SRX Services Gateway
Highlighted
SRX Services Gateway

NAT configuration problem in SRX550

‎12-17-2014 07:42 PM

I am working in aamra Technologies ltd, which is one of best IT solution provider company in Bangladesh. Recently we have sold one Juniper SRX550 firewall in Primer bank limited, which is one of the leading bank in Bangladesh. We have set up this firewall in DMZ zone. The network design and theie requirment is as below :

 

1. In SRX550, they have dropped two ISP.

2. Behind the firewall they have some Application server in DMZ zone and all the service is depend on internet.

 

Now theie requirment is :

 

1. Some application servers are going through ISP A via NAT

2. Some application servers are going through ISP B via NAT

3. They want to use both ISP at a time.

4. When one ISP will goes down that time automatically all trafiic will through another  ISP via NAT.

 

I can configure one defult route via one ISP but how I will configure default route for both ISP in active active senario.

 

Is it possible to configure this firewall by matching the above critaria. If possible then plase help me how I will configure it. 

 

Regards,

Shuvo

 

2 REPLIES 2
SRX Services Gateway

Re: NAT configuration problem in SRX550

‎12-17-2014 10:53 PM

Hi,

 

Using FBF( Filter Based Forwarding) you an achive your requiremet.

 

 

And pl refer below KB to configure the FBF on SRX branch devices.

 

http://kb.juniper.net/InfoCenter/index?page=content&id=KB17223&smlogin=true

 

or http://kb.juniper.net/InfoCenter/index?page=content&id=KB22052&smlogin=true

 

 

 

 

........
If this worked for you please flag my post as an "Accepted Solution".

Best Regards,
Suresh Mudhireddy
SRX Services Gateway

Re: NAT configuration problem in SRX550

‎12-20-2014 04:16 AM

With your requirements I would configure two virtual routers one for each ISP and their associated servers.  This will very simply keep them on their respective ISP link.

 

then you would need to configure a secondary default route to the alternate ISP virtual router so that when you lose the upstream default route the failover can occur.  for this I would use either qualified next hop or the RPM ip tracking.

Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
http://puluka.com/home