Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Wed Jan 18, 2017 7:42 pm


Author Message
debuser
  Post  Post subject: Juniper SRX - How to perform source nat on Junos self originated packets - Junos 11.4  |  Posted: Sun Jun 03, 2012 3:46 pm

Joined: Thu Aug 06, 2009 2:48 am
Posts: 105

Offline
 

Juniper SRX - How to perform source nat on Junos self originated packets - Junos 11.4

In Junos version 11.4, a new security zone junos-host was added to match to/from Junos self-traffic device.

Few details here: https://cn.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/release-notes/11.4/index.html?topic-62163.html

How to do source nat for Junos self originated packets - Junos 11.4

Assuming the security zone matching Internet zone is called internet in our Junos configuration, source nat from Junos originated packets towards internet can be achieved using following config:

Code:
> show configuration security nat source rule-set self-internet                 
from zone junos-host;
to zone internet;
rule RE-internet {
    match {
        source-address 0.0.0.0/0;
    }
    then {
        source-nat {
            interface;
        }
    }
}


Same can be achieved using commands:
Code:
> show configuration security nat source rule-set self-internet | display set   
set security nat source rule-set self-internet from zone junos-host
set security nat source rule-set self-internet to zone internet
set security nat source rule-set self-internet rule RE-internet match source-address 0.0.0.0/0
set security nat source rule-set self-internet rule RE-internet then source-nat interface


P.S.: Default configurations will not need source nat as Junos, by default, uses the IP of the outgoing interface as source. But for those rare cases when source nat is really needed, this will help.





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Juniper SRX - How to perform source nat on Junos self originated packets - Junos 11.4"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Juniper SRX NAT64 behavior in relation to DF (Don’t Fragment) bit on incoming IPv4 packets

admin

0

294

Thu Mar 10, 2016 11:31 am

admin View the latest post

There are no new unread posts for this topic. Juniper SRX testcase - How to block TCP SYN packets with data/segment bytes (strict-syn-check)

admin

0

929

Tue Jun 19, 2012 8:38 am

admin View the latest post

There are no new unread posts for this topic. Junos 11.4 - SRX flow mode - traffic destined for loopback lo0 interface

mandrei99

0

2764

Thu May 30, 2013 9:20 am

mandrei99 View the latest post

There are no new unread posts for this topic. BGP Blackhole (RTBH) with Juniper SRX firewall

mandrei99

0

2355

Thu May 29, 2014 6:45 am

mandrei99 View the latest post

There are no new unread posts for this topic. Juniper SRX firewall debug: packet dropped: for self but not interested

admin

0

1461

Mon Jun 23, 2014 3:52 am

admin View the latest post

There are no new unread posts for this topic. Juniper SRX NAT64 static-nat inet impacts non-nat IPv4 traffic

admin

2

447

Wed May 11, 2016 9:15 pm

admin View the latest post

There are no new unread posts for this topic. Configuring and verifying unicast reverse path filter (uRPF) on Juniper SRX

admin

1

2059

Fri Feb 01, 2013 12:09 pm

admin View the latest post

There are no new unread posts for this topic. Juniper SRX packet mode switch back to flow mode (verification)

mandrei99

1

2835

Tue May 28, 2013 11:10 am

mandrei99 View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO