SRX Services Gateway
Highlighted
SRX Services Gateway

SRX BGP Multiple Public IP not working

[ Edited ]
‎10-05-2018 02:40 AM

Hi,

 

I have a BGP connection to my ISP and when my network is using the public IP of the SRX all is ok. But when I try to use a different IP in the subnet allocated such as 119.28.29.135.

 

Servers can send packets out but dont see a reply. I have setup a tcpdump on an external server and can see the packet arrive there from 119.28.29.135. It is showing the correct external IP and reply's to the ping to the correct addess 119.28.29.135, but I never see it arrive. I have put on a packet filter onto the SRX and still dont see a reply. Policises and static NAT are correct.

 

I think possibly the person that setup this BGP connection missed something, can someone double check the below BGP setup, and advise?

Thanks

 

from zone [ trust untrust ];
rule 4 {
match {
destination-address 119.28.29.135/32;
}
then {
static-nat {
prefix {
192.168.2.11/32;
}
}
}
}
}
}
proxy-arp {
interface reth0.0 {
address {
192.168.2.0/32;
}
}
}
policy trust_to_any {
match {
source-address any;
destination-address any;
application any;
from-zone trust;
to-zone any;
}
then {
permit;
}
}
zones {
security-zone untrust {
host-inbound-traffic {
system-services {
https;
ssh;
ping;
ike;
}
protocols {
bgp;
bfd;
}
}
interfaces {
reth1.0 {
host-inbound-traffic {
system-services {
ssh;
https;
ping;
ike;
}
protocols {
bgp;
bfd;
}
}
}
}
}
}
reth1 {
description "Internet Primary";
redundant-ether-options {
redundancy-group 1;
}
unit 0 {
family inet {
address 119.28.29.130/28;
}
}
}

routing-options { autonomous-system 0.65000; }
protocols {
bgp {
authentication-algorithm md5;
group ISP {
type external;
preference 100;
import import-default-route;
authentication-algorithm md5;
export my-bgp-network;
peer-as 38333;
outbound-route-filter {
prefix-based {
accept { inet; } } }
neighbor 119.28.29.129 {
local-address 119.28.29.130;
authentication-key "£dj60em9t045gimlkfvDfjnd6Au1"; ## SECRET-DATA } }
l2-learning {
global-mode switching;
}
}

 

4 REPLIES 4
SRX Services Gateway
Solution
Accepted by topic author VOIPBunny
‎10-05-2018 04:34 AM

Re: SRX BGP Multiple Public IP not working

‎10-05-2018 02:48 AM

Hi,

You are using the natted IP ( 119.28.29.135) from the reth1.0 subnet range (119.28.29.130/28). So you have to enable proxy-arp for the natted ip so that SRX can respond to return packets.

set security nat prox-arp interface reth1.0 address 119.28.29.135/32

 

Thanks,
Nellikka
JNCIE x3 (SEC #321; SP #2839; ENT #790)
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!
SRX Services Gateway

Re: SRX BGP Multiple Public IP not working

‎10-05-2018 04:10 AM

Thanks that worked. Althoguh now I'm confused as I have other SRX's that I have not proxy-arp public IP's and they work.

SRX Services Gateway

Re: SRX BGP Multiple Public IP not working

‎10-05-2018 04:19 AM
Hi,
Proxy-are is required only when the natted up and the interface ip (In this case reth1.0) are in the same subnet.
In other SRXs, the natted ip may be in different subnet.
Thanks,
Nellikka
JNCIE x3 (SEC #321; SP #2839; ENT #790)
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!
SRX Services Gateway

Re: SRX BGP Multiple Public IP not working

‎10-05-2018 04:34 AM

They are in the same subnet on the others, this is why I'm confused.