Description


This article describes how we can access cloud server from a branchLAN with the help of NAT configuration on Head Quarter's SRX.

Symptoms


Scenario:
                                              server
                                           on internet
                                                   |
                                                   |
LAN-1---SRX-100---------------SRX-240----- LAN-2
               Site-A    IPSEC-VPN     Site-B

*Cloud server has restriction policies to reject all traffic except traffic sourced from the HQ i.e. Cloud server only accessible via Head Quarter
*Branch users are not able to access cloud server located on internet via ISP’s direct link
*Route based IPSEC vpn is already running between branch and HQ

IP Schema:
Lan-1(Branch users):192.168.1.0/24
Lan-2(HQ users):192.168.254.0/24
Cloud server ip:192.162.221.3/32

Requirement:
Cloud Server which is located on internet should be accessible from LAN-1(i.e branch users) without any changes on server's or on Branch SRX.

Solution


->One can achieve this scenario by using source-nat and destination-nat on the HQ's SRX-240.

->Please find below a sample NAT configuration and reference security policy configuration which needs to be performed on the SRX-240.

nat {
    source {
        rule-set R2 {
            from zone untrust;
            to zone untrust;
            rule SITE_B_pub {
                match {
                    source-address 192.168.1.0/24;
                }
                then {
                    source-nat {
                        interface;
                    }
                }
            }
        }
    }
    destination {
        pool server_pub_ip {
            address 192.162.221.3/32;
        }
        rule-set R1 {
            from zone untrust;
            rule SEVER_dst {
                match {
                    destination-address 192.168.254.253/32;
                }
                then {
                    destination-nat pool server_pub_ip;
                }
            }
        }
    }
}


Security policy which is required:

----output omitted
policies {
----output omitted
from-zone untrust to-zone untrust {
    policy untr-to-untr {
        match {
            source-address 192.168.1.0/24;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
-----output omitted

->We need one dummy IP from LAN-2 to map server's public ip 192.162.221.3/32, here the ip is:192.168.254.253 

->Therfore, LAN-1 user will use this ip 192.168.254.253 to open the cloud server 192.162.221.3/32.

->As per the above configuration, when LAN-1 user initiates a session to the Server, it will first reach the HQ's SRX via IPSEC VPN tunnel and then HQ's SRX will do a Destination and Source NAT on the session and send it to the cloud server.
   On the cloud server, it will see this traffic as coming from HQ, and not from the branch, as such, it will allow that traffic to access its resources.


Result/Output:

root@SRX100_Branch# run ping 192.168.254.253 source 192.168.1.1
PING 192.168.254.253 (192.168.254.253): 56 data bytes
64 bytes from 192.168.254.253: icmp_seq=0 ttl=62 time=7.318 ms
64 bytes from 192.168.254.253: icmp_seq=1 ttl=62 time=7.383 ms
64 bytes from 192.168.254.253: icmp_seq=2 ttl=62 time=7.289 ms

root@SRX-240-HQ# run show security nat destination rule all
Total destination-nat rules: 1

Destination NAT rule: SEVER_dst Rule-set: R1
Rule-Id : 1
Rule position : 1
From zone : untrust
Destination addresses : 192.168.254.253 - 192.168.254.253
Action : server_pub_ip
Destination port : 0
Translation hits :20

[edit]
root@SRX-210-4-HQ# run show security nat source rule all
Total rules: 1

source NAT rule: SITE_B_pub Rule-set: R2
Rule-Id : 2
Rule position : 1
From zone : untrust
To zone : untrust
Match
Source addresses : 192.168.1.0 - 192.168.1.255
Destination port : 0 - 0
Action : interface
Persistent NAT type : N/A
Persistent NAT mapping type : address-port-mapping
Inactivity timeout : 0
Max session number : 0
Translation hits :23