SRX

Hi,

Well basically I am much new to SRX environment and I need to NAT a public Ip to 2 private IP's on different ports.
In Cisco it is quite easy but in JunOS I dont have a clue how it is to be done, anyone can help kinndly with display set configuration.

Furthermore one of the private IP is in one zone whereas the other private IP is in a different zone.

Create 2 address Pools for each private IP and assosiated port

 

set security nat destination pool Address-1 address 192.168.1.1/32
set security nat destination pool Address-1 address port 80
set security nat destination pool Address-2 address 172.16.1.1/32
set security nat destination pool Address-2 address port 443

 

Destination NAT rule
set security nat destination rule-set Rule-set-1 from routing-instance default --> This can be zone or interface on whihc actual traffuc reach SRX

set security nat destination rule-set Rule-set-1 rule 1 match destination-address 4.4.4.4/32
set security nat destination rule-set Rule-set-1 rule 1 match destination-port 80
set security nat destination rule-set Rule-set-1 rule 1 then destination-nat pool Address-1

set security nat destination rule-set Rule-set-1 rule 2 match destination-address 4.4.4.4/32
set security nat destination rule-set Rule-set-1 rule 2 match destination-port 443
set security nat destination rule-set Rule-set-1 rule 2 then destination-nat pool Address-2

 

 

make sure you have security policies for each private IP zones, we dont have to specify them on NAT rule.

Hi Suraj,

 

Thanks for this I am having couple of things more on it.
The routing-instance on which the traffic will be coming on the SRX is already having static nat, so still can I configure the one you said set security nat destination rule-set...

Also if I am not wrong the security policy will be something like this

set security policy from-zone untrust to-zone trust policy ABC match source-address any

set security policy from-zone untrust to-zone trust policy ABC match destination-address address-1

set security policy from-zone untrust to-zone trust policy ABC then applciation junos-http

 

Kindly let me know if it is correct. Also like what is the difference in the nat destination pool address and the address book as if I am not worng the address-book is the IP address of the subject in that zone, can you please clarify this.

The routing-instance on which the traffic will be coming on the SRX is already having static nat, so still can I configure the one you said set security nat destination rule-set...

You can still use routing-instance match.

Policy config should be as below.

set security policy from-zone untrust to-zone trust policy ABC match source-address any
set security policy from-zone untrust to-zone trust policy ABC match destination-address address-1
set security policy from-zone untrust to-zone trust policy ABC match applciation junos-http
set security policy from-zone untrust to-zone trust policy ABC then perming

Same way you need to write another policy on which address 2 is connected .

The routing-instance on which the traffic will be coming on the SRX is already 
having static nat, so still can I configure the one you said set security nat 
destination rule-set...

Not sure what you mean by this but:

 

You cannot use the SAME ip address in both static NAT and forwarding different ports to separate servers.

 

You do configure as the rule in the same hierarchy as Suraj notes if the addresses are different.

 

 

well what I mean is I am having some ip's with static nat already in this zone I am having to do it via proxy-arp as the ISP has given a subnet of public IP's which are to be used for publising and other stuff.
I will configure different IP's for static NAT and destination NAT
but my question was if I am doing it like two type of NAT's (Static/Destination) coming on same Zone of SRX it will not create any issues right or wrong.

Thanks to you both I found what I was looking for.
If I get to face any problem I will revert.

Your example is on page 9 the one to many.

 

https://kb.juniper.net/library/CUSTOMERSERVICE/technotes/Junos_NAT_Examples.pdf

 

Basically, you have separate rules for NAT and security policy based on the zone to zone initiation direction.