ScreenOS Firewalls (NOT SRX)
Reply
Visitor
AbsolutV
Posts: 8
Registered: ‎03-13-2011
0

VPN and NAT

Hi all, 

I hope you could help me to solve this issue:

 

i have a LAN to LAN, policy based VPN:

 

LAN1(192.168.1.0) -----[FW1]------- tunnel -------[JNP1]---- LAN2 (192.168.2.0)

 

the policy for the tunnel on JNP is:

FROM LAN1 to LAN2

 

On the JNP1 i have a static route that permit the host in LAN2 to reach the hosts on anothe network LAN3 (10.0.0.0/24). and the default GW to reach the LAN3 hosts is the JNP1 itself.

 

 

Now the problem is that I would like the hosts in LAN3 to appear like if they were hosts of LAN2. To do this for example I added a policy:

FROM LAN2 to LAN2 for a host 192.168.2.2 NATting it to 10.0.0.2 . Doing so I can ping the host 10.0.0.2  in LAN3 from hosts in LAN2

 

If I ping  192.168.2.2 from LAN2 it works, and the natted host in LAN3 is pinged, and I see in the polucy FROM LAN2 to LAN2 the ping succeeding.

 

The issue I have is that if i do a ping to the 192.168.2.2 host from LAN1 I see in the logs of the VPN policy  that there is a ping from 192.168.1.1 to 192.168.2.2 but nothing more....

 

So, why can't I ping from LAN1 the 192.168.2.2 ip address ( the natted one)?

 

Thanks for your help.

 

Regards-

 

 

 

 

Distinguished Expert
echidov
Posts: 858
Registered: ‎11-02-2009
0

Re: VPN and NAT

Hi,

 

The packet from 192.168.1.1 has Untrust as it's source zone and this IP does not belong to LAN2. It's destination is a NAT configured on the Trust interface. The packet exits the trust interface and enters it again. You can imagine it this way. So, this is a looping connection that requires two policies. But LAN2 to LAN2 policy is not applied to this packet (wrong source IP!). You can enable source NAT for the LAN1 to LAN2 policy and use trust interface IP for the NAT.

Configuring/troubleshooting of such looping connections may be cumbersome. Besides, only the first policy is logged. One should use "debug flow" to understand how it works.

If you need a clean solution, you'd better connect LAN3 to a dedicated interface and switch to the route based VPN. The most adequate (and flexible) NAT would be in this case a policy based NAT.

Kind regards,
Edouard
Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.