Source
r/networking•
esseph_

Problems with NAT on MX w/ MS-MPC-128

Hi all,

I've been chugging through quite a few forum posts, mailing lists, and juniper tech pub documentation and I simply can't find where I'm going wrong.

Current topology:

WAN<----- border router (MX) -----><----- core router (mx, ms-mpc-128) -----> transport routers/switches (ex)

OSPF running between the border, core, and transport, ae interfaces between core and transport.

Here's my current config:

set services nat pool thing1 address xx.yy.196.3/32
set services nat rule cgnat match-direction input
set services nat rule cgnat term THINGTONAT1 from source-address 100.64.1.0/24
set services nat rule cgnat term THINGTONAT1 from destination-address 0.0.0.0/0
set services nat rule cgnat term THINGTONAT1 then translated source-pool thing1
set services nat rule cgnat term THINGTONAT1 then translated translation-type dynamic-nat44
set services service-set cgnat nat-rules cgnat
set services service-set cgnat interface-service service-interface ms-4/0/0
set chassis fpc 4 pic 0 inline-services bandwidth 20g
set interfaces ms-4/0/0 unit 0 family inet
set interfaces ae1 unit 0 family inet service input service-set cgnat service-filter sf-in
set interfaces ae1 unit 0 family inet service output service-set cgnat service-filter sf-out
set firewall family inet service-filter sf-in term 1 from source-address 100.64.0.0/10
set firewall family inet service-filter sf-in term 1 from destination-address 0.0.0.0/0
set firewall family inet service-filter sf-in term 1 from destination-address 100.64.0.0/10 except
set firewall family inet service-filter sf-in term 1 then count sf-in-filter-nat-traffic
set firewall family inet service-filter sf-in term 1 then service
set firewall family inet service-filter sf-in term 2 then skip
set firewall family inet service-filter sf-out term 1 then count sf-out-filter-excluded-from-nat
set firewall family inet service-filter sf-out term 1 then skip

=======================

Traffic seems to make it up the chain then drops at the border router. It's like it's not being NAT'd, but the counters seem to show otherwise.

Any tips?

Thanks

(EDIT: Cleaning up formatting)

Posted Jul 12, 2016, 6:58 PM UTC

14
bhoskinsCERTs are overrated•

What says the output of 'show services nat mappings detail' or other operational commands under 'show services nat'?

1
esseph_OPinsurance companies HATE him!!!•

Empty, which is part of the thing I don't understand since it is hitting the rules :(

1
Warm_Soup•

Don't you have to specify both the inside-service-interface and outside-service interface ?

We're doing something similar with MX960's and MS-MPC's... Using a /27 pool to PAT all incoming connections through...

I'd be happy to share the sanitized configuration with you... although, I'm by no means an expert on it.

set services nat pool PAT-pool address X.Y.1.0/27
set services nat pool PAT-pool port automatic
set services nat allow-overlapping-nat-pools
set services nat rule TCP-PAT-RULE match-direction input
set services nat rule TCP-PAT-RULE term 1 then translated source-pool PAT-pool
set services nat rule TCP-PAT-RULE term 1 then translated translation-type napt-44
set services service-set BLAH nat-rules TCP-PAT-RULE
set services service-set BLAH next-hop-service inside-service-interface ams0.1
set services service-set BLAH next-hop-service outside-service-interface ams0.101
1
esseph_OPinsurance companies HATE him!!!•

I can't find the in AND out interface in any of the examples I've seen, just the in interface.

Welp, part of why this would suck is the outbound interface is actually OSPF ECMP, with two different providers fiber paths to the border router.

I'll try what you've got here, but that doesn't even look like you're using the MS-MPC at all.

edit: Another thing I noticed is you are NATing all traffic it looks like, based on the exclusion of firewall inet service filters. Also, you're using next-hop, I need inline :[

1