
Pse
c V
PN
So
luti
on
s L
ab
Loca
l-VR
(.10)
<l�a
a. '\c
· \c
u·
ocal
-VR
(.10)
�ri·
a\�
172.
20.1
00.0
;24
,al
4,e
172.
20.1
00.0
/24
,---
--
--
""' U
ntru
st Z
one
-· ·-·
----
-· ·-
0 2
. sr
xD-1
sr
x -
. Ac
quire
d Zo
ne1
stO:
_10.
10.4
0.1/
24
stO:
_10.
1 0.4
0 .2/
24 r
� )qu1re
d Zo
ne
(. ) G
RE. 1
1.11
.41.
1/30
GR
E. 1
1.11
.41.
2/30
lo
O: 1
92.1
68.1
.1
loO: 1
92.1
68.2
.1
vlan.
107
(.1)"
vlan.
207
...,
,.,..
vlan.
108
(.1)
vlan
.208
\..
-
Inter
face
ge-0
/0/ 4
-17
2.20
.107
.0/2
4 _Li
.10)
I ... 1 (\7
I
IY
I .L
Uf
I
Juni
per-S
V
172.
20.2
07.0
/24
(.10)
I vr2
07I ..___
Virtu
al R
oute
rs
172.
20.1
08.0
/24
172.
20.2
08.0
/24
(10)
(.10)'
Juni
per-W
F AC
ME-
WF
Po
d D
Ne
two
rk D
iag
ram
: P
erf
orm
ing
S_e
cu
rity
Tro
ub
les
ho
oti
ng
Te
ch
niq
ue
s L
ab
srxD
-1
vlan.
107
-In
terfa
ce ge
-0/0
/4 -
172.
20.1
07.0
/24
172.
20.2
07.0
/24
(.10
)
Juni
per-S
Y
(.10)
ACM
E-SV
�
Virt
ual R
oute
rs,,,...
srxD
-2
172.
20.1
08.0
/24
172.
20.2
08.0
/24
(10
)(.1
0)'
Juni
per-W
F AC
ME-
WF