SRX

last person joined: 4 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  Multiple Zones to Interface NAT

    Posted 12-28-2012 16:10

    I'm looking for a bit of help with a source NAT setup for an SRX210HE. The SRX is running Junos 11.4R2.14 with a single ISP connected to ge-0/0/0.0 (static IP). There are three zones setup; untrust, trust, and external. Untrust has ge-0/0/0.0 interface only. Trust zone has vlan.100, interfaces fe-0/0/2.0 and fe-0/0/3.0 only, for network 10.1.1.0/24. External zone has vlan.200, interfaces fe-0/0/6.0 and fe-0/0/7.0 only, for network 192.168.0.0/24. I'm doing a source NAT from trust and external to untrust (see attached txt doc).

     

    What I thought was working well seems not to be not working properly. The traffic for trust zone computers seem to function fine (or no complaints yet). The traffic for external zone computers are having connectivity issues when browsing to Internet services (mainly http/https). From watching the flows it looks like the return traffic is not going back to the IP that made the request. So, the end users connected to external are seeing intermitant issues with pages not loading properly or not at all. A copy of one of the flows is attached for review.

     

    After reviewing the NAT examples I've found from Juniper it seems that I may need to better define the traffic for each zone.     

    - Do i need to specify the network of each zone int the source-address?

     - Since this is a NAT to a single IP on ge-0/0/0.0 would it be best to create a pool for each internal network in each zone?

     

    All help is greatly appreciated. I hope a fix is possible.

    Attachment(s)

    txt
    security flows.txt   3 KB 1 version
    txt
    source nat.txt   1 KB 1 version


  • 2.  RE: Multiple Zones to Interface NAT

    Posted 12-29-2012 01:40

    Theconfiguration looks fine

    However if the packets are not reaching the end host

     

    catch security flow session destination prefix ..... so that we can see both sides of the session

     

    also collecting security flow  traceoption with basic datapath and packet-drop will be helpful.

     

    Regards,

    Sachin



  • 3.  RE: Multiple Zones to Interface NAT
    Best Answer

    Posted 01-24-2013 08:11

    After researching the issue further it came down to a few branch SRX's that had PPPOE as their IP interface. The fix was adjusting all tcp traffic to 1350. I had just vpn traffic using this mss. Once changed to all-tcp it works great.

     

    set security flow tcp-mss all-tcp mss 1350