SRX Services Gateway
Reply
Contributor
jeniferdcosta
Posts: 92
Registered: ‎07-25-2010
0

source NAT with 1 IP but different port range to different destinations

Hello ,

 

As i  tried that 1 IP can be used only in 1 pool it  can't be used in another pool by another name of the pool, So how to achieve the below.

 

real source : 10.10.10.10

destination-1:100.100.100.100

source port:  60000-65000

translated IP: 11.11.11.11

 

real source : 10.10.10.10

destination: 150.150.150.150

source port:  40000-45000

translated IP: 11.11.11.11

 

real source : 10.10.10.10

destination: 50.50.50.50

source port:  30000-35000

translated IP: 11.11.11.11

 

Thanks

 

 

Distinguished Expert
MMcD
Posts: 628
Registered: ‎07-20-2010
0

Re: source NAT with 1 IP but different port range to different destinations

[ Edited ]

I would suggest you do something like the following:

 

First create all the rules required to NAT ALL the other traffic from 10.10.10.10 to all destinations such as FTP, HTTP, SSH.  Then just allow all the other ports to go to these 3 locations. 

 

Hopefully it should work for you

pool 11_11_11_11 {
    address {
        11.11.11.11/32;
    }
}
pool 172_16_1_1 {
    address {
        172.16.1.1/32;
    }
}
rule-set source-test {
    from zone trust;
    to zone untrust;
    rule ftp {
        match {
            source-address 10.10.10.10/32;
            destination-address 11.120.130.140/32;
        destination-port 21;
        }
        then {
            source-nat {
                pool {
                    172_16_1_1;
                }
            }
        }
    }
    rule HTTP {
        match {
            source-address 10.10.10.10/32;
            destination-address 120.140.150.160/32;
        destination-port 80;
        }
        then {
            source-nat {
                pool {
                    172_16_1_1;
                }
            }
        }
    }
    rule dest1 {
        match {
            source-address 10.10.10.10/32;
            destination-address [100.100.100.100/32 150.150.150.150/32 50.50.50.50/32];
        }
        then {
            source-nat {
                pool {
                    11_11_11_11;
                }
            }
        }
    }

 

MMcD [JNCIP-SEC, JNCIS-ENT, CCNA, MCP]
____________________________________________________

[Please Mark My Solution Accepted if it Helped, Kudos are Appreciated Too]
Regular Visitor
Jim_Greene
Posts: 9
Registered: ‎02-21-2008
0

Re: source NAT with 1 IP but different port range to different destinations

Why not create a rule-set with the three desired rules, each using the same IP pool?

Contributor
jeniferdcosta
Posts: 92
Registered: ‎07-25-2010
0

Re: source NAT with 1 IP but different port range to different destinations

Hi,

 

i didnt understood ur replies my concern is the source Port  and not the destination port, as u can see the source port are different for different destination.

 

Thanks

Regular Visitor
Jim_Greene
Posts: 9
Registered: ‎02-21-2008
0

Re: source NAT with 1 IP but different port range to different destinations

Ah, yes, I see your issue now since you can't match on source port. I don't know if maybe a persistent NAT would help but if you are purely relying on source port for differentiation even that may prove problematic. I will try to mock it up in my lab and see if I can get it to work.

Regular Visitor
Jim_Greene
Posts: 9
Registered: ‎02-21-2008
0

Re: source NAT with 1 IP but different port range to different destinations

The more I think about it the more I think you probably need to use security policies to filter that traffic before it gets to the NAT rules. Since it is a source NAT it gets evaluated after security policy lookups so that may work for you.

Recognized Expert
JunOS_Fan
Posts: 241
Registered: ‎02-13-2012
0

Re: source NAT with 1 IP but different port range to different destinations

Hi,

 

What about the traffic coming from same source 10.10.10.10 but with a different source port ( other than 60000-65000,40000-45000 and 30000-35000) ?  how it should be translated ? is there any specific requirement for this ?

 

and for the traffic with these sourceport ranges , do you need to maintain the same port ? or  PAT is fine for this ?

 

I think , having an idea of overall requirement should give us a better picture . if possible , could you share your complete NAT requirements ?

Best regards
Pradeep (JNCIP-SEC,ENT,SP)
www.networker.co.in
Contributor
jeniferdcosta
Posts: 92
Registered: ‎07-25-2010
0

Re: source NAT with 1 IP but different port range to different destinations

Hello Pradeep,

 

As i have written in my 1st mail, one source is going to different destination and port but with different source port.and 1 IP from pool

 

how it should be translated ? is there any specific requirement for this ?

They will go by one IP from the pool.

 

and for the traffic with these sourceport ranges , do you need to maintain the same port ?

yes i need to maintain different source port ranges to different destination

Contributor
jeniferdcosta
Posts: 92
Registered: ‎07-25-2010
0

Re: source NAT with 1 IP but different port range to different destinations

Dear's,

 

Anybody can help me to solve the above issues.

 

Thanks

Visitor
venu
Posts: 7
Registered: ‎01-24-2011
0

Re: source NAT with 1 IP but different port range to different destinations

Hi , can you confirm whether the source-port range that you had mentioned is actual source-port or the translated source- port after N(P)AT.

Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.