4

I'm having issues setting up the Source NAT on my SRX300 firewall. The firewall is connected to an LC-panel through a fibre optic cable in port 0/6. I have set the public ip on that interface and have configured the dns-servers and default gateway. Additionally I have a DHCP server running on Port 0/3. The SRX has a connection and can ping remote hosts, and connecting a device to Port 0/3 will give it an IP address from the Pool. The devices on Port 3 can ping the SRX but can not reach the public internet and I believe I'm missing something in my source NAT config.

Here is my nat security (203.0.113.192/30 being a stand in for my public IP):

security {
    nat {
        source {
            pool src-nat-pool-1 {
                address {
                    203.0.113.192/30;
                }
            }
            rule-set rs1 {
                from zone trust;
                to zone untrust;
                rule r1 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            pool {
                                src-nat-pool-1;
                            }
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
            policy internet-access {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/2.0;
                ge-0/0/3.0;
                ge-0/0/4.0;
                ge-0/0/5.0;
                ge-0/0/6.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
        }
        security-zone untrust {
            screen untrust-screen;
        }
    }
}

And the relevant interfaces are configured as follows:

interfaces {
    ge-0/0/3 {
        unit 0 {
            family inet {
                address 192.168.3.1/24;
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family inet {
                address 203.0.113.192/30;
            }
        }
    }
}

Sadly I can't even seem to get any translation hits.

2

Hello and welcome to NetworkEngineering!

  1. Change your source-nat pool... to source-nat interface in SNAT config.

  2. Remove interface ge-0/0/6.0 from trust zone to untrust.

[edit]

delete security nat source rule-set rs1 rule r1 then source-nat
set security nat source rule-set rs1 rule r1 then source-nat interface

delete security zones security-zone trust interfaces ge-0/0/6.0
set security zones security-zone untrust interfaces ge-0/0/6.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.