Article Detail

Description

Multicast traffic is not passing when source NAT is configured for the traffic. The solution is to convert the NAT to a one-to-one mapping without port-translation, using the host-address-base option.

Symptoms

User wants to pass multicast traffic and also change the IP address of the source to some other IP address. An interface based source NAT is configured. Traffic is flowing from zone trust_1 (source: 10.10.64.2) to zone trust_2 for group 239.100.10.10. The source NAT is configured as follows:

security {
    nat {
        source {
            pool p6 {
                address {
                    10.10.64.3/32;
                }
                host-address-base 10.10.64.2/32;
            }
            rule-set multicast-nat-source {
                from zone trust_1;
                to zone trust_2;
                rule r1 {
                    match {
                        destination-address 239.100.10.10/32;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }

Solution

Flow traceoptions for group 239.100.10.10 is enabled as follows:

security {
    flow {
        traceoptions {
            file flowtrace size 3m files 3 world-readable;
            flag basic-datapath;
            flag packet-drops;
            packet-filter pf1 {
                destination-prefix 239.100.10.10/32;
            }
        }
    }
}

On checking the log file, the error dip alloc failed appears:

Oct 24 16:43:38 16:41:56.460482:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:<10.10.64.2/52912->239.100.10.10/1025;17> matched filter pf1:

Oct 24 16:43:38 16:41:56.460524:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:packet [60] ipid = 15101, @0xfb12e0e4

Oct 24 16:43:38 16:41:56.460536:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP flow starts, mbuf=0x26955800, ifl_idx=71, ctxt_type=0xf

Oct 24 16:43:38 16:41:56.460554:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:  cp_flow_fast_lookup

Oct 24 16:43:38 16:41:56.460562:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP flow search session, hash=1776253534

Oct 24 16:43:38 16:41:56.460576:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:  cp_flow_first_sanity_check: in <ge-0/0/0.0>, out <N/A>

Oct 24 16:43:38 16:41:56.460590:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:  cp_flow_first_create_session

Oct 24 16:43:38 16:41:56.460599:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP flow search session, hash=1776253534

Oct 24 16:43:38 16:41:56.460611:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP allocates a CP session, id 10551

Oct 24 16:43:38 16:41:56.460620:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP couldn't find session, creates a pending session 2937, 00002937

Oct 24 16:43:38 16:41:56.460646:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:Fwd packet with rtbl idx 0, cos 0

Oct 24 16:43:38 16:41:56.460655:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:cp2spu fwd, cp sess id 10551 (00002937), id bits 27, gen bits 5, id mask 07ffffff, gen mask f8000000

Oct 24 16:43:38 16:41:56.460677:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP fwd pkt to SPU ==*1*==, iif: 71, flag: 0x00000800

Oct 24 16:43:38 16:41:56.461281:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP received install sess event, sess id 10551

Oct 24 16:43:38 16:41:56.461290:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP process msg SESS_MSG_INSTALL_FLOW

Oct 24 16:43:38 16:41:56.461307:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP install sess, cp_sess_id=10551, spu_sess_id=86618

Oct 24 16:43:38 16:41:56.461332:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP ack session install to SPU 1, spu_sess_id=86618

Oct 24 16:43:38 16:41:56.461440:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:<10.10.64.2/52912->239.100.10.10/1025;17> matched filter pf1:

Oct 24 16:43:38 16:41:56.461476:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:packet [60] ipid = 15101, @0xfb12e0e4

Oct 24 16:43:38 16:41:56.461489:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:tunnel_info_to_nsp: unknown tunne_type 0x7, info 0xffffffff

Oct 24 16:43:38 16:41:56.461501:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_mcast_processing: tunnel_info 0xffffffff in_tunnel 0x0

Oct 24 16:43:38 16:41:56.461560:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: flow_first_in_dst_nat: in <ge-0/0/0.0>, out <ge-0/0/1.0> dst_adr 239.100.10.10, sp 52912, dp 1025

Oct 24 16:43:38 16:41:56.461588:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: chose interface ge-0/0/0.0 as incoming nat if.

