Quantcast
Channel: SRX Services Gateway topics
Viewing all articles
Browse latest Browse all 3959

1-to-1 NAT setup to untrust /24?

$
0
0

I have a setup like this:

srx-345_nat_to_public.jpg

I have the ge0/0/1.x NAT set up for each respective VLAN, but I want each VLAN to route to it's own public static in the /24. I'm used to Linux where you'd just create 0:0, 0:1 etc and set static IP on them and then route to them, but I doubt this is the way JunOS works? I tried to just add IP addresses to the interface, but I think maybe that's not right?

interface ge-0/0/0.0 {
    address {
        1.2.3.4/32;
        1.2.3.5/32;
        1.2.3.6/32;
    }
}

Then I read I should be setting up a 1-to-1 NAT proxy-arp, so I started working on that and just reset the original /24 IP on ge0/0/0, so I have something like:

proxy-arp {
    interface ge-0/0/0.0 {
        address {
            1.2.3.3/32;
            1.2.3.4/32;
            1.2.3.5/32;
        }
    }
}

then set up some rules like:

set security nat static rule-set untrust-to-vlan10 from zone untrust
set security nat static rule-set untrust-to-vlan10 rule 10 match destination-address 1.2.3.4
set security nat static rule-set untrust-to-vlan10 rule 10 then static-nat prefix 1.2.3.4

Am I approaching this the right way, or what am I missing?


Viewing all articles
Browse latest Browse all 3959

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>