inxi -Fxz
Gives a good overview of the system
Tuesday, 30 May 2017
Monday, 22 May 2017
source NAT on juniper SSG
I wanted to source NAT my traffic so it appears to come from 10.58.x.x range so it could go over my VPN.
I was able to do this with a DIP on juniper. The DIP must be created on the tunnel interface which is attached to the VPN that we want to travel over.
Since the tunnel interface is unnumbered I confgured the extended IP
10.58.254.1 /24 (I know this range is free)
For the DIP range I gave 10.58.254.2 - 10.58.254.254
set interface tunnel.4 ext ip 10.58.254.1 255.255.255.0 dip 4 10.58.254.2 10.58.254.254
You need a policy to allow the traffic and do the NAT.
The policy should be at the top so other rules won't overlap/interfere.
The policy should be at the top so other rules won't overlap/interfere.
set policy id 123 from "Trust" to "Untrust" "LOCAL_NETS_2_NAT" "REMOVE_VPN_NETS" "ANY" nat src dip-id 4 permit log
The 10.58.x.x/16 network already had a policy to allow the traffic and was already in the encryption domain.
Did a debug flow basic and it seems to have worked, will test now.
WebGUI
Network -> Interfaces -> Edit tunnel.4
DIP tab -> New
Fill in IP range 10.58.254.2 - 10.58.254.254
Select port translation
Select in the same subnet as the extended IP fill in 10.58.254.1/24
Create you NAT policy
Policy -> Policies
Select source and destination networks
Service = ANY
Action = Permit
Click Advanced button
Tick Source Translation
Select the DIP you created on tun.4
Click ok
Subscribe to:
Posts (Atom)