Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Wed May 24, 2017 1:10 pm


Author Message
debuser
  Post  Post subject: Juniper SRX - How to perform source nat on Junos self originated packets - Junos 11.4  |  Posted: Sun Jun 03, 2012 3:46 pm

Joined: Thu Aug 06, 2009 2:48 am
Posts: 105

Offline
 

Juniper SRX - How to perform source nat on Junos self originated packets - Junos 11.4

In Junos version 11.4, a new security zone junos-host was added to match to/from Junos self-traffic device.

Few details here: https://cn.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/release-notes/11.4/index.html?topic-62163.html

How to do source nat for Junos self originated packets - Junos 11.4

Assuming the security zone matching Internet zone is called internet in our Junos configuration, source nat from Junos originated packets towards internet can be achieved using following config:

Code:
> show configuration security nat source rule-set self-internet                 
from zone junos-host;
to zone internet;
rule RE-internet {
    match {
        source-address 0.0.0.0/0;
    }
    then {
        source-nat {
            interface;
        }
    }
}


Same can be achieved using commands:
Code:
> show configuration security nat source rule-set self-internet | display set   
set security nat source rule-set self-internet from zone junos-host
set security nat source rule-set self-internet to zone internet
set security nat source rule-set self-internet rule RE-internet match source-address 0.0.0.0/0
set security nat source rule-set self-internet rule RE-internet then source-nat interface


P.S.: Default configurations will not need source nat as Junos, by default, uses the IP of the outgoing interface as source. But for those rare cases when source nat is really needed, this will help.





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Juniper SRX - How to perform source nat on Junos self originated packets - Junos 11.4"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Juniper SRX NAT64 behavior in relation to DF (Don’t Fragment) bit on incoming IPv4 packets

admin

0

429

Thu Mar 10, 2016 11:31 am

admin View the latest post

There are no new unread posts for this topic. Juniper SRX testcase - How to block TCP SYN packets with data/segment bytes (strict-syn-check)

admin

0

1058

Tue Jun 19, 2012 8:38 am

admin View the latest post

There are no new unread posts for this topic. Junos 11.4 - SRX flow mode - traffic destined for loopback lo0 interface

mandrei99

0

3068

Thu May 30, 2013 9:20 am

mandrei99 View the latest post

There are no new unread posts for this topic. BGP Blackhole (RTBH) with Juniper SRX firewall

mandrei99

0

2966

Thu May 29, 2014 6:45 am

mandrei99 View the latest post

There are no new unread posts for this topic. Juniper SRX firewall debug: packet dropped: for self but not interested

admin

0

1701

Mon Jun 23, 2014 3:52 am

admin View the latest post

There are no new unread posts for this topic. Juniper SRX NAT64 static-nat inet impacts non-nat IPv4 traffic

admin

2

613

Wed May 11, 2016 9:15 pm

admin View the latest post

There are no new unread posts for this topic. Configuring and verifying unicast reverse path filter (uRPF) on Juniper SRX

admin

1

2505

Fri Feb 01, 2013 12:09 pm

admin View the latest post

There are no new unread posts for this topic. Juniper SRX packet mode switch back to flow mode (verification)

mandrei99

1

3066

Tue May 28, 2013 11:10 am

mandrei99 View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO