vSRX
vSRX

Basic Nat - source interface setup.

[ Edited ]
‎06-19-2019 01:07 PM

I clearly have something wrong, but I feel like i'm close? 

 

Also, how do I setup a static route for management only? 

 

   

admin@MLB-vSRX-RTR1# show security 
nat {
    source {
        rule-set Internal {
            from zone Inside;
            to zone Outside;
            rule A {
                match {
                    source-address 0.0.0.0/0;
                    destination-address 0.0.0.0/0;
                }
                then {
                    source-nat {
                        interface;
                    }
                }
            }
        }
    }
}
policies {
    from-zone Inside to-zone Outside {
        policy Wan-Access {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
            }
        }
    }
    from-zone Outside to-zone Inside {
        policy DenyOutsidIn {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;                   
            }
        }
    }
}
zones {
    security-zone Inside {
        host-inbound-traffic {
            system-services {
                ping;
            }
        }
        interfaces {
            ge-0/0/1.3000;
        }
    }
    security-zone Outside {
        host-inbound-traffic {
            system-services {
                ping;
            }
        }
        interfaces {
            ge-0/0/0.0;
        }
    }
}

[edit]
8 REPLIES 8
vSRX

Re: Basic Nat - source interface setup.

‎06-19-2019 01:27 PM

Hi RoutingFrames,

 

Could you please elaborate on what you are trying to accomplish?

 

Regards,

HS

vSRX

Re: Basic Nat - source interface setup.

‎06-19-2019 01:37 PM

Hey again!

 

Basic Nat. 

 

Int ge-0/0/0/1.3000 is "inside", I have VM on that network and I can hit the gateway that lives at 0/0/0.3000, however I cannot get out to the internet. 

 

I belive this to be a nat config problem, my config is 0.0.0.0/0 pointing to the WAN router downstream of our vSRX. 

 

Therefore, I cannot remote to the fxp0 interface, so how do I make a static route for the fxp0 interface as obviously I am coming from internal for SSH access and not external. 

vSRX

Re: Basic Nat - source interface setup.

‎06-19-2019 01:48 PM

Understood, could you please share the outputs of the following commands:

 

> show configuration interfaces 

> show configuration routing-options

 

Regards,

HS

vSRX

Re: Basic Nat - source interface setup.

‎06-19-2019 02:28 PM

Based on this explaination, I believe this is the topology you have:

 

VM ----0/0/1.3000----(inside zone)----vSRX----(outside zone)----0/0/0.3000----WAN Router

                                                                      |

                                                                    fxp0

 

fxp0 is the management interface and probably IP'ed from management subnet. Based on the Source NAT configured, any traffic from 'Inside' going to 'Outside' will be source natted using the 'Outside' interface IP. This will not NAT the traffic destined to fxp0. 

 

However check the route you have on the VM for this fxp0 IP on the vSRX to how this routed. Also I don't see 0/0/0.3000 as part of your 'Outside' security zone and only 'ge-0/0/0.0' is listed there. Not sure if thats a typo but thought of letting you know.

 

If this post helped resolve your issue, please mark this post as an "Accepted Solution". Kudos are also appreciated too.

 

Regards,

HS

vSRX

Re: Basic Nat - source interface setup.

‎06-19-2019 02:38 PM

In addition to what HS said in last post.

 

You can try few things here, I will divide the response in two items

1)NAT configuration

The Source NAT configuration looks fine and as I understand default route is also pointing to WAN router which should be connected via ge-0/0/0. This is correct interface as per topology given.
Start ping to 4.2.2.2 and look the "show security flow session output protocol icmp" You should see the something like this.

Session ID: 10115977, Policy name: SG/4, State: Active, Timeout: 60, Valid
In: VM_IP/1000 --> 4.2.2.2/2000;icmp, Conn Tag: 0x0, If: ge-0/0/1.200, Pkts: 1, Bytes: 86,
Out: 4.2.2.2/2000 --> ge-0/0/0 inteface IP/1000;icmp, Conn Tag: 0x0, If: ge-0/0/0, Pkts: 1, Bytes: 86,

Look for the packet counter in incoming and outging direction. if you don't see the session the counters only in outgoing direction that mean SRX device doesn't see traffic in return direction which mean issue could be with Internet.

-If you don't see the session at all under "show security flow session output protocol icmp" that mean device is dropping the flow.

In order to find out why device is dropping packet you can run this traceoption to find out.

set security flow traceoptions flag basic-datapath
set security flow traceoptions file flowtrace.txt
set security flow traceoptions packet-filter PF1 source-prefix VM_IP/32 destination-prefix 4.2.2.2/32
set security flow traceoptions packet-filter PF1 source-prefix 4.2.2.2/32 destination-prefix ge-0/0/0_interface_IP/32

 

2)FXP0- FXP0 being a management interface you need to configure management subnet which should be different from your actual ge-0/0/0 intefaces.
Instead of configuring 0/0 via fxp0 you can specify specific LAN subnet via fxp0 so that you can access it from internal network.

vSRX

Re: Basic Nat - source interface setup.

‎06-19-2019 07:49 PM

Hello RoutingFrames,

 

SSH to fxp0:

When you said you are coming from Internal for SSH access to fxp, do you mean to say you want to access fxp0 IP from LAN connected to ge-0/0/1.3000? If that is the case, it will not work. fxp0 sits on the RE and we cannot divert traffic coming on PFE to the fxp0. fxp0 is for out of band management only so to access the fxp0 IP, you need to be coming from a VM/LAN connected to the fxp0.

 

Internet traffic:

 

As HS suggested, please check if its ge-0/0/0.3000 that needs to be bound to the 'Outside' Security zone.

Also, what is the IP configuration for the interface in External zone? Does ge-0/0/0.3000 have a public IP configured on it? 

Can you share the output for show interfaces terse?

 

Thanks,
Pranita

vSRX

Re: Basic Nat - source interface setup.

‎06-20-2019 01:25 AM

Hi,

 

You can hit the gateway (ge-0/0/0/1.3000) on the inside interface from your VM that means your LAN side is good.

 

Traceoptions updated above will give you the pointer that is broken.

Maybe an internet route on the firewall or may be NAT is fine but traffic is not coming back. Are you able to ping internet from SRX ?

 

For Management, if you do not have fxp configured and a seperate connectivity. Allow SSH on the inside interface and manage the vSRX on its revenue interface (ge-0/0/0/1.3000)

 

-Rahul

Regards,
Rahul
vSRX

Re: Basic Nat - source interface setup.

‎07-02-2019 12:45 PM

Hey All.

 

Sorry, I had to go away from this and basically start all over again.

 

I'm gonna make a new thread. Thanks!