I had my xbox behind an ssg5 and moved it behind an srx 210 to test this. the 210 is also behind the ssg5. so it goes:
internet -- ssg5 -- srx 210 -- xbox.
the ssg5 is doing the same VIP it was always doing to the xbox. the 210 has the old xbox IP and is now doing src / dst nat to the xbox which I moved behind the srx 210.
The problem is not the Dst NAT inbound… it’s the Src NAT outbound. The SRX is port translating outbound and throwing off the xbox server. I realize that my SSG-5 never had this problem and a simple VIP worked fine, but this is how I got it to work on my SRX-210 WITHOUT static NAT.
The trick is to use the “no-translate” option on a source pool for your xbox. You need a source pool and not the source interface NAT to be able to use the no-translate option, but no worries, just use the same public IP in the source pool. SRX will require at least two IPs for the pool because of the no-translate, again, no worries just use the next IP. Yes, next public IP. The next IP won’t ever get used, the xbox is the only thing using this pool. If you have problems with your public IP switching all the time, then maybe a script is in your future. I have not gotten that far yet.
Try this:
172.23.1.6 = the public IP
172.23.2.80 -= the xbox private IP
The policy is the same as in the thread above, allow xbox ports to the xbox private ip
[edit]
admin# show security nat
source {
pool xbox_src_pool {
address {
172.23.1.6/32 to 172.23.1.7/32;
}
port no-translation;
}
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule xbox_out {
match {
source-address 172.23.2.80/32;
}
then {
source-nat {
pool {
xbox_src_pool;
}
}
}
}
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
destination {
pool XBOX-pool {
address 172.23.2.80/32;
}
rule-set XBOX-rs {
from zone untrust;
rule XBOX-1 {
match {
destination-address 172.23.1.6/32;
destination-port 88;
}
then {
destination-nat pool XBOX-pool;
}
}
rule XBOX-2 {
match {
destination-address 172.23.1.6/32;
destination-port 3074;
}
then {
destination-nat pool XBOX-pool;
}
}
rule XBOX-3 {
match {
destination-address 172.23.1.6/32;
destination-port 53;
}
then {
destination-nat pool XBOX-pool;
}
}
}
}
[edit]
I hope this helps!
-Jason