Oct 24 16:43:38 16:41:56.461635:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_first_rule_dst_xlate: DST no-xlate: 0.0.0.0(0) to 239.100.10.10(1025)

Oct 24 16:43:38 16:41:56.461670:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_first_policy_search: policy search from zone trust_1-> zone trust_2 (0x0,0xceb00401,0x401)

Oct 24 16:43:38 16:41:56.461695:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:Policy lkup: vsys 0 zone(6:trust_1) -> zone(7:trust_2) scope:0

Oct 24 16:43:38 16:41:56.461709:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: 10.10.64.2/52912 -> 239.100.10.10/1025 proto 17

Oct 24 16:43:38 16:41:56.461902:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: policy has timeout 900

Oct 24 16:43:38 16:41:56.461909:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: app 0, timeout 1800s, curr ageout 1800s

Oct 24 16:43:38 16:41:56.461919:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_first_policy_search: template timeout 30 tick increased to leaf timeout 900 tick

Oct 24 16:43:38 16:41:56.461937:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: permitted by policy p1(4)

Oct 24 16:43:38 16:41:56.461944:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT: packet passed, Permitted by policy.

Oct 24 16:43:38 16:41:56.461958:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_first_src_xlate:  nat_src_xlated: False, nat_src_xlate_failed: False

Oct 24 16:43:38 16:41:56.461973:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_first_src_xlate:  incoming src port is : 52912.

Oct 24 16:43:38 16:41:56.462017:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:flow_first_src_xlate: src nat returns status: 1, rule/pool id: 2/2, pst_nat: False.

Oct 24 16:43:38 16:41:56.462040:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:  dip alloc failed. dip_id = 0/0 <<<<<<<<<<<<<<

Oct 24 16:43:38 16:41:56.462049:CID-00:FPC-01:PIC-00:THREAD_ID-16:RT:  packet dropped, dip alloc failed

Interface based NAT is not supported for multicast traffic. Juniper Networks only supports source NAT with host-address-base option as mentioned here: Understanding NAT for Multicast Flows

The solution is to convert the NAT to a one-to-one mapping without port-translation, using the host-address-base option. The NAT configuration is now as follows:

security {
    nat {
        source {
            pool p6 {
                address {
                    10.10.64.3/32;
                }
                host-address-base 10.10.64.2/32;
            }
            rule-set multicast-nat-source {
                from zone trust_1;
                to zone trust_2;
                rule r1 {
                    match {
                        destination-address 239.100.10.10/32;
                    }
                    then {
                        source-nat {
                            pool {
                                p6;
                            }
                        }
                    }
                }
            }
        }

After making the above changes traffic works as we can see in the flow traceoptions as well:

Oct 24 17:05:52 17:04:10.251939:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:<10.10.64.2/63280->239.100.10.10/1025;17> matched filter pf1:

Oct 24 17:05:52 17:04:10.251981:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:packet [60] ipid = 18121, @0xfa44a0e4

Oct 24 17:05:52 17:04:10.251991:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP flow starts, mbuf=0x268b0800, ifl_idx=71, ctxt_type=0xf

Oct 24 17:05:52 17:04:10.252009:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:  cp_flow_fast_lookup

Oct 24 17:05:52 17:04:10.252018:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP flow search session, hash=465253279

Oct 24 17:05:52 17:04:10.252032:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:  cp_flow_first_sanity_check: in <ge-0/0/0.0>, out <N/A>

Oct 24 17:05:52 17:04:10.252046:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:  cp_flow_first_create_session

Oct 24 17:05:52 17:04:10.252055:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP flow search session, hash=465253279

Oct 24 17:05:52 17:04:10.252065:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP allocates a CP session, id 11866

Oct 24 17:05:52 17:04:10.252076:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP couldn't find session, creates a pending session 2e5a, 00002e5a

Oct 24 17:05:52 17:04:10.252100:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:Fwd packet with rtbl idx 0, cos 0

Oct 24 17:05:52 17:04:10.252109:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:cp2spu fwd, cp sess id 11866 (00002e5a), id bits 27, gen bits 5, id mask 07ffffff, gen mask f8000000

Oct 24 17:05:52 17:04:10.252132:CID-00:FPC-01:PIC-00:THREAD_ID-08:RT:CP fwd pkt to SPU ==*1*==, iif: 71, flag: 0x00000800

Oct 24 17:05:52 17:04:10.252725:CID-00:FPC-01:PIC-00:THREAD_ID-10:RT:CP received install sess event, sess id 11866

Oct 24 17:05:52 17:04:10.252737:CID-00:FPC-01:PIC-00:THREAD_ID-10:RT:CP process msg SESS_MSG_INSTALL_FLOW

Oct 24 17:05:52 17:04:10.252746:CID-00:FPC-01:PIC-00:THREAD_ID-10:RT:CP install sess, cp_sess_id=11866, spu_sess_id=88699

Oct 24 17:05:52 17:04:10.252768:CID-00:FPC-01:PIC-00:THREAD_ID-10:RT:CP ack session install to SPU 1, spu_sess_id=88699

Oct 24 17:05:52 17:04:10.252879:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:<10.10.64.2/63280->239.100.10.10/1025;17> matched filter pf1:

Oct 24 17:05:52 17:04:10.252918:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:packet [60] ipid = 18121, @0xfa44a0e4

Oct 24 17:05:52 17:04:10.252928:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:tunnel_info_to_nsp: unknown tunne_type 0x7, info 0xffffffff

Oct 24 17:05:52 17:04:10.252941:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_mcast_processing: tunnel_info 0xffffffff in_tunnel 0x0

Oct 24 17:05:52 17:04:10.253009:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  flow_first_in_dst_nat: in <ge-0/0/0.0>, out <ge-0/0/1.0> dst_adr 239.100.10.10, sp 63280, dp 1025

Oct 24 17:05:52 17:04:10.253037:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  chose interface ge-0/0/0.0 as incoming nat if.

Oct 24 17:05:52 17:04:10.253067:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_rule_dst_xlate: DST no-xlate: 0.0.0.0(0) to 239.100.10.10(1025)

Oct 24 17:05:52 17:04:10.253099:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_policy_search: policy search from zone trust_1-> zone trust_2 (0x0,0xf7300401,0x401)

Oct 24 17:05:52 17:04:10.253124:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:Policy lkup: vsys 0 zone(6:trust_1) -> zone(7:trust_2) scope:0

Oct 24 17:05:52 17:04:10.253138:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:             10.10.64.2/63280 -> 239.100.10.10/1025 proto 17

Oct 24 17:05:52 17:04:10.253226:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  policy has timeout 900

Oct 24 17:05:52 17:04:10.253233:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  app 0, timeout 1800s, curr ageout 1800s

Oct 24 17:05:52 17:04:10.253242:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_policy_search: template timeout 30 tick increased to leaf timeout 900 tick

Oct 24 17:05:52 17:04:10.253258:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  permitted by policy p1(4)

Oct 24 17:05:52 17:04:10.253267:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  packet passed, Permitted by policy.

Oct 24 17:05:52 17:04:10.253281:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_src_xlate:  nat_src_xlated: False, nat_src_xlate_failed: False

Oct 24 17:05:52 17:04:10.253295:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_src_xlate:  incoming src port is : 63280.

Oct 24 17:05:52 17:04:10.253329:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_src_xlate: src nat returns status: 1, rule/pool id: 2/32772, pst_nat: False.

Oct 24 17:05:52 17:04:10.253372:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  dip id = 4/1, 10.10.64.2/63280->10.10.64.3/63280 protocol 17

Oct 24 17:05:52 17:04:10.253409:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  choose interface ge-0/0/1.0(P2P) as outgoing phy if

Oct 24 17:05:52 17:04:10.253421:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  flow_first_final_check: in <ge-0/0/0.0>, out <ge-0/0/1.0>

Oct 24 17:05:52 17:04:10.253435:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_final_check: flow_set_xlate_vector.

