4

Background

I have the following config which uses lt interfaces to route traffic between 2 routing instances (default and a custom one called vpn).

The reason I do this is so that I can have overlapping IP ranges/subnets and just use destination NAT to get round it.

My test device is an SRX 100 and is has the following local IP's

fe-0/0/0.0   - 1.1.1.1/30            - Overlapping IP range
fe-0/0/1.0   - 192.168.218.240/24    - IPSEC to another firewall on 192.168.218.1
fe-0/0/7.0   - 10.10.10.1/24         - Internal LAN
lt-0/0/0.101 - 10.77.77.101/30       - Attached to default routing instance
lt-0/0/0.102 - 10.77.77.102/30       - Attached to VPN routing instance
st0.100      - 10.255.0.100/32       - IPSEC tunnel to remote device

I have a test computer (A) sitting on 10.10.10.2/24 and a test firewall connected via fe-0/0/1.0 on 192.168.218.1

I have an IPSEC tunnel between the two devices, it's a simple route based tunnel that works fine. The issue is that I need to get to the remote devices on the network 1.1.1.0/30 which overlaps with my network on fe-0/0/0.0. Unfortunately it's not an option to re-IP it as this is just a test lab, I have a larger device with 100+ VPN's and lots of overlapping networks that I don't control.

The config I built basically does destination NAT for 2.2.2.0/30 -> 1.1.1.0/30. To get the traffic to route correctly I have a route in my default routing instance that looks like this

inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

2.2.2.0/30         *[Static/5] 00:31:48
                    > to 10.77.77.102 via lt-0/0/0.101

The nice thing about this is that any traffic routed via the lt interface causes it to hit my NAT rule and the perform a route lookup in my vpn routing instance which then routes the traffic out of the tunnel interface.

Total destination-nat rules: 1
Total referenced IPv4/IPv6 ip-prefixes: 1/0

Destination NAT rule: DNAT-1               Rule-set: t
  Rule-Id                    : 1
  Rule position              : 1
  From routing instance      : vpn
    Destination addresses    : 2.2.2.0         - 2.2.2.3


vpn.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.0/30         *[Static/5] 05:04:34
                    > via st0.100
10.10.10.0/24      *[Static/5] 00:34:52
                    > to 10.77.77.101 via lt-0/0/0.102

This means I can ping 2.2.2.1 from my computer (10.10.10.2) and it will flow correctly through both routing tables via the lt interface and down the tunnel to the remote overlapping network.

Jul 31 17:05:28  Gareth-FW RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.10.10.2/1->2.2.2.1/21042 icmp 10.10.10.2/1->2.2.2.1/21042 None None 1 allow_all(global) trust trust 8502 N/A(N/A) fe-0/0/7.0 UNKNOWN UNKNOWN UNKNOWN
Jul 31 17:05:28  Gareth-FW RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.10.10.2/1->2.2.2.1/21042 icmp 10.10.10.2/1->1.1.1.1/21042 None DNAT-1 1 allow_all(global) vpn vpn 8503 N/A(N/A) lt-0/0/0.102 UNKNOWN UNKNOWN UNKNOWN

Finally the actual question

This all works great on my test SRX 100. I would now like to deploy it to my SRX 240 cluster running JUNOS 12.1X46-D10.2 and I instantly find that you can't have an lt interface!

Is there a way I can replicate this config using some other interface or method to route my traffic? I would like to avoid using a physical interface if possible.

Thanks

SRX Config

I've left out the IPSEC config as it's just a simple config

root@Gareth-FW# show interfaces
fe-0/0/0 {
    unit 0 {
        family inet {
            address 172.30.1.100/24 {
                preferred;
            }
            address 1.1.1.1/30;
        }
    }
}
lt-0/0/0 {
    unit 101 {
        encapsulation ethernet;
        peer-unit 102;
        family inet {
            address 10.77.77.101/30;
        }
    }
    unit 102 {
        encapsulation ethernet;
        peer-unit 101;
        family inet {
            address 10.77.77.102/30;
        }
    }
}
fe-0/0/1 {
    unit 0 {
        family inet {
            address 192.168.218.240/24;
        }
    }
}
fe-0/0/7 {
    unit 0 {
        family inet {
            address 10.10.10.1/24;
        }
    }
}
st0 {
    unit 100 {
        family inet {
            address 10.255.0.100/32;
        }
    }
}

root@Gareth-FW# show routing-options
static {
    route 2.2.2.0/30 next-hop 10.77.77.102;
}

root@Gareth-FW# show routing-instances
vpn {
    instance-type virtual-router;
    interface lt-0/0/0.102;
    interface lo0.101; ## 'lo0.101' is not defined
    interface st0.100;
    routing-options {
        static {
            route 1.1.1.0/30 next-hop st0.100;
            route 10.10.10.0/24 next-hop 10.77.77.101;
        }
        router-id 10.200.0.2;
    }
}

root@Gareth-FW# show security nat
destination {
    pool test {
        address 1.1.1.0/30;
    }
    rule-set t {
        from routing-instance vpn;
        rule DNAT-1 {
            match {
                destination-address 2.2.2.0/30;
            }
            then {
                destination-nat {
                    pool {
                        test;
                    }
                }
            }
        }
    }
}
4
  • Hang on...let's take a step back. What are you seeing that indicates that you can't have lt- interfaces on an SRX240? Is it something to do with the clustering? 'Cause I'm pretty sure the 240 in general is just as capable (if not moreso than the 100) of doing lt- interfaces. What error are you seeing when you try to commit it? Jul 31, 2014 at 17:28
  • You can configure a lt interface on the cluster and it will commit. It just doesn't appear in the interfaces list {primary:node0} gareth@FW01> show interfaces lt-0/0/0.101 error: device lt-0/0/0 not found {primary:node0} gareth@FW01> show interfaces lt-0/0/0 error: device lt-0/0/0 not found Jul 31, 2014 at 17:54
  • See kb.juniper.net/InfoCenter/… Jul 31, 2014 at 20:10
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10, 2017 at 4:57

1 Answer 1

2

One way would to to use a physical loopback cable and run a /30 or/31 over that. Downside is you lose 2x revenue ports

@Jeff, you'll find that the LT interface is an internal only port not associated with any PIMs etc hence why you can't use it in a cluster.

EDIT: If you do go the physical link route; I suggest you do one per chassis and run it in a RETH ( it should work )

4
  • Yeah, I saw the information on it not being supported on a cluster. I figured it'd be handled like a loopback...moving with redundancy group 0 (or perhaps defined to be part of a different RG). I guess I've never had reason to use an lt on a cluster. Always good to pick up new tidbits of info. Aug 1, 2014 at 14:12
  • Yeah however the loopback is a different kettle of fish since it is the path to the RE. I suspect that the reason also is why the SRX110H cannot cluster (unless this has changed)
    – nzspambot
    Aug 2, 2014 at 6:26
  • Thanks, I thought physical might be the only way to go and wanted to avoid it if possible. I have been trying to get it to work using two logical interfaces on one of the existing physical interfaces. I can't seem to get it to work though, I even tried creating a GRE tunnel between the two logical interfaces but I can't get it to come up. Probably isn't designed to work like that! I wonder if there is a different way to go about this issue Aug 2, 2014 at 8:24
  • The other thing you could try off the top of my head is to leak a /32 between instances and run BGP between them. I don't know if a P2P OSPF would work but BGP should work. I think I might have done this in the past but can't recall sorry. You can add a static route and set the nexthop as a inet/table: me@srx001# set routing-options static route 1.2.3.4/32 next-table VRF.inet.0
    – nzspambot
    Aug 4, 2014 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.