L2V Vlan Groups In Nsm Overview; Predefined L2V Zones In Nsm Overview - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Configuring ScreenOS Devices Guide
Related
Documentation

L2V VLAN Groups in NSM Overview

Related
Documentation

Predefined L2V Zones in NSM Overview

260
L2V VLAN Groups in NSM Overview on page 260
Predefined L2V Zones in NSM Overview on page 260
Layer 2 Vsys Configuration Overview on page 258
A VLAN group contains VLAN IDs and specifies the port and zone on the physical device
that handles those IDs. You can create a VLAN group that includes a single ID range, or
add multiple ID ranges to group multiple VLAN ranges.
For each group, you must configure:
The VLAN IDs ranges you want to include in the group. To include an ID range within a
group, you must have previously imported the IDs to the vsys (the IDs must be reserved
by the vsys). To view the VLAN IDs imported to the vsys, select the option Show Vlan
IDs Imported (option is located at the bottom of the VLAN Group screen). To clear
the VLAN ID information from the group screen, clear (unselect) the option.
The port and zone that handle traffic with the specified IDs. You can select any physical
interface or aggregate interface and any L2 zone. Interfaces included within an aggregate
interface are not displayed and cannot be selected.
If you select the null zone for a VLAN interface, NSM automatically sets the zone as
v1-null.
You can create VLAN groups at the root level and at the vsys level. When configuring a
root VLAN group, however, any VLAN ID ranges you include in the group are automatically
reserved for the root system and cannot be imported by a vsys.
You cannot delete VLAN IDs that are included in a VLAN group.
Predefined L2V Zones in NSM Overview on page 260
L2V Interface Management in NSM Overview on page 261
Assigning L2V VLAN IDs (NSM Procedure) on page 259
You can configure any predefined zone in a shared virtual router as shareable. In the NSM
UI, the following predefined L2 zones appear with regular zone names:
v1-trust appears as trust
v1-untrust appears as untrust
v1-dmz appears as dmz
The exception is v1-null, which appears as v1-null; the regular null zone is unchanged,
and appears as null. By default, the predefined VLAN zone is also sharable when using
L2V. The VLAN zone contains all vsys management interfaces.
Copyright © 2010, Juniper Networks, Inc.