SRX Getting Started – Configure Ethernet ports for switching


This article provides examples of how to configure Ethernet ports for switching and information about how to verify and troubleshoot your configuration.

For other topics, go to the SRX Getting Started main page.



The SRX Series products provide a comprehensive suite of Ethernet switching functionality. Ethernet switching features eliminate the need for Layer 2 switches in small branch offices and act as an aggregate switch in medium-sized branch offices.

J Series routers include Ethernet switching features, integrated routing and bridging, and support for several Layer 2 protocols. These features are also present in branch SRX Series Services Gateways (SRX100, SRX110, SRX210, SRX220, SRX240, SRX550 and SRX650). Switching is not available (and not needed) on the high-end SRX devices.  Switching is performed in the hardware, which allows full throughput without consuming CPU performance.Important Note:Use of Ethernet Switching in chassis clusters requires the following Junos OS versions:
SRX240 & SRX650 (Junos 11.1 or later)
SRX210, SRX220 (Junos 11.2 or later)
SRX550 (Junos 12.1 or later)
SRX100 and SRX110 devices do not support ethernet-switching in clusters.  

For a configuration example in chassis clusters, refer to KB21422 – How to configure Ethernet Switching in Chassis Cluster mode.

For a list of devices and ports that support switching features, refer to KB15455 – Which ports on J-Series and SRX-Branch support Layer2 switching.

CLI Configuration

Two examples are provided. In the first example, the default Ethernet switch configuration is explained.  In the second example, two interfaces are assigned to a new, different VLAN.

Example 1 — Default ethernet switch configuration.

The following procedure shows the default configuration for Ethernet switching on interfaces on a SRX210 device. The factory default configuration includes a predefined VLAN named vlan-trust and a VLAN interface named vlan.0 that is assigned to an IP address of and as a Layer 3 interface. The VLAN interface is assigned to the trust security zone, which allows all services and protocols.

  1. An internal VLAN (vlan-trust) is defined to allow switching several interfaces:
  2. user@host# set vlans vlan-trust vlan-id 3
  3. Assign a VLAN interface as the Layer 3 interface to the predefined vlan-trust VLAN.:

  4. user@host#
    set vlans vlan-trust l3-interface vlan.0
  5. Configure a VLAN interface with an IP address for the VLAN. For branch deployments, the IP address is typically the gateway address. This layer 3 interface can has an IP address that is reachable from all hosts on its VLAN.
  6. user@host#set interfaces vlan unit 0 family inet address
  7. Assign all physical interfaces except ge-0/0/0 to an interface range with the name interfaces-trust:
  8. user@host# set interfaces interface-range interfaces-trust member ge-0/0/1
    user@host# set interfaces interface-range interfaces-trust member fe-0/0/2
    set interfaces interface-range interfaces-trust member fe-0/0/3
    user@host# set interfaces interface-range interfaces-trust member fe-0/0/4
    user@host# set interfaces interface-range interfaces-trust member fe-0/0/5
    user@host# set interfaces interface-range interfaces-trust member fe-0/0/6
    set interfaces interface-range interfaces-trust member fe-0/0/7
  9. Assign the interface range to the VLAN vlan-trust.
  10. user@host#set interfaces interface-range interfaces-trust unit 0 family ethernet-switching vlan members vlan-trust
  11. Assign the VLAN interface to a security zone, and specify allowed host-inbound services and protocols. (It is a firewall, so the interface is mapped to zone trust where all services are enabled.)
user@host# set security zones security-zone trust interfaces vlan.0
set security zones security-zone trust host-inbound-traffic system-services all
user@host# set security zones security-zone trust host-inbound-traffic protocols all


Example 2 — Configure two interfaces into separate VLAN

The following procedure shows an example of configuring the fe-0/0/2 and fe-0/0/3 interfaces as Ethernet switch ports in a separate vlan (vlan100).    It is important to note that that interfaces have to be removed from interface-ranges before they can be added to other VLANs for switching (step 1 below).

