Description

This article describes device behavior when eBGP is running on an aggregated multiservices (AMS) interface that has the Network Address Translation (NAT) service set. 

Symptoms

The topology for this scenario is given below.

eBGP is running on an interface with the NAT service set, but the interface is not up and the BGP notification can be seen in the log messages. This issue is seen only on aggregated multiservices (AMS) interfaces. On MS interfaces, the issue has been fixed via PR1645585.

NAT(BGP)      -------------------- CE               

BGP (active)            CE(passive)

Log Messages

Apr  6 09:07:16.264  jtac-mx480-r2017-re0 rpd[24379]: bgp_pp_recv:5038: NOTIFICATION sent to 192.168.1.2+54803 (proto): code 6 (Cease) subcode 5 (Connection Rejected), Reason: no group for 192.168.1.2+54803 (proto) from AS 200 found (eBGP connection attempt to an address that does not belong to the interface that peer connected to) in master(ams0.10), dropping him
Apr  6 09:07:24.243  jtac-mx480-r2017-re0 rpd[24379]: bgp_pp_recv:5038: NOTIFICATION sent to 192.168.1.2+65390 (proto): code 6 (Cease) subcode 5 (Connection Rejected), Reason: no group for 192.168.1.2+65390 (proto) from AS 200 found (eBGP connection attempt to an address that does not belong to the interface that peer connected to) in master(ams0.10), dropping him

Configuration

set interfaces xe-1/3/0 unit 0 family inet service input service-set MS_OFFICE_nat_serviceset
set interfaces xe-1/3/0 unit 0 family inet service output service-set MS_OFFICE_nat_serviceset
set interfaces xe-1/3/0 unit 0 family inet address 192.168.1.1/30
set interfaces ams0 unit 10 family inet

set services service-set MS_OFFICE_nat_serviceset stateful-firewall-rules MS_OFFICE_nat_fw2
set services service-set MS_OFFICE_nat_serviceset nat-rules SNAT
set services service-set MS_OFFICE_nat_serviceset interface-service service-interface ams0.10
set services stateful-firewall rule MS_OFFICE_nat_fw2 match-direction input-output
set services stateful-firewall rule MS_OFFICE_nat_fw2 term allow-rule then accept
set services nat pool NAT-POOL address 101.234.8.10/32
set services nat pool NAT-POOL port range low 40000
set services nat pool NAT-POOL port range high 60000
set services nat rule SNAT match-direction output
set services nat rule SNAT term translate from source-address 0.0.0.0/0
set services nat rule SNAT term translate then translated source-pool NAT-POOL
set services nat rule SNAT term translate then translated translation-type napt-44
set services nat rule SNAT term translate then syslog

set protocols bgp group ebgp type external
set protocols bgp group ebgp local-address 192.168.1.1
set protocols bgp group ebgp peer-as 200
set protocols bgp group ebgp neighbor 192.168.1.2

Solution

To work around this issue, set up a service filter to skip the NAT service for this BGP. 

set firewall family inet service-filter test term 10 from address 192.168.1.1/32
set firewall family inet service-filter test term 10 then skip
set firewall family inet service-filter test term 20 then service

set interfaces ge-1/0/0 unit 0 family inet service input service-set MS_OFFICE_nat_serviceset service-filter test
set interfaces ge-1/0/0 unit 0 family inet service output service-set MS_OFFICE_nat_serviceset service-filter test

Modification History

Initial Draft