Description

This article provides information on when to use the source-nat off statement in the Source NAT configuration on a SRX device.

Symptoms

Consider the following scenario:


[PC]---[SRX]----------[INTERNET]----------[SRX]----[SERVER]

Traffic can be primarily sent from the PC to the Server in two ways:

  • In encrypted form, via a site to site VPN, between the 2 SRX devices; as shown in the above diagram.

  • In unencrypted form, over the Internet by translating private IP addresses into public IP addresses, via Source NAT.

As per design, the VPN traffic does not have to be NAT'ed.

Solution


To allow VPN traffic to pass though the SRX device, in the presence of Source NAT configuration, you need to use the source-nat off statement in the Source NAT configuration and make it the first rule that the traffic would hit.

Subsequently, you may have a source-nat interface or source-nat pool for the non-encrypted traffic.

Refer to the following configuration: 

[edit security nat source]
root# show 
rule-set test {
    from zone trust;
    to zone untrust;
 rule 1 { > Rule 1 is configured for the Encrypted traffic going through the VPN
        match {
            source-address 192.168.1.1/24;
            destination-address 10.10.10.1/24;
        }
        then {
            source-nat {                
                off;
            }
    rule 2 { > Rule 2 is configured for the Non VPN traffic
        match {
            source-address 0.0.0.0/0;
            destination-address 0.0.0.0/0;
        }
        then {
            source-nat {
                interface;
            }
        }
    }
   
        }
    }
}
Note :

  • The above configuration is valid for both the main and aggressive mode.

  • It is applicable to both the Policy and Route Based VPNs

  • Zones: Trust - contains LAN interface. Untrust - contains ISP facing interface.