oh ! I'm very tired. You are in right. I forgot the source nat rules, for my inside IPs @ (private @) I will config them tomorrow morning. But I can't understand why , from a node on the DMZ (193.48.41.194, a public @) I can't ping a node on internet. In fact, in a first time, I began to ping nodes on internet from the DMZ. The range 193.48.41.194/29 doesn't need source nat rule. Maybe this range is not routed by my provider. I must verify that ... but I don't think it's the good answer. I think I forgot something else in the SRX configuration.
Roland DROUAL ----- Mail Original ----- De: "Marco Nesler" <[email protected]> À: "roland droual" <[email protected]> Envoyé: Lundi 11 Juin 2012 21h57:04 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: {Disarmed} Re: [j-nsp] Problem to ping a node on internet can't see any nat rule, based on your config it seems you are triyng to reach the outside world with a private ip address.. 2012/6/11 roland DROUAL < [email protected] > Hello the List, I have a problem to ping a node on internet. From INSIDE network, I can ping a node on DMZ network. From DMZ network, I can ping a node on INSIDE network From the SRX650 , I can ping a node on INSIDE network, and a node on DMZ network. From the SRX650 , I can ping a node on internet, via OUTSIDE interface. For example, I can ping 23.45.160.170 (PS: 23.45.160.170 = www.cisco.com :-) I'm a little nostalgic ) But .... From a node on INSIDE network, or a node from DMZ network, I can't ping a node on internet; I can ping the OUTSIDE interface on SRX650 (195.221.125.206), but I can't ping the next-hop (195.221.125.205) for the default route. Can you help me ? Thanks for your help Roland DROUAL This is my config: ============================== ===== toto@AS-SRX650-01# run show configuration ... reth0 { description "TRUNK vers INTER-SITES et OUTSIDE"; vlan-tagging; redundant-ether-options { redundancy-group 1; } unit 201 { vlan-id 201; family inet { address MailScanner warning: numerical links are often malicious: 10.1.3.1/29 ; } } unit 955 { vlan-id 955; family inet { address MailScanner warning: numerical links are often malicious: 195.221.125.206/30 ; } } } reth1 { description "vers INSIDE"; vlan-tagging; redundant-ether-options { redundancy-group 1; } unit 100 { vlan-id 100; family inet { address MailScanner warning: numerical links are often malicious: 10.1.4.2/29 ; } } } reth2 { description "802.1Q vers DMZ1"; vlan-tagging; redundant-ether-options { redundancy-group 1; } unit 10 { vlan-id 10; family inet { address MailScanner warning: numerical links are often malicious: 193.48.41.193/29 ; } } } } routing-options { static { route MailScanner warning: numerical links are often malicious: 10.96.0.0/11 next-hop 10.1.4.1; route MailScanner warning: numerical links are often malicious: 10.192.0.0/11 next-hop 10.1.3.2; route MailScanner warning: numerical links are often malicious: 0.0.0.0/0 next-hop 195.221.125.205; } } security { nat { source { address-persistent; } } policies { from-zone OUTSIDE to-zone DMZ { policy allow-test { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone DMZ to-zone OUTSIDE { policy allow-test { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone INSIDE to-zone DMZ { policy allow-test { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone DMZ to-zone INSIDE { policy allow-test { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone INSIDE to-zone OUTSIDE { policy allow-test { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone OUTSIDE to-zone INSIDE { policy allow-test { match { source-address any; destination-address any; application any; } then { permit; } } } } zones { security-zone OUTSIDE { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { reth0.955; } } security-zone INSIDE { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { reth1.100; } } security-zone DMZ { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { reth2.10; } } } } {primary:node0}[edit] toto@AS-SRX650-01# ______________________________ _________________ juniper-nsp mailing list [email protected] https://puck.nether.net/ mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