  1. Before you can add an interface to switching you probably have to remove assignments.  Run the following command to see how it’s configured:
    user@host# run show configuration | match <interface> | display set    
  2. If the interface is member of an interface-group in use, you need to untie it:
    user@host# delete interfaces interface-range <interface-range-name> member <interface>If there is an IP address assigned to the interface you have to remove it:
    user@host# delete interfaces <interface> unit 0 family inet
  3. Specify a new VLAN, which will be used for switching, in this case vlan 100:
  4. user@host# set vlans vlan-100 vlan-id 100
  5. Assign this VLAN interface as your Layer3 Interface on this VLAN:
  6. user@host# set vlans vlan-100 l3-interface vlan.100
  7. Configure a VLAN interface with an IP for this VLAN.   (It must be on a different L3 subnet than the other VLANs.)
  8. user@host# set interfaces vlan unit 100 family inet address
  9. Assign the fe-0/0/2 and fe-0/0/3 physical interfaces to an interface range with the name interfaces-vlan100.
  10. user@host# set interfaces interface-range interfaces-vlan100 member fe-0/0/2
    user@host# set interfaces interface-range interfaces-vlan100 member fe-0/0/3
  11. Assign the interface range to the desired VLAN. (The default for new switching interfaces is port mode = access (untagged)).
  12. user@host# set interfaces interface-range interfaces-vlan100 unit 0 family ethernet-switching vlan members vlan-100  
  13. It is a firewall, so the VLAN interface must also be in a zone
  14. user@host# set security zones security-zone trust interfaces vlan.100
  15. Allow services on the VLAN interface if desired:
  16. user@host# set security zones security-zone trust interfaces vlan.100 host-inbound-traffic system-services <service>
    user@host# set security zones security-zone trust host-inbound-traffic protocols <protocol>

Application Note

Refer to the application note TN191 – J Series and Branch SRX Series Ethernet Switching Configuration Guide for an overview of the Junos OS Layer 2 features for J Series and branch SRX Series Services gateways.

Technical Documentation

Ethernet Interfaces Feature Guide for Security Devices

Verification & Troubleshooting

The following commands are helpful for verifying and troubleshooting Ethernet switching and VLANs:

user@host> show ethernet-switching mac-learning-log
Technical documentation reference:   show ethernet-switching mac-learning-log

user@host> show ethernet-switching table              
Technical documentation reference:   show ethernet-switching table

user@host> show vlans
user@host> show vlans <vlan> extensive

user@host> show ethernet-switching table interface <interface>

user@host> monitor interface <vlan interface>


Junos Basics – Inter VLAN Routing

By | July 22, 2013

In my previous Junos Basics post I covered the configuration steps required to create VLAN’s on a Juniper switch and assign interfaces to them. In this post I’ll step through the config to enable routing between these VLAN’s and also show a couple of verification commands to check it’s working as expected.

Firstly we configure a routed VLAN interface (RVI) for each VLAN, which is the equivalent of an SVI in Ciscoland. Note that we are configuring the unit value (used for logical interface configuration) to be the same as the VLAN tag, although this is optional:

set interfaces vlan unit 100 family inet address
set interfaces vlan unit 200 family inet address

Secondly, we link the VLAN’s to the RVI’s. Note that we specify the unit numbers we set in the previous step for each layer 3 interface:

set vlans SALES l3-interface vlan.100
set vlans IT l3-interface vlan.200

For an RVI to be up and the routing table to have a valid route to it’s VLAN there has to be at least one interface in that VLAN connected and up. I’ve connected a couple of hosts to the interfaces we’ve configured so we can see this in action.

First up we can check the status of our L3 interfaces:

rich@EX2200C> show interfaces terse | match vlan
vlan                    up    up
vlan.100                up    up   inet
vlan.200                up    up   inet

All good so far, next let’s check the local routing table to see if the routes to our new VLAN’s are in there and are valid (if there are no UP interfaces in a VLAN, then the route will say “reject”):

rich@EX2200C> show route

inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both     *[Direct/0] 00:08:17
                    > via vlan.100     *[Local/0] 00:36:50
                      Local via vlan.100     *[Direct/0] 00:00:41
                    > via vlan.200     *[Local/0] 00:36:50
                      Local via vlan.200

As a final verification, lets ping one of our RVI’s and make sure it’s up:

rich@EX2200C> ping
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=64 time=0.356 ms

I hope this has been a useful explanation.  In the next post in this Junos Basics series, I’ll cover trunking the VLAN’s out to an access layer switch.


How to start screen gnome-screensaver daemon

Following is what you will do to use gnome-screensaver. Make sure that gnome screensaver is installed, along with its components. Unfortunately, you cannot change the default blanking behavior. (But, since that is what you said that you did anyway, this may just be the solution for you and you will not need the one for using xscreensaver).

