are you using routing instance?
On Sat, Sep 8, 2012 at 11:01 AM, Patrick Dickey <[email protected]>wrote: > I'm a little confused here. Where does the 192.168.17.16 network reside? > > The static NAT will only NAT the 192.168.35.200 IP when its initiating > traffic to the FROM zone in the static NAT configuration, not just > generally. > What does a flow from the 192.168.32.x/24 network look like when trying to > get to the 192.168.35.200 (or 192.168.32.5). How about in the reverse? > > Patrick > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Oliver Garraux > Sent: Friday, September 07, 2012 5:08 PM > To: Brent Jones > Cc: [email protected] > Subject: Re: [j-nsp] SRX Static NAT - Not working in both directions > > Brent, Patrick, > > Thanks for the replies. > > When I change the rule-set to apply to traffic from the user zone, I'm > seeing the same behavior. The source address on traffic from the desktop > (192.168.35.200) out to the rest of the network isn't being NAT'ed. I also > can't initiate connections to 192.168.32.5 from the rest of my network. > > I've also tried putting both the user and trust zones in the rule-set. > In that scenario, I can connect to 192.168.32.5 from outside, but the > outgoing traffic from 192.168.35.200 still isn't NAT'ed. > > Thanks, > > Oliver > > ------------------------------------- > > Oliver Garraux > Check out my blog: www.GetSimpliciti.com/blog Follow me on Twitter: > twitter.com/olivergarraux > > > On Fri, Sep 7, 2012 at 5:34 PM, Brent Jones <[email protected]> wrote: > > Try to apply the static NAT policy to zone 'user' and see how that goes. > > > > On Fri, Sep 7, 2012 at 12:22 PM, Oliver Garraux <[email protected]> > wrote: > >> Hey, > >> > >> I recently bought an SRX and have been trying the different NAT > >> configuration options to become more familar with JunOS. > >> > >> Static NAT isn't operating quite as I'd expect from the documentation. > >> My understanding is that static NAT should be bidirectional, in that > >> it should translate connections going in both directions. > >> > >> I'm using 192.168.32.0/24 on the interface connected to the rest of > >> my network (ge-0/0/0.100), and 192.168.35.0/24 on vlan.200 on my SRX. > >> ge-0/0/0.100 is in the "trust" zone, and vlan.200 is in the "user" > >> zone. > >> > >> static { > >> rule-set user_to_trust { > >> from zone trust; > >> rule desktop1 { > >> match { > >> destination-address 192.168.32.5/32; > >> } > >> then { > >> static-nat prefix 192.168.35.200/32; > >> } > >> } > >> } > >> } > >> proxy-arp { > >> interface ge-0/0/0.100 { > >> address { > >> 192.168.32.5/32; > >> } > >> } > >> } > >> > >> > >> I'm only seeing it translate connections coming in to the destination > >> address (192.168.32.5). The source address on connections initiated > >> by the "static-nat" address (192.168.35.200 - the address on the > >> desktop sitting behind my SRX) are not being translated to > >> 192.168.32.5. Am I misunderstanding how static NAT works? > >> > >> I've tried using an IP that is routed to the SRX (where no proxy-arp > >> should have been required in that situation). I also don't see the > >> address being translated when I look at these flows in "show security > >> flow session", so I don't think this is an issue with proxy-arp. I'm > >> permitting all traffic between the "user" and "trust" zones (in both > >> directions) in my security policies. > >> > >> Here's one of the flow entries when I try to ping from 192.168.35.200 > >> to 192.168.17.16 > >> > >> Session ID: 21626, Policy name: permit-all/5, Timeout: 16, Valid > >> In: 192.168.35.200/25622 --> 192.168.17.16/1280;icmp, If: vlan.200, > >> Pkts: 1, Bytes: 60 > >> Out: 192.168.17.16/1280 --> 192.168.35.200/25622;icmp, If: > >> ge-0/0/0.100, Pkts: 0, Bytes: 0 > >> > >> Any ideas? > >> > >> Thanks, > >> > >> Oliver > >> > >> ------------------------------------- > >> > >> Oliver Garraux > >> Check out my blog: www.GetSimpliciti.com/blog Follow me on Twitter: > >> twitter.com/olivergarraux > >> _______________________________________________ > >> juniper-nsp mailing list [email protected] > >> https://puck.nether.net/mailman/listinfo/juniper-nsp > > > > > > > > -- > > Brent Jones > > [email protected] > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
