Great, thanks Alex. When I get this working I'll post a working configuration for anyone searching for this ;-)
On Jan 17, 2012, at 8:27 PM, Alex Arseniev wrote: > The link You supplied is for JUNOSE, not JUNOS. > If you have 100s of users and 1s of public IPs means You need NAPT44. > The way to use PPTP through NAPT44 on JUNOS is to activate PPTP ALG (more > specifically, match on application "junos-pptp" in NAT rule or SFW rule) and > PPTP ALG ALG is supported from JUNOS 11.2R1. > HTH > Rgds > Alex > > ----- Original Message ----- > From: Jo Rhett > To: Alex Arseniev > Cc: [email protected] > Sent: Tuesday, January 17, 2012 7:09 PM > Subject: Re: [j-nsp] PPTP VPN through NAT on M10i > > Does that mean that it is supported from 11.2R1 up, or does that mean it's > never supported this way? Did I misread this page, which says that outside > source dynamic nat is supported? > > https://www.juniper.net/techpubs/en_US/junose10.1/information-products/topic-collections/swconfig-ip-services/id-67401.html > > Is there any way to do this without 1:1 static mapping? This site has very > few external addresses, and hundreds of internal users. Mapping each > possible VPN user to a static external IP is not possible here. It's > possible I'm just implementing this the wrong way... > > On Jan 16, 2012, at 11:33 PM, Alex Arseniev wrote: >> PPTP ALG is supported from JUNOS 11.2R1 >> GRE is not supported with "nat source dynamic" >> HTH >> Rgds >> Alex >> >> ----- Original Message ----- From: "Jo Rhett" <[email protected]> >> To: <[email protected]> >> Sent: Tuesday, January 17, 2012 3:19 AM >> Subject: [j-nsp] PPTP VPN through NAT on M10i >> >> >> I've got a problem with NAT on an M10i with Junos 10.4. Simple PNAP >> interface, works fine for TCP and UDP. Doesn't work for PPTP or IPSEC. Way >> back in my mind I remember something about having to create a second nat >> rule without port mapping, but its not working. I'm pretty sure I'm >> forgetting something here. Can someone spare a 2x4 and clue me over the >> head? >> >> ---yes, I know that the filters in the configuration below aren't active. >> >> Here's the configuration now: >> >> interfaces { >> ge-0/0/0 { >> unit 0 { >> family inet { >> address 192.168.1.1/24; >> } >> } >> } >> ge-0/1/0 { >> unit 0 { >> family inet { >> service { >> input { >> service-set NAT; >> } >> output { >> service-set NAT; >> } >> } >> address 192.168.2.1/24; >> } >> } >> } >> sp-0/3/0 { >> unit 0 { >> family inet; >> } >> } >> >> …. >> >> firewall { >> filter UNTRUST-IN { >> term ICMP { >> from { >> destination-address { >> 192.168.2.1/4; >> } >> protocol icmp; >> } >> then accept; >> } >> term EVERYTHING-ELSE { >> then { >> discard; >> } >> } >> } >> filter TRUST-OUT { >> term IPOUT { >> from { >> source-address { >> 192.168.1.0/24; >> } >> destination-address { >> 0.0.0.0/0; >> } >> } >> then accept; >> } >> } >> } >> services { >> service-set NAT { >> nat-rules Outbound; >> interface-service { >> service-interface sp-0/3/0.0; >> } >> } >> nat { >> pool NATPOOL { >> address 192.168.2.3/32 >> port { >> automatic; >> } >> } >> pool GRE-NATPOOL { >> address 192.168.2.3/32 >> } >> rule Outbound { >> match-direction output; >> term PPTP_VPNs { >> from { >> source-address { >> 192.168.1.0/24; >> } >> applications GRE-PPTP; >> } >> then { >> translated { >> source-pool GRE-NATPOOL; >> translation-type { >> source dynamic; >> } >> } >> } >> } >> term Else { >> from { >> source-address { >> 192.168.1.0/24; >> } >> } >> then { >> translated { >> source-pool NATPOOL; >> translation-type { >> source dynamic; >> } >> } >> } >> } >> } >> } >> adaptive-services-pics { >> traceoptions { >> flag all; >> } >> } >> } >> applications { >> application GRE-PPTP { >> protocol gre; >> } >> } >> >> -- >> Jo Rhett >> Net Consonance : consonant endings by net philanthropy, open source and >> other randomness >> >> _______________________________________________ >> juniper-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/juniper-nsp >> > > -- > Jo Rhett > Net Consonance : consonant endings by net philanthropy, open source and other > randomness -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