1. Go to and install the Lock Screen Extension.

2. Restart your system and see if the extension is running when you logon. It will look like a little lock in your Panel. If not, you will need to edit the json information to add your current version of GNOME Shell and restart GNOME Shell again.

The file will be: ~/.local/share/gnome-shell/extensions/

The text should look something like the following (it could differ but your GNOME Shell major and minor version must be in the shell-version list as below):

  "_generated": "Generated by SweetTooth, do not edit", 
  "description": "Add lock icon to the panel and lock the screen instead of using ctrl-alt-l", 
  "name": "Lock Screen", 
  "shell-version": [
  "url": "", 
  "uuid": "", 
  "version": 5

3. Now, once the extension is running and you see the little lock, what you will need to do is to check for the presence of a Screensaver desktop shortcut in the /etc/xdg/autostart directory. If you check the properties and it says gnome-screensaver in the command field, you can skip to step 8.

4. If there is no gnome-screensaver.desktop file there, you will need to create one and put it in /etc/xdg/autostart. You will need to do this as root or using sudo, as follows. In terminal type sudo nano /etc/xdg/autostart/gnome-screensaver.desktop and press Enter.

5. Paste the following text into that open window:

[Desktop Entry]
Name[ar]=حافظة الشاشة
Name[be]=Ахоўнік экрана
Name[be@latin]=Źbierahalnik ekranu
Name[bg]=Предпазител на екрана
Name[br]=Damanter skramm
Name[ca]=Estalvi de pantalla
Name[ca@valencia]=Estalvi de pantalla
Name[crh]=Ekran qoruyıcısı
Name[cs]=Šetřič obrazovky
Name[cy]=Arbedwr sgrin
Name[el]=Προστασία οθόνης
Name[fa]=محافظ صفحه*نمایش
Name[fr]=Économiseur d'écran
Name[ga]=Spárálaí Scáileáin
Name[gl]=Protector de pantalla
Name[he]=שומר מסך
Name[hr]=Čuvar zaslona
Name[id]=Pengaman Layar
Name[ko]=화면 보호기
Name[lt]=Ekrano užsklanda
Name[mg]=Sary mitsitsy
Name[mk]=Чувар на екранот
Name[mn]=Дэлгэц гамнагч
Name[ms]=Penyelamat skrin
Name[oc]=Estalviaire d'ecran
Name[or]=ପରଦା ସଂରକ୍ଷକ
Name[pl]=Wygaszacz ekranu
Name[ps]=پرده ساتونکی
Name[pt]=Protecção de Ecrã
Name[pt_BR]=Proteção de tela
Name[ro]=Protector de ecran
Name[ru]=Хранитель экрана
Name[sk]=Šetrič obrazovky
Name[sl]=Ohranjevalnik zaslona
Name[sq]=Ruajtës ekrani
Name[sr]=Чувар екрана
Name[sr@latin]=Čuvar ekrana
Name[ta]=திரை சேமிப்பி
Name[tr]=Ekran koruyucu
Name[ug]=ئېكران قوغدىغۇچ
Name[uk]=Збереження екрана
Name[vi]=Bộ bảo vệ màn hình
Comment=Launch screensaver and locker program
Comment[af]=Lanseer sluimerskerm en sluitprogram
Comment[an]=Lanzar o salvapantallas y o programa de bloqueyo
Comment[ar]=شغّل برنامج حافظة الشاشة
Comment[as]=স্ক্ৰিনছেইভাৰ আৰু লকাৰ প্ৰগ্ৰাম আৰম্ভ কৰক
Comment[be]=Запуск ахоўніка і блакіроўшчыка экрана
Comment[bg]=Стартиране на предпазителя на екрана и заключване
Comment[bn]=স্ক্রিন-সেভার এবং লক করার প্রোগ্রাম আরম্ভ
Comment[bn_IN]=স্ক্রিন-সেভার ও লকার প্রোগ্রাম আরম্ভ করুন
Comment[ca]=Executa l'estalvi de pantalla i el programa de blocatge
Comment[ca@valencia]=Executa l'estalvi de pantalla i el programa de blocatge
Comment[crh]=Ekran qoruyıcı ve kilitleyici programnı fırlat
Comment[cs]=Spustí šetřič obrazovky a program uzamknutí
Comment[da]=Start pauseskærm og skærmlåsningsprogram
Comment[de]=Bildschirmschoner und Bildschirmsperrung starten
Comment[el]=Έναρξη της προφύλαξης οθόνης και του προγράμματος κλειδώματος υπολογιστή
Comment[en_GB]=Launch screensaver and locker program
Comment[eo]=Ruli ekrankurtenon kaj ŝlosprogramaron
Comment[es]=Lanzar el salvapantallas y el programa de bloqueo
Comment[et]=Ekraanisäästmis- ja lukustustamisprogrammi käivitamine
Comment[eu]=Abiarazi pantaila-babeslea edo programa blokeatzailea
Comment[fa]=اجرای محافط صفحه*نمایش و اجرای برنامه*ی قفل
Comment[fi]=Käynnistä näytönsäästäjä ja lukitusohjelma
Comment[fr]=Lancer l'économiseur d'écran et le programme de verrouillage
Comment[gl]=Iniciar o protector de pantallas e o programa de bloqueo
Comment[gu]=સ્ક્રીન સેવર અને લોકર પ્રક્રિયાને શરૂ કરો
Comment[he]=טעינת שומר המסך ואת תכנית הנעילה
Comment[hi]=स्क्रीनसेवर और लॉकर प्रोग्राम लॉन्च करें
Comment[hu]=Képernyővédő és -zároló program indítása
Comment[id]=Menjalankan pengaman layar serta mengunci program
Comment[it]=Lancia il programma per salvaschermo e per blocco schermo
Comment[km]=បើក​ដំណើរការ​កម្មវិធី​រក្សា​ធាតុ​អេក្រង់ និង​កម្មវិធី​ចាក់សោ
Comment[ko]=화면 보호기 및 잠그기 프로그램을 실행합니다
Comment[lt]=Paleisti ekrano užsklandą ir užraktą
Comment[lv]=Palaist ekrāna saudzētāju un noslēgšanas programmu
Comment[ml]=സ്ക്രീന്* സേവറും ലോക്കര്* പ്രോഗ്രാം ലഭ്യമാക്കുക
Comment[mr]=स्क्रीनसेवर व लॉकर प्रोग्राम सुरू करा
Comment[ms]=Lancar penyelamatskrin dan program pengunci
Comment[nb]=Start skjermsparer og låsprogram
Comment[nl]=Schermbeveiliging en -vergrendeling opstarten
Comment[or]=ପରଦା ସଂରକ୍ଷକ ଏବଂ ଅପରିବର୍ତ୍ତନୀୟ ପ୍ରଗ୍ରାମକୁ ଆରମ୍ଭ କରନ୍ତୁ
Comment[pa]=ਸਕਰੀਨ ਸੇਵਰ ਅਤੇ ਲਾਕਰ ਪਰੋਗਰਾਮ ਚਲਾਓ
Comment[pl]=Uruchamia wygaszacz ekranu i program blokujący
Comment[pt]=Iniciar o protector de ecrã e a aplicação de trancar
Comment[pt_BR]=Executa o protetor de tela e bloqueia programa
Comment[ro]=Lansează programul de blocare și protejare a ecranului
Comment[ru]=Запустить хранитель экрана и программу блокировки
Comment[sl]=Zaženi ohranjevalnik zaslona in program za zaklepanje
Comment[sr]=Покреће чувара екрана и програм за закључавање екрана
Comment[sr@latin]=Pokreće čuvara ekrana i program za zaključavanje ekrana
Comment[sv]=Starta program för skärmsläckare och -låsning
Comment[ta]=திரைசேமிப்பு மற்றும் பூட்டு நிரலை துவக்கு
Comment[te]=తెరకాపరిని మరియు తాళంవేయు ప్రోగ్రామును ప్రారంభించు
Comment[tr]=Ekran koruyucu ve kilitleyici programı başlat
Comment[ug]=ئېكران قوغدىغۇچ ۋە قۇلۇپلاش پروگراممىسىنى قوزغات
Comment[uk]=Програма запуску збереження екрана та блокування
Comment[vi]=Chạy chương trình bảo vệ và khóa màn hình
Comment[xh]=Ukhupha umgcini-skrini kunye nenkqubo yotshixa

7. Press Ctrl+x and save the file.

8. Make sure the file is executable by checking permissions. If it is not executable, type sudo chmod a+x ‘/etc/xdg/autostart/gnome-screensaver.desktop’ and press Enter. Once you have done that reboot your system and logon to GNOME Shell again. Check System Monitor to see if the gnome-screensaver process is running. If it is, clicking the lock icon in the panel should lock your screen and blank it. If it works, you are done and can skip the remaining steps. If it still does not work, you have to make three modifications to the code of the Lock Screen Extension you installed in a previous step.

9. Open ~/.local/share/gnome-shell/extensions/ in gEdit.

10. Add the following line to the constants:

const GLib =;

11. Comment out the line reading: “const ScreenSaver = imports.misc.screenSaver;” and add the following below that if it is not already there:

const Main = imports.ui.main;

12. Locate and comment out the lines that read as follows:

screenSaverProxy = new ScreenSaver.ScreenSaverProxy();

13. Add the following two lines below the two lines you just commented out:

	GLib.spawn_command_line_async('gnome-screensaver-command --lock');

14. Save the file, restart your machine, and then the Lock Screen icon in your panel should work to start gnome-screensaver and lock and blank your screen.

You’re done, if you followed these instructions exactly.



Statisk kopi af dynamisk side

Mange hjemmesider, vi støder på i dag er dynamiske. Men i nogle tilfælde kan det være nødvendigt eller ønskværdigt at oprette en statisk kopi af en hjemmeside.

  • Siden kører på en gammel og forældet version af websoftwaren (et CMS-system, f.eks.)
  • Siden er blevet hacket, men indholdet er stadig brugbart
  • Siden er ikke blevet opdateret i lang tid, og har mistet sin relevans, men skal måske genoplives som en dynamisk hjemmeside

Derudover kan man med fordel bruge en statisk side som midlertidig fail-over, som de besøgende får vist, til den primære side bringes online igen.

Den nemmeste måde er med wget-kommandoen, som eksekveres fra et terminalvindue:

wget -P [sti til lokal mappe] -mpck --user-agent="" -e robots=off --wait 1 -E [URL til hjemmesiden, der ønskes gemt]

Når wget har kørt færdig, åbner du den lokale mappe, og åbner index-filen i din browser.

Installér Gnome3 i Arch Linux

To pakkegrupper kan som udgangspunkt installeres for at få det hele med. Gnome-extra indeholder en del spil, som nogle måske vil vælge at fjerne igen efterfølgende.

sudo pacman -S gnome gnome-extra

Gnome bruger GDM som display manager – så GDM skal køre som tjeneste for at du kan starte op i Gnome.

sudo systemctl enable gdm.service

Gnome Tweak Tool er ikke et absolut krav, men udvider Gnomes meget spartanske indstillingsmuligheder betydeligt. Uundværligt, hvis du vil ændre tema i Gnome.

sudo pacman -S gnome-tweak-tool

Koncentriske cirkler i Inkscape

Der er to måder at konstruere koncentriske cirkler på i Inkscape.

Vi kan lave x antal cirkler, og vælge at fjerne fyldfarven og kun bruge stregen. Dét kan give problemer senere hen, hvis man ønsker at udføre operationer på bemeldte cirkler, efter de er blevet konverteret til sti-objekter.

Den bedre måde – hvis vi ved, at vi alligevel skal konvertere til sti-objekter – er at konvertere til disse med det samme, og derpå  “skære” cirklerne ud ved hjælp operationer.

  1. Først placeres to cirkler centreret oven på hinanden, den ene lidt mindre end den anden – ideelt set også af forskellig farve, så man nemmere kan se forskel. Vi kan ændre farven igen senere.
  2. Vi vælger at slå stregfarve fuldstændig fra, så vi kun har cirklernes indre fyldfarve til at definere dem.
  3. Begge cirkler vælges og konverteres til sti-objekter.
  4. Så kører vi – stadig med begge cirkler valgt – en sti-operation på dem: Path > Difference. Dette sletter alt, hvor de to cirkler overlapper. Resultatet er, at vi har et fint cirkelrundt sti-objekt, der til forveksling ligner en streg.
  5. Trin 1-4 gentages for det passende antal cirkler, vi ønsker i vores billede.
  6. Sluttelig kan alle cirkler kombineres til eet sti-objekt ved at vælge dem alle, og køre sti-operationen Kombinér (Path > Combine). Dermed kan vi anvende dem sammen med andre sti-objekter til sti-operationer, hvoraf nogle – f.eks Path > Union – kan køres på nøjagtig to objekter og ikke mere.