VRF instance required on the middle router to avoid packet loops.
In order to enabling NAT in Juniper, AS-PIC/MS-PIC needed in the router.
Packet lookup and translation will done in the SP (Services PIC) interface.
Below is the topology used in this post:
A-B prefix list is 172.16.0.0/24 (A =.1, B=.2)
A loopback address is 1.1.1.1/32
B-C prefix list is 192.168.150.0/24 (B=.252, C=.102)
B is the middle router and doing NAT from source address A.
Thus, all packet with source IP 1.1.1.1 (A’s loopback) will translated to 10.0.0.0/24, and source IP Address 172.16.0.0/24 will translated to 10.1.1.0/24.
IP Nat pool = 10.0.0.0/24 and 10.1.1.0/24 (In the real network, only 1 prefix needed).
Router B Service Configuration
enugadi@M7i# show
stateful-firewall {
rule firewall-nat-rule {
match-direction input;
term 1 {
then {
accept;
}
}
}
}
nat {
pool nat-pool {
address 10.0.0.0/24;
}
pool nat-pool-1 {
address 10.1.1.0/24;
}
rule nat-rule {
match-direction input;
term 1 {
from {
source-address {
1.1.1.1/32;
}
}
then {
translated {
source-pool nat-pool;
translation-type {
source static;
}
}
}
}
term 2 {
from {
source-address {
172.16.0.0/24;
}
}
then {
translated {
source-pool nat-pool-1;
translation-type {
source static;
}
}
}
}
}
}
service-set nat {
stateful-firewall-rules firewall-nat-rule;
nat-rules nat-rule;
next-hop-service {
inside-service-interface sp-0/1/0.100;
outside-service-interface sp-0/1/0.200;
}
}
Interface Configuration
enugadi@M7i# show interfaces sp-0/1/0
unit 100 {
family inet;
service-domain inside;
}
unit 200 {
family inet;
service-domain outside;
}
VRF Configuration
enugadi@M7i# show routing-instances vrf-a
instance-type vrf;
interface sp-0/1/0.100;
interface ge-0/0/0.0;
route-distinguisher 1:1;
vrf-target target:1:1;
routing-options {
static {
route 192.168.150.0/24 next-hop sp-0/1/0.100;
route 1.1.1.1/32 next-hop 172.16.0.2;
}
}
Verify NAT packet translation:
enugadi@m7i# run show services stateful-firewall flows
Interface: sp-0/1/0, Service set: nat
Flow State Dir Frm count
ICMP 192.168.150.102 -> 10.0.0.1 Watch O 343
NAT dest 10.0.0.1 -> 1.1.1.1
ICMP 192.168.150.102 -> 10.1.1.2 Watch O 100
NAT dest 10.1.1.2 -> 172.16.0.2
ICMP 172.16.0.2 ->192.168.150.102 Watch I 100
NAT source 172.16.0.2 -> 10.1.1.2
ICMP 1.1.1.1 ->192.168.150.102 Watch I 343
NAT source 1.1.1.1 -> 10.0.0.1
Source IP Address 1.1.1.1/32 are translated to 10.0.0.0,
Source IP Address 172.168.0.0/24 are translated to 10.1.1.0 as expected.
