<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div><div><div>Hi all,</div><div><br></div><div>Thanks to every one who has helped out on this, I happy to say that it has been resolved.</div><div><br></div><div>The issues we faced were:</div><div><br></div><div> VLAN tagging (facepalm) - I was sending tagged traffic from our router to the switch that was configured as an access port.</div><div> BGP authentication - The router config files normally generated in the AWS portal weren't generated, so we didn't have the BGP key. We ended up finding it in Megaport's service info page for the VXC.</div><div> </div><div>Cheers,</div><div>Andy</div></div><div><br></div><div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Cambria;"><font face="Helvetica-Light" size="1" color="#08254F" style="background-color: rgb(255, 255, 255);"><span style="font-size: 11px;">ANDY COWAN</span></font></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: Cambria;"><font face="Helvetica-Light" size="1" color="#99989D" style="background-color: rgb(255, 255, 255);"><span style="font-size: 11px;">+61 430 034 642 </span></font></p></div></div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Simon Dixon <<a href="mailto:simon@dicko.net.au">simon@dicko.net.au</a>><br><span style="font-weight:bold">Date: </span> Friday, 23 January 2015 5:42 pm<br><span style="font-weight:bold">To: </span> Geordie Guy <<a href="mailto:elomis@gmail.com">elomis@gmail.com</a>><br><span style="font-weight:bold">Cc: </span> Andrew Cowan <<a href="mailto:andycowan@gmail.com">andycowan@gmail.com</a>>, "<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br><span style="font-weight:bold">Subject: </span> Re: [AusNOG] AWS Direct Connect & Juniper<br></div><div><br></div><div dir="ltr">Andrew, <div><br></div><div>Is it a SRX cluster your using? </div><div><br></div><div>If so check that your allowing BGP to the RE in the zone config</div><div><br></div><div>A default config change would look like this.</div><div><br></div><div><span style="color:rgb(38,38,38);font-size:13px;line-height:16px">set security zone security-zone untrust host-inbound-traffic protocols bgp</span><br></div><div><span style="color:rgb(38,38,38);font-size:13px;line-height:16px"><br></span></div><div><span style="color:rgb(38,38,38);font-size:13px;line-height:16px">Regards</span></div><div><span style="color:rgb(38,38,38);font-size:13px;line-height:16px"><br></span></div><div><span style="color:rgb(38,38,38);font-size:13px;line-height:16px">Simon.</span></div><div class="gmail_extra"><br><div class="gmail_quote">On 23 January 2015 at 13:26, Geordie Guy <span dir="ltr"><<a href="mailto:elomis@gmail.com" target="_blank">elomis@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Just to confirm, you can see traffic coming from AWS but not going back? Or is it the other way around? Are you connecting to a VPC or using a public IPs for Internet facing resources like S3? Also, if you're using it for public accessibility over the DxC, are you using your own assigned IPs or are you part of the beta program where AWS assign you a /31 in 54.239.0.0?</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Fri, Jan 23, 2015 at 3:49 PM, Andrew Cowan <span dir="ltr"><<a href="mailto:andycowan@gmail.com" target="_blank">andycowan@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div style="word-wrap:break-word;font-size:14px;font-family:Calibri,sans-serif"><div><div style="color:rgb(0,0,0)">Hi Chris,</div><div style="color:rgb(0,0,0)"><br></div><div style="color:rgb(0,0,0)">Thanks for your suggestion. I checked the firewall and got the output below, I think this just means the firewall is disabled, so no problem there.</div><div style="color:rgb(0,0,0)"><br></div><div><p style="margin:0px;font-size:10px;font-family:Monaco">> show configuration firewall </p><p style="margin:0px;font-size:10px;font-family:Monaco">filter filter-jflow {</p><p style="margin:0px;font-size:10px;font-family:Monaco"> term 1 {</p><p style="margin:0px;font-size:10px;font-family:Monaco"> then {</p><p style="margin:0px;font-size:10px;font-family:Monaco"> sample;</p><p style="margin:0px;font-size:10px;font-family:Monaco"> accept;</p><p style="margin:0px;font-size:10px;font-family:Monaco"> }</p><p style="margin:0px;font-size:10px;font-family:Monaco"> }</p><p style="margin:0px;font-size:10px;font-family:Monaco">}</p></div><div style="color:rgb(0,0,0)"><br></div><div><p style="margin:0px;font-size:10px;font-family:Monaco">> show configuration firewall family inet </p><p style="margin:0px;font-size:10px;font-family:Monaco;min-height:14px"><br></p><p style="margin:0px;font-size:10px;font-family:Monaco">{primary:node0}</p></div><div style="color:rgb(0,0,0)"><br></div><div style="color:rgb(0,0,0)"><br></div></div></div></div></div></blockquote></div></div></blockquote></div><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank"></a></div></div></span></body></html>