Oct 24 17:05:52 17:04:10.253448:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_first_complete_session, pak_ptr: 0xde1f0c40, nsp: 0x65d206e8, in_tunnel: 0x0

Oct 24 17:05:52 17:04:10.253463:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:construct v4 vector for nsp2

Oct 24 17:05:52 17:04:10.253470:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  existing vector list 0x1000-0x33c6b970.

Oct 24 17:05:52 17:04:10.253481:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  Session (id:88700) created for first pak 1000

Oct 24 17:05:52 17:04:10.253491:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  flow_first_install_session======> 0x65d206e8

Oct 24 17:05:52 17:04:10.253502:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT: nsp 0x65d206e8, nsp2 0x65d20798

Oct 24 17:05:52 17:04:10.253512:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:Link P2MP session

Oct 24 17:05:52 17:04:10.253519:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_save_lpak_info_to_mbuf_common: setting flow_ctxt->iif to:0 based on keybuf iif.
Oct 24 17:05:52 17:04:10.253540:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:no need update ha

Oct 24 17:05:52 17:04:10.253554:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_session_state_pending2valid, template session 0x65d20458, sessid 0x15a7b

Oct 24 17:05:52 17:04:10.253572:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:no need update ha

Oct 24 17:05:52 17:04:10.253579:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:Installing c2s NP session wing

Oct 24 17:05:52 17:04:10.253602:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:no need install rflow np

Oct 24 17:05:52 17:04:10.253612:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_decap_vector:session present with incoming mbuf.

Oct 24 17:05:52 17:04:10.253621:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  flow session id 88700

Oct 24 17:05:52 17:04:10.253631:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT: vector bits 0x1000 vector 0x33c6b970

Oct 24 17:05:52 17:04:10.253642:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:flow_xlate_pak

Oct 24 17:05:52 17:04:10.253652:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  post addr xlation: 10.10.64.3->239.100.10.10.

Oct 24 17:05:52 17:04:10.253680:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:  post addr xlation: 10.10.64.3->239.100.10.10.

Oct 24 17:05:52 17:04:10.253705:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:skip pre-frag: is_tunnel_if- 0, is_if_mtu_configured- 0

Oct 24 17:05:52 17:04:10.253721:CID-00:FPC-01:PIC-00:THREAD_ID-20:RT:mbuf 0x268b0800, exit nh 0x50010

Oct 24 17:05:52 17:04:10.252792:CID-00:FPC-01:PIC-00:THREAD_ID-24:RT:SPU received an event,type 97, common:0

Oct 24 17:05:52 17:04:10.252804:CID-00:FPC-01:PIC-00:THREAD_ID-24:RT:Rcv packet with rtbl idx 0, cos 0

Oct 24 17:05:52 17:04:10.252813:CID-00:FPC-01:PIC-00:THREAD_ID-24:RT:SPU processing install_flow_ack, spu_sess_id=00015a7b, natp=0x65d20458

Oct 24 17:05:52 17:04:10.252830:CID-00:FPC-01:PIC-00:THREAD_ID-24:RT:SPU flow flush 1 paks for natp (0x65d20458), lock:1

Oct 24 17:05:52 17:04:10.252848:CID-00:FPC-01:PIC-00:THREAD_ID-24:RT:SPU flow enqueuing pkt from pending to mcast inq

Oct 24 17:05:52 17:04:10.252862:CID-00:FPC-01:PIC-00:THREAD_ID-24:RT:Got CP ack for session 88699.  P->V success

Oct 24 17:05:52 17:04:10.252156:CID-00:FPC-01:PIC-00:THREAD_ID-28:RT:SPU received an event,type 80, common:0

Oct 24 17:05:52 17:04:10.252168:CID-00:FPC-01:PIC-00:THREAD_ID-28:RT:Rcv packet with rtbl idx 0, cos 0

Oct 24 17:05:52 17:04:10.252177:CID-00:FPC-01:PIC-00:THREAD_ID-28:RT:SPU received pak with event message from CP, cp_sess_id=11866 flag a