Problems with NAT on MX w/ MS-MPC-128 (xpost from /r/networking)
Hi all, I've been chugging through quite a few forum posts, mailing lists, and juniper tech pub documentation and I simply can't find where I'm going wrong. Current topology: WAN<----- border router (MX) -----><----- core router (mx, ms-mpc-128) -----> transport routers/switches (ex) OSPF running between the border, core, and transport, ae interfaces between core and transport. Here's my current config:
set services nat pool thing1 address xx.yy.196.3/32 set services nat rule cgnat match-direction input set services nat rule cgnat term THINGTONAT1 from source-address 100.64.1.0/24 set services nat rule cgnat term THINGTONAT1 from destination-address 0.0.0.0/0 set services nat rule cgnat term THINGTONAT1 then translated source-pool thing1 set services nat rule cgnat term THINGTONAT1 then translated translation-type dynamic-nat44 set services service-set cgnat nat-rules cgnat set services service-set cgnat interface-service service-interface ms-4/0/0 set chassis fpc 4 pic 0 inline-services bandwidth 20g set interfaces ms-4/0/0 unit 0 family inet set interfaces ae1 unit 0 family inet service input service-set cgnat service-filter sf-in set interfaces ae1 unit 0 family inet service output service-set cgnat service-filter sf-out set firewall family inet service-filter sf-in term 1 from source-address 100.64.0.0/10 set firewall family inet service-filter sf-in term 1 from destination-address 0.0.0.0/0 set firewall family inet service-filter sf-in term 1 from destination-address 100.64.0.0/10 except set firewall family inet service-filter sf-in term 1 then count sf-in-filter-nat-traffic set firewall family inet service-filter sf-in term 1 then service set firewall family inet service-filter sf-in term 2 then skip set firewall family inet service-filter sf-out term 1 then count sf-out-filter-excluded-from-nat set firewall family inet service-filter sf-out term 1 then skip Traffic seems to make it up the chain then drops at the border router. It's like it's not being NAT'd, but the counters seem to show otherwise. Any tips? Thanks (EDIT: Cleaning up formatting)
Posted Jul 12, 2016, 8:26 PM UTC
Does the border router have a route back to the pool subnet on the core router?
It does not actually, and that's an area I've been wondering about.
I can actually "touch" that router behind the nat, though I get nothing in show services nat *, which makes me think something isn't working, despite counters for the NAT matching increasing.
I would fix that issue otherwise how will any return traffic get back to the NAT pool? Additionally, if your WAN router doesn't have a route back to the pool, how can it advertise the pool to the WAN?
First thing first, NAT itself isn't working. This is proven by the ability of ICMP traffic behind the "NAT" to traverse the core and hit loopbacks on the border router as well as multiple border router wan interfaces. Despite incrementing the "nat hit" counters, for whatever reason the ms interface isn't actually translating the traffic.
Secondly, I can't find an example of how to pull this off in juniper land. Simply inject an ip or the range itself into ospf i would assume. I'll look into that.
You could use this page as an example for your configs:
http://www.juniper.net/documentation/en_US/junos15.1/topics/example/nat-nat44-config-ms-mpc.html
Instead of using the ALGs in the firewall filter though, just accept all traffic to make things easier for right now.
Something like:
set services stateful-firewall rule snatr1 match-direction input
set services stateful-firewall rule snatr1 term t1 from source-address any-unicast
set services stateful-firewall rule snatr1 term t1 then accept
Can you just use a static route on the border router pointing back to the core for the NAT pool for right now? I'd keep things simple until you're able to see the NAT sessions being built.
You should be able to monitor pool usage http://www.juniper.net/techpubs/en_US/junos15.1/topics/task/verification/nat-pool-usage-monitoring.html
Additionally I believe you should see the sessions if you do a show services stateful-firewall flows