Unset interface bgroup0 dhcp server config next-server-ip Set interface bgroup0.1 dhcp server option dns1 8.8.8.8 Set interface bgroup0.1 dhcp server option netmask 255.255.255.0 Set interface bgroup0.1 dhcp server option gateway 10.150.0.1 Set interface bgroup0.1 dhcp server option lease 1440 Set interface bgroup0 dhcp server option dns1 8.8.8.8 Set interface bgroup0 dhcp server option netmask 255.255.255.0 Set interface bgroup0 dhcp server option gateway 192.168.1.1 Set interface bgroup0.1 dhcp server enable Set interface bgroup0.1 dhcp server service Set interface bgroup0 dhcp server service Unset interface vlan1 bypass-others-ipsec Set interface 'bgroup0.1' tag 2 zone 'Wifi'

Set interface 'ethernet0/1' zone 'Untrust' Set interface 'ethernet0/0' zone 'Untrust' Set zone 'V1-Untrust' screen ip-filter-src

Set zone 'Untrust-Tun' vrouter 'trust-vr' Set auth-server 'Local' server-name 'Local'

Here is the complete config file: unset key protection enable I know I can setup the juniper to use different ports for the wifi lan and use their procurve switch to do the vlan separation, but I never used vlan'ing on a Juniper firewall and I would like to try it out this way. The idea is to setup an AP with lan and guest access (AP supports multiple ssid's on different vlans). Can ping this ip from the default vlan but not from vlan2ġ0.150.0.0/24 is the wifi isolated lan on vlan2 Even setting up logging on the wifi-to-untrust policy and it does shows the attempts (it's it's timeouts).ġ72.31.16.0/24 is the untrusted lan, it's already nat'ed but works fine for testing.

I am able to get the correct ip address (10.150.0.0/24) from dhcp, able to get to the juniper management page, etc but nothing past the firewall, can't ping 4.2.2.2 or the internet gateway. When I switch to vlan2 I'm unable to get to the internet. When connected on the default vlan it gets on the internet just fine. I'm unable to get a brand new Juniper SSG-5 with latest 6.3.0r05 firmware routing to the internet from a subinterface I created on bgroup0 setup as vlan2 (bgroup0.1 on 'wifi' zone).

Juniper ssg 5 configure dmz