Hi, all.
I have SRX240 and some routed local networks (wich not directly attached to SRX). So, I have to make source nat, but still no luck.
Scheme: LocalNet 10.17.17.0/24 ---- LOCALROUTER (10.1.1.2)---- (net 10.1.1.0/24) ---- (10.1.1.1)SRX240 ----(external net x.x.x.x/24)
My config:
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address x.x.x.2/24;
}
}
}
ge-0/0/14 {
gigether-options {
802.3ad ae0;
}
}
ge-0/0/15 {
gigether-options {
802.3ad ae0;
}
}
ae0 {
description link-to-c4507R;
aggregated-ether-options {
lacp {
active;
}
}
unit 0 {
family ethernet-switching {
port-mode trunk;
vlan {
members [ vlan18-p2p ];
}
}
}
}
vlan {
unit 18 {
family inet {
address 10.1.1.1/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop x.x.x.1;
route 10.17.17.0/24 next-hop 10.1.1.2;
}
}
security {
nat {
source {
rule-set TRUST-UNTRUST-NAT {
from zone trust;
to zone untrust;
rule NAT-RULE {
match {
source-address 0.0.0.0/0;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.18;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
ssh;
}
}
interfaces {
ge-0/0/0.0;
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
}
vlans {
vlan18-p2p {
vlan-id 18;
l3-interface vlan.18;
}
}
So, when I trying to ping some outside host - I see record in NAT table (for example):
Session ID: 4555, Policy name: trust-to-untrust/6, Timeout: 58, Valid
In: 10.17.17.23/62058 --> 8.8.8.8/53;udp, If: vlan.18, Pkts: 1, Bytes: 71
Out: 8.8.8.8/53 --> x.x.x.2/51831;udp, If: ge-0/0/0.0, Pkts: 1, Bytes: 527
I see, that request was sent from host behind nat and arrived to destination outside host. Destination host is answer for request, but "that answer" not coming back. Why? What wrong?
Sorry my bad english and thx for your answers.