Thanks a lot, Alex. I really appreciate your help. I'm going to try it and tell you the result.
Kind regards Octavio On Tue, Jun 30, 2015 at 3:18 PM, Alexander Arseniev <[email protected] > wrote: > Hello, > You just need a MSDPC SFW rule to allow that, also explicit SFW rule is > required for other subs if You don't have any: > > set services stateful-f rule Allow-subs-2-inet match-direction input > set services stateful-f rule Allow-subs-2-inet term 1 then accept > > set services stateful-f rule Allow-fm-inet-2-subs match-direction output > set services stateful-f rule Allow-fm-inet-2-subs term 1 from > destination-address <your public sub IP here> > set services stateful-f rule Allow-fm-inet-2-subs term 1 then accept > > set services service-set <Your SVC-set processing public subs> > stateful-firewall-rules Allow-subs-2-inet > set services service-set <Your SVC-set processing public subs> > stateful-firewall-rules Allow-fm-inet-2-subs > > HTH > Thanks > Alex > > On 30/06/2015 10:48, Octavio Alfageme wrote: > > Hello everyone, > > We have a pretty academic next-hop style CGNAT (deterministic NAT) > configuration based on MS-DPCs in a couple of MX480s. In our case, the > incoming routing instance is a VRF and the outgoing one is the default > routing-instance (inet.0).'Behind' the MS-DPCs there are specific customers > with public IP addressing that, obviously, are not translated by means of > the right nat-rule configuration. Additionally, using rib-groups these > addresses are 'leaked' to the inet.0. > > With the described config everything works fine. Every customer 'behing' > the CGNAT has IP connectivity regardless he is NATed (customers with > private IP addressing) or he isn't NATed (customers with public IP > addressing), as far as they begin the IP communication from the CGNAT's > internal routing-instance. Some of these public IP address customers want > to be reachable from the internet and here comes my problem. This is not a > proper port-forwarding config as far as there is neither address nor port > translation. Could you, please, tell me what I must use to allow incoming > sessions from the default routing instance reach public IP addresses > connected to the CGNAT's internal routing instance traversing the MS-DPCs. > > Thanks in advance > > Kind regards > > Octavio > _______________________________________________ > juniper-nsp mailing list > [email protected]https://puck.nether.net/mailman/listinfo/juniper-nsp > > > _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
