Description

HairPIN NAT with Destination NAT is used when Internal private hosts who are themselves NAT'd with a traditional NAT translation type like NATP-44 need to access an Internal private server (same LAN subnet or in the same corporate network) using the server’s public NATd IP address from inside the network.

Symptoms

Here ,169.254.10.100/32 Public IP has been assigned to Internal server (10.1.0.100) and DNAT is configured on NAT device which will translate any connection initiated from Public Network with the Destination IP address 169.254.10.100/32 to internal server IP address 10.1.0.100

Solution

NAT Device Configuration :

set services service-set HairPIN-test nat-rules HairpinNAT
set services service-set HairPIN-test nat-rules DNAT
set services service-set HairPIN-test next-hop-service inside-service-interface ms-5/0/0.1
set services service-set HairPIN-test next-hop-service outside-service-interface ms-5/0/0.2
set services nat pool HairPIN_pool address 169.254.10.0/24
set services nat pool HairPIN_pool port automatic
set services nat rule HairpinNAT match-direction input
set services nat rule HairpinNAT term 1 from source-address 10.1.0.0/24
set services nat rule HairpinNAT term 1 then translated source-pool HairPIN_pool
set services nat rule HairpinNAT term 1 then translated translation-type napt-44
set services nat rule DNAT match-direction output
set services nat rule DNAT term 1 from destination-address 169.254.10.100/32
set services nat rule DNAT term 1 then translated destination-prefix 10.1.0.100/32
set services nat rule DNAT term 1 then translated translation-type dnat-44
set interfaces xe-0/0/0 unit 0 family inet address 172.16.0.1/30
set interfaces ms-5/0/0 unit 1 family inet
set interfaces ms-5/0/0 unit 1 service-domain inside
set interfaces ms-5/0/0 unit 2 family inet
set interfaces ms-5/0/0 unit 2 service-domain outside
set interfaces ge-0/3/1 unit 0 family inet address 172.168.100.1/24
set routing-instances inside instance-type virtual-router
set routing-instances inside interface ge-0/3/1.0
set routing-instances inside interface ms-5/0/0.1
set routing-instances inside routing-options static route 10.1.0.0/24 next-hop 172.168.100.2
set routing-instances inside routing-options static route 0.0.0.0/0 next-hop ms-5/0/0.1
set routing-instances outside instance-type virtual-router
set routing-instances outside interface ms-5/0/0.2
set routing-instances outside interface xe-0/0/0.0
set routing-instances outside routing-options static route 169.254.100.0/24 next-hop 172.16.0.2  

Verification:

root@Public-Host# run ssh [email protected] source 169.254.100.100
Password:
Password:
Last login: Wed Jul 26 08:47:28 2017 from 169.254.100.100
--- JUNOS 15.1X54-D10.5 built 2015-06-17 17:20:27 UTC
root@Host10-1-0-100>
 
root@NAT-Device# run show services sessions
ms-5/0/0
Service Set: HairPIN-test, Session: 167772162, ALG: none, Flags: 0x0000, IP Action: no, Offload: no, Asymmetric: no
TCP     169.254.100.100:50728  ->  169.254.10.100:22     Forward  O              24
TCP          10.1.0.100:22     -> 169.254.100.100:50728  Forward  I              21
  
root@Host10-1-0-10> ssh [email protected] source 10.1.0.10
The authenticity of host '169.254.10.100 (169.254.10.100)' can't be established.
ECDSA key fingerprint is 8d:56:d8:2a:bd:24:ac:66:5d:56:a2:7f:c8:b4:8e:ed.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '169.254.10.100' (ECDSA) to the list of known hosts.
Password:
Last login: Wed Jul 26 08:58:17 2017 from 169.254.100.100
--- JUNOS 15.1X54-D10.5 built 2015-06-17 17:20:27 UTC
root@Host10-1-0-100> 

root@NAT-Device# run show services sessions
ms-5/0/0
Service Set: HairPIN-test, Session: 33554435, ALG: none, Flags: 0x0000, IP Action: no, Offload: no, Asymmetric: no
TCP        169.254.10.7:1024   ->  169.254.10.100:22     Forward  O              22
TCP          10.1.0.100:22     ->    169.254.10.7:1024   Forward  I              19
 
Service Set: HairPIN-test, Session: 134217729, ALG: none, Flags: 0x0000, IP Action: no, Offload: no, Asymmetric: no
TCP           10.1.0.10:63904  ->  169.254.10.100:22     Forward  I              22
TCP      169.254.10.100:22     ->    169.254.10.7:1024   Forward  O              19

When the internal host tried to ssh internal server with public IP. the request reaches to NAT device and NAT device perform both Source and Destination NAT for the session.
The internal host’s source IP (10.1.0.10) was translated to 169.254.10.7 and the server’s public IP was translated to 10.1.0.100 as per DNAT rule.