Juniper vLabs Lab 4 (Network Address Translation, Source NAT to Interface)
Step By Step Guide:
1) Login to vLabs and Reserve/Launch the Lab (should take a few minutes to start
up).
- [Link]
2) Lets start by changing the IP addresses on the interfaces between the vSRX and
Host3.
Host3:
delete interfaces ge-0/0/2.0 family inet address [Link]/24
set interfaces ge-0/0/2 unit 0 family inet address [Link]/30
vSRX:
delete interfaces ge-0/0/2.0 family inet address [Link]/24
set interfaces ge-0/0/2 unit 0 family inet address [Link]/30
3) We do this to simulate the connection between Host3 and the vSRX being a
publicly routed, external subnet. Now lets add a
static route in Host1 so that it knows how to reach the external subnet of
[Link]/30 through the firewall. We will also try
to ping from Host1 to Host3.
jcluser@Host1# set routing-options static route [Link]/30 next-hop [Link]
jcluser@Host1> ping [Link] rapid count 5
PING [Link] ([Link]): 56 data bytes
.....
--- [Link] ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
4) We see that the pings have failed, lets do a security flow session on the vSRX
to troubleshoot.
jcluser@vSRX1> show security flow session | refresh
---(refreshed at 2024-04-08 23:56:51 UTC)---
Session ID: 256, Policy name: default-permit/5, State: Stand-alone, Timeout: 54,
Valid
In: [Link]/9506 --> [Link]/0;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts:
1, Bytes: 84,
Out: [Link]/0 --> [Link]/9506;icmp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts:
0, Bytes: 0,
5) We see that the vSRX is showing packets enter in from Host1, but we do not see
any replies from Host3. Lets look at Host3's
routing table.
jcluser@Host3> show route
inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
[Link]/0 *[Static/5] 00:39:23
> to [Link] via fxp0.0
[Link]/16 *[Direct/0] 00:39:23
> via fxp0.0
[Link]/32 *[Local/0] 00:39:23
Local via fxp0.0
[Link]/30 *[Direct/0] 00:26:41
> via ge-0/0/2.0
[Link]/32 *[Local/0] 00:26:41
Local via ge-0/0/2.0
6) As we can see, Host3 doesn't have any private IP subnets listed in its route
table, and the default route is setup in the lab
through fxp0.0 most likely for reachbility through the management network to the
device. This is a normal configuration. Lets now
setup a NAT policy on the firewall to perform NAT on its external interface so that
traffic sourced from Host1 ([Link]) now
shows up sourced from the firewalls external interface towards Host3 in the UNTRUST
zone ([Link] - ge-0/0/2.0).
set security nat source rule-set INTERNAL_HOSTS_TO_UNTRUST from zone trust
set security nat source rule-set INTERNAL_HOSTS_TO_UNTRUST to zone untrust
set security nat source rule-set INTERNAL_HOSTS_TO_UNTRUST rule INTERFACE_NAT match
source-address [Link]/0
set security nat source rule-set INTERNAL_HOSTS_TO_UNTRUST rule INTERFACE_NAT match
destination-address [Link]/0
set security nat source rule-set INTERNAL_HOSTS_TO_UNTRUST rule INTERFACE_NAT then
source-nat interface
7) Now lets try the ping again from Host1 to Host3 and see the results.
jcluser@Host1> ping [Link] rapid count 5
PING [Link] ([Link]): 56 data bytes
!!!!!
--- [Link] ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.204/1.489/1.865/0.222 ms
jcluser@vSRX1> show security flow session | refresh
---(refreshed at 2024-04-08 23:55:20 UTC)---
Total sessions: 0
---(refreshed at 2024-04-08 23:55:25 UTC)---
Session ID: 251, Policy name: default-permit/5, State: Stand-alone, Timeout: 4,
Valid
In: [Link]/6434 --> [Link]/0;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts:
1, Bytes: 84,
Out: [Link]/0 --> [Link]/28337;icmp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts:
1, Bytes: 84,
8) We can see that the ping is successful, we can also use the security flow
session command to verify the NAT is occuring. We see
that in the "OUT" line that the traffic is returning the the interface IP on the
vSRX and not to the source address of HOST1, this
is because of the NAT interface policy we created. We can also check to see if our
policy is getting hits/matches with the
following command:
jcluser@vSRX1> show security nat source rule INTERFACE_NAT
source NAT rule: INTERFACE_NAT Rule-set: HOST1_TO_UNTRUST
Rule-Id : 1
Rule position : 1
From zone : trust
To zone : untrust
Match
Source addresses : [Link] - [Link]
Destination addresses : [Link] - [Link]
Action : interface
Persistent NAT type : N/A
Persistent NAT mapping type : address-port-mapping
Inactivity timeout : 0
Max session number : 0
Translation hits : 25
Successful sessions : 25
Number of sessions : 0
9) In the show command above we see that we are getting translation hits which is
further proof that the traffic is being matched
on the NAT policy we created. Lets add a static route in Host2 so that it knows how
to reach the external subnet of [Link]/30
through the firewall and see if Host2 can ping the external Host3 as well.
jcluser@Host2# set routing-options static route [Link]/30 next-hop [Link]
[edit]
jcluser@Host2# commit and-quit
commit complete
Exiting configuration mode
jcluser@Host2> ping [Link] rapid count 5
PING [Link] ([Link]): 56 data bytes
!!!!!
jcluser@vSRX1> show security flow session | refresh
---(refreshed at 2024-04-08 23:53:58 UTC)---
Total sessions: 0
---(refreshed at 2024-04-08 23:54:08 UTC)---
Session ID: 241, Policy name: default-permit/5, State: Stand-alone, Timeout: 2,
Valid
In: [Link]/57889 --> [Link]/0;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts:
1, Bytes: 84,
Out: [Link]/0 --> [Link]/26100;icmp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts:
1, Bytes: 84,
10) That is the end of the lab! We've successfully verified that our Interface NAT
policy is working on both Host1 and Host2.