Tuesday 30 May 2017

Monday 22 May 2017

source NAT on juniper SSG

I wanted to source NAT my traffic so it appears to come from 10.58.x.x range so it could go over my VPN.

I was able to do this with a DIP on juniper. The DIP must be created on the tunnel interface which is attached to the VPN that we want to travel over.


Since the tunnel interface is unnumbered I confgured the extended IP
10.58.254.1 /24 (I know this range is free)
For the DIP range I gave 10.58.254.2 - 10.58.254.254

set interface tunnel.4 ext ip 10.58.254.1 255.255.255.0 dip 4 10.58.254.2 10.58.254.254

You need a policy to allow the traffic and do the NAT.
The policy should be at the top so other rules won't overlap/interfere.

set policy id 123 from "Trust" to "Untrust" "LOCAL_NETS_2_NAT" "REMOVE_VPN_NETS" "ANY" nat src dip-id 4 permit log

The 10.58.x.x/16 network already had a policy to allow the traffic and was already in the encryption domain.

Did a debug flow basic and it seems to have worked, will test now.

WebGUI
Network -> Interfaces -> Edit tunnel.4
DIP tab  -> New 
Fill in IP range 10.58.254.2 - 10.58.254.254
Select port translation
Select in the same subnet as the extended IP fill in 10.58.254.1/24

Create you NAT policy
Policy -> Policies
Select source and destination networks
Service = ANY
Action = Permit
Click Advanced button
Tick Source Translation
Select the DIP you created on tun.4 
Click ok