2

I have a SRX 220 cluster running Junos 12.1XD46-D30.2. My ISP provides me with a /27 public IP range. Lets say 80.0.0.64/27

The way this is configured is that they use the first two available IP addresses for a VRRP redundant router setup. These are our default gateway IP addresses.

I have configured my SRX interface reth0.0 to use the IP address 80.0.0.71/27

Network overview


Question

How can I place a device in a DMZ zone that has the IP address 80.0.0.90?


What have I tried?


Config 1:

reth0.0 configured as 80.0.0.71/27 in zone untrust
reth1.110 configured as 80.0.0.89/30 in zone DMZ
SRX has the default gateway of 80.0.0.65
server configured as 80.0.0.90/30 with it's gateway as 80.0.0.89

Tests/Results:

  1. SRX can ping the server and vice versa
  2. server can't ping the SRX's default gateway 80.0.0.65
  3. When I ping the server (.90) from a remote device I see ARP requests for 80.0.0.90 from our providers gateway 80.0.0.65 but I don't see the SRX sending back any replies
  4. When I ping the SRX reth1.110 (.89) address from a remote device I also see ARP requests from our providers gateway 80.0.0.65. I sdon't see the SRX sending back any replies

Like this capture of traffic from the reth0.0 interface (via switch port mirror)

13:03:31.967949 arp who-has 80.0.0.89 tell 80.0.0.65
13:03:35.612408 arp who-has 80.0.0.90 tell 80.0.0.65

This shows me clearly that the SRX will not send ARP replies on behalf of it's smaller /30 subnet residing on a different interface (reth1.110) out of it's reth0.0 interface.

I thought that this could be a good reason to use the proxy arp settings under security > nat > proxy-arp

Checking the routing table shows that my traffic is routed to the correct interface so it isn't that

inet.0: 258 destinations, 267 routes (258 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

80.0.0.88/30     *[Direct/0] 00:44:23
                  > via reth1.110

Config 2:

same as config 1 with the following additions

set security nat proxy-arp interface reth0.0 address 80.0.0.88/30

Tests/Results:

  1. SRX can ping the server and vice versa
  2. server can't ping the SRX's default gateway 80.0.0.65, however I now see ICMP traffic leaving the SRX on the external interface heading for 80.0.0.65. I also see that 80.0.0.65 is just sending ARP requests back which are going unanswered by the SRX.
13:17:30.182718 IP 80.0.0.90 > 80.0.0.65: ICMP echo request, id 9514, seq 1, length 64
13:17:30.183316 arp who-has 80.0.0.90 tell 80.0.0.65
13:17:31.240008 IP 80.0.0.90 > 80.0.0.65: ICMP echo request, id 9514, seq 2, length 64
13:17:32.240342 IP 80.0.0.90 > 80.0.0.65: ICMP echo request, id 9514, seq 3, length 64
13:17:32.240990 arp who-has 80.0.0.90 tell 80.0.0.65
13:17:33.239726 IP 80.0.0.90 > 80.0.0.65: ICMP echo request, id 9514, seq 4, length 64
13:17:34.239860 IP 80.0.0.90 > 80.0.0.65: ICMP echo request, id 9514, seq 5, length 64
13:17:34.240758 arp who-has 80.0.0.90 tell 80.0.0.65
  1. When I ping the server (.90) from a remote device I see ARP requests for 80.0.0.90 from our providers gateway 80.0.0.65 but I don't see the SRX sending back any replies
  2. When I ping the SRX reth1.110 (.89) address from a remote device I also see ARP requests from our providers gateway 80.0.0.65. I sdon't see the SRX sending back any replies

It looks like the SRX is still not sending ARP replies on behalf on it's /30 subnet and now my routing table looks a little different which I assume is down to the proxy arp config entry.

inet.0: 258 destinations, 268 routes (258 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

80.0.0.88/30       *[Direct/0] 00:58:45
                    > via reth1.110
                    [Static/1] 00:08:33
                      Receive

Config 3:

this time I changed the proxy arp statement so that it just covered the server IP address

set security nat proxy-arp interface reth0.0 address 80.0.0.90/32

[edit security nat proxy-arp interface reth0.0 address]
+      80.0.0.90/32;
-      80.0.0.88/30;

Tests/Results:

  1. SRX can NOT ping the server and vice versa
# run ping 80.0.0.90
PING 80.0.0.90 (80.0.0.90): 56 data bytes
ping: sendto: Can't assign requested address
ping: sendto: Can't assign requested address

--- 80.0.0.90 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss

looking at the routing table on the SRX now shows this entry

inet.0: 259 destinations, 268 routes (259 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

80.0.0.90/32       *[Static/1] 00:00:29
                      Receive
  1. When I ping the server (.90) from a remote device I see ARP requests for 80.0.0.90 from our providers gateway 80.0.0.65 and now I see ARP replies
13:23:59.327903 arp who-has 80.0.0.90 tell 80.0.0.65
13:23:59.333994 arp reply 80.0.0.90 is-at 00:00:00:ff:b0:00
  1. When I ping the SRX reth1.110 (.89) address from a remote device I see ARP requests from our providers gateway 80.0.0.65. I don't see the SRX sending back any replies

Now it looks like the SRX is sending ARP replies but can't actually route the traffic to the correct interface due to the proxy arp entry/routing rule.


Interesting if I now revert the convert back to the original because the upstream router has cached our ARP entry for 80.0.0.90 everything works until it times out.

I will post this now while I wait for the ARP entry to timeout (hopefully not 4 hours!!).

Does anyone know what I'm missing?

Normally this isn't so hard as your ISP gives you a /30 PTP link between them and you and then they just route all traffic down that link leaving you free to do whatever!

  • Do you have intra-zone policy defined? – Ippy Aug 19 '15 at 16:07
  • I have policies defined that allow any traffic from my remote test machine coming from untrust (reth0.0) to the server in the DMZ zone (reth1.110). Then all traffic allowed from the server in the DMZ zone (reth1.110) to any address in the untrust zone (reth0.0). – Gareth Hastings Aug 19 '15 at 19:08
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 4:57
2

I think with the way you are going about this with routing is always going to run into a problem. Since the subnet with the provider is 80.0.0.64 - 80.0.0.95 and you want to use .90 in another subnet that is behind the SRX you are going to run into either arp issues with the ISP or routing issues. When the ISP routers want to talk with .90 they always assume based on the subnet that is is layer 2 adjacent. As you said you are able to proxy arp, then remove the arp and it works till the ISP router arp table times out.

So I think you are going to be forced to use a static source nat with a proxy-arp with the way you have it now.

If you just want to be able to apply security policies between the server and the internet you can actually just run some of the the SRX interfaces in a layer 2 mode. That way you can put 2 interfaces in the same VLAN/bridge but in different security zones. That way you can write policies between the zones and still have that .90 address directly on that server.

http://www.juniper.net/documentation/en_US/junos12.1/topics/example/security-zone-layer2-configuring.html

Otherwise you will need to work with your ISP to get that block routed to your SRX and have another subnet between the SRX and the ISP router. This is the ideal solution in my opinion.

  • static NAT doesn't work. I had looked at doing a bridged interface but I need to go to the remote site to move some cables around and haven't had chance to do this. I think what I'll do is ask the ISP to route traffic to the second subnet via my gateway. Thanks – Gareth Hastings Sep 9 '15 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.