5

I have about 4 different subnetworks at my place, when i'm trying to ping to static device in subnetwork1 from subnetwork2 i always see that device pings, even if it's off. I assume my SRX300 answers ICMP requests instead of forwarding them to specific subnetwork. I had no same issue in EdgeMAX, which i were using before.

How to make SRX not intercept ICMP requests to different devices than himself?

Config:

version 15.1X49-D170.4;
system {    
    root-authentication {
        encrypted-password ""; ## SECRET-DATA
    }
    name-server {
        8.8.8.8;
        8.8.4.4;
        1.1.1.1;
        1.0.0.1;
    }
    login {
        .......
    }
    services {
        ssh {
            root-login deny;
            protocol-version v2;
        }
        netconf {
            ssh;
        }
        dns {
            dns-proxy {
                propogate-setting enable;
                interface {
                    ae0.5;
                    ae0.11;
                    ae0.12;
                    ae0.22;
                    ae0.23;
                }
                default-domain main {
                    forwarders {
                        8.8.8.8;
                        8.8.4.4;
                        1.0.0.1;
                        1.1.1.1;
                    }
                }
            }
        }
        dhcp-local-server {
            group CORP {
                interface ae0.11;
            }
            group PBX {
                interface ae0.22;
            }
        }
        web-management {
            https {
                system-generated-certificate;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        boot-server 91.206.16.3;
        server 185.102.185.102;
        source-address 10.33.11.1;
        source-address 10.41.22.1;
        source-address 10.42.23.1;
    }
}
chassis {
    aggregated-devices {
        ethernet {
            device-count 4;
        }
    }
}
security {
    log {
        mode stream;
        report;
    }
    address-book {
        global {
            ......
        }
    }
    flow {
        allow-dns-reply;
        tcp-mss {
            all-tcp {
                mss 1452;
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            .....
        }
        static {
            .....
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            .....
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                    ntp;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ae0.11;
                ae0.5;
                ae0.22;
                ae0.23;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/7.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            tftp;
                        }
                    }
                }
                ge-0/0/6.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            tftp;
                            http;
                            https;
                            telnet;
                        }
                    }
                }
                pp0.0;
            }
        }
    }
}
interfaces {
    ge-0/0/0 {
        gigether-options {
            802.3ad ae0;
        }
    }
    ge-0/0/1 {
        gigether-options {
            802.3ad ae0;
        }
    }
    ge-0/0/2 {
        gigether-options {
            802.3ad ae0;
        }
    }
    ge-0/0/3 {
        gigether-options {
            802.3ad ae0;
        }
    }
    ge-0/0/5 {
        unit 0 {
            family inet {
                address 172.16.16.1/24;
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family inet {
                address 192.168.8.8/24;
            }
        }
    }
    ge-0/0/7 {
        mac 00:00:00:00:00:00;
        unit 0 {
            encapsulation ppp-over-ether;
        }
    }
    ae0 {
        vlan-tagging;
        aggregated-ether-options {
            lacp {
                active;
                periodic fast;
            }
        }
        unit 5 {
            vlan-id 5;
            family inet {
                address 10.5.5.1/24;
            }
        }
        unit 11 {
            vlan-id 11;
            family inet {
                address 10.33.11.1/24;
            }
        }
        unit 12 {
            vlan-id 12;
            family inet {
                address 172.17.17.1/24;
            }
        }
        unit 22 {
            vlan-id 22;
            family inet {
                address 10.41.22.1/24;
            }
        }
        unit 23 {
            vlan-id 23;
            family inet {
                address 10.42.23.1/24;
            }
        }
    }
    pp0 {
        unit 0 {
            .....
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 {
            next-hop pp0.0;
            preference 5;
        }
    }
}
protocols {
    l2-learning {
        global-mode switching;
    }
    rstp {
        interface all;
    }
}
access {
    address-assignment {
        pool CORP {
            family inet {
                network 10.33.11.0/24;
                range r1 {
                    low 10.33.11.201;
                    high 10.33.11.254;
                }
                dhcp-attributes {
                    name-server {
                        10.33.11.1;
                    }
                    router {
                        10.33.11.1;
                    }
                    propagate-settings irb.11;
                }
            }
        }
        pool PBX {
            family inet {
                network 10.41.22.0/24;
                range r1 {
                    low 10.41.22.201;
                    high 10.41.22.254;
                }
                dhcp-attributes {
                    name-server {
                        10.41.22.1;
                    }
                    router {
                        10.41.22.1;
                    }
                    propagate-settings irb.22;
                }
            }
        }
    }
}

EDIT-- Sessions info:

    username> show security flow session protocol icmp source-prefix 10.33.11.206/32 destination-prefix 10.5.5.22/32
Session ID: 2690, Policy name: trust-to-trust/4, Timeout: 4, Valid
  In: 10.33.11.206/1365 --> 10.5.5.22/1;icmp, Conn Tag: 0x0, If: ae0.11, Pkts: 1, Bytes: 60,
  Out: 10.41.22.3/1 --> 10.33.11.206/1365;icmp, Conn Tag: 0x0, If: ae0.22, Pkts: 1, Bytes: 60,

Session ID: 3967, Policy name: trust-to-trust/4, Timeout: 2, Valid
  In: 10.33.11.206/1363 --> 10.5.5.22/1;icmp, Conn Tag: 0x0, If: ae0.11, Pkts: 1, Bytes: 60,
  Out: 10.41.22.3/1 --> 10.33.11.206/1363;icmp, Conn Tag: 0x0, If: ae0.22, Pkts: 1, Bytes: 60,

Session ID: 27899, Policy name: trust-to-trust/4, Timeout: 4, Valid
  In: 10.33.11.206/1364 --> 10.5.5.22/1;icmp, Conn Tag: 0x0, If: ae0.11, Pkts: 1, Bytes: 60,
  Out: 10.41.22.3/1 --> 10.33.11.206/1364;icmp, Conn Tag: 0x0, If: ae0.22, Pkts: 1, Bytes: 60,
Total sessions: 3
Improve this question
7
  • 1
    Here we need to understand one thing that the ICMP doesn't have any port number as it is not working on the Transport layer, We can say virtually it is running on Layer 3.5 as it uses the service of IP and does not have Port number. Now when you wants to forward ports from any gateway level device for ICMP protocol, According to logic it must be all ports which needs to be forwarded in the direction on the local subnet then only the gateway level device will forward this packets inside subnet and not answers by themselves.
    – user1021946
    Commented May 21, 2019 at 12:21
  • config is in post now
    – Nufay
    Commented May 21, 2019 at 13:46
  • 1
    Assuming you're pinging a "forwarded" IP address (destination NAT) - port forwarding works for transport-layer protocols that use L4 ports, not for ICMP.
    – Zac67 ♦
    Commented May 21, 2019 at 17:07
  • I ping from 10.33.11.201 to 10.5.5.5. Under "forwarding" i mean not responding to it, but let the actual address respond to ICMP
    – Nufay
    Commented May 22, 2019 at 7:27
  • 1
    Please provide your Destination NAT configuration, and the output of show security flow session protocol icmp source-prefix 10.33.11.201/32 destination-prefix 10.5.5.5/32 run while you are pinging the device that is turned off
    – Benjamin Dale
    Commented May 22, 2019 at 12:34

2 Answers 2

Reset to default
6

The session output shows that the box is translating the destination address 10.5.5.22 to 10.41.22.3 and then routing it out ae0.22 instead of ae0.5 like you'd expect. It is very likely that your NAT config will help determine why this is (static and destination)

Improve this answer
3
  • Can you direct me, what i can do to solve this issue?
    – Nufay
    Commented May 23, 2019 at 11:59
  • @Nufay Provide your full NAT configuration show configuration security nat
    – Andrey Prokhorov
    Commented May 24, 2019 at 9:12
  • @AndreyProkhorov , Destination NAT contains only rules with forwarding from untrust zone to trust zone used for remote access.
    – Nufay
    Commented May 27, 2019 at 7:52
2

After @BenjaminDale and @AndreyProkhorov asked for full NAT configuration, i went to check it once more and i found what caused this problem. Destination NAT was the cause of the problem

I had Hairpin rules for port forward and it looked like this:

username# show security nat destination rule-set HAIRPIN-trust
from zone trust;
rule HAIRPIN-SRV1 {
    match {
        destination-address 0.0.0.0/32;
        destination-port {
            20001 to 21000;
        }
    }
    then {
        destination-nat {
            pool {
                SRV1;
            }
        }
    }
}

And the cause of my problem was solved after specifying actual WAN IP address in match destination-address section. But i still don't understand, why it could cause this issue.

At the end i left the destination NAT configuration with protocol specified:

username# show security nat destination rule-set HAIRPIN-trust
from zone trust;
rule HAIRPIN-SRV1 {
    match {
        destination-address 0.0.0.0/32;
        destination-port {
            20001 to 21000;
        }
        protocol tcp;
    }
    then {
        destination-nat {
            pool {
                SRV1;
            }
        }
    }
}

Thanks @BenjaminDale and @AndreyProkhorov for help! If you see anything strange in my configuration, please tell me.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.