You might need to configure the Inline NAT interface style due to the hardware limitations and support of your FPC.

NOTE:Only static NAT is supported. Port translation, dynamic NAT, and ALGs are not supported. Hence, applications such as SIP or FTP Active Mode which require advanced processing for NAT do not function. An MS-MPC, MS-MIC, MS-DPC, or MS-PIC is still needed for any stateful-firewall processing, ALG support, and dynamic port translation.

Inline NAT does not support sampling or logging of packets.

Due to hardware limitations, only Inline NAT is supported on the FPC.

Here is an example configuration for this:

Topology example:

In this example, an MX Series device with an MPC line card provides inline source NAT services to traffic flowing between two end hosts.

As shown in the figure, host H1 sends traffic towards server S1. The MX Series device performs source NAT to translate H1’s source IP address from 10.1.1.2 to 192.0.2.2. Server S1 then sends return traffic to host H1 using the destination IP address 192.0.2.2, and the MX Series device reverts H1’s IP address back to 10.1.1.2.

The following configuration elements are used in this scenario:

• Inline service interface—a virtual interface that resides on the Packet Forwarding Engine of the MPC. To access services, traffic flows in and out of these si- (service-inline) interfaces.
• Service set—defines the service(s) to be performed, and identifies which inline interface(s) will feed traffic into and out of the service set. There are two ways to implement service sets:
  • Interface-style—an interface-based method, where packets arriving at an interface are forwarded through the inline service.
  • Next-hop-style—a route-based method, where static routes are used to forward packets destined for a specific destination through the inline service.
• This example uses the interface-style service set.
• NAT rule—uses an if-then structure (similar to firewall filters) to define matching conditions and then apply address translation to the matching traffic.
• NAT pool—a user-defined set of IP addresses that are used by the NAT rule for translation.

Interface-Based Inline Source NAT

Step-by-Step Procedure

1. Enable inline services for the relevant FPC slot and PIC slot, and define the amount of bandwidth to dedicate for inline services.
2. The FPC and PIC settings here will create and map to an si- interface.

[edit chassis fpc 0 pic 0]
user@MX# set inline-services bandwidth 1g

1. On the si- interface, specify the protocol family (or families) that will need NAT services.

NOTE: The FPC and PIC settings here must match the settings defined above.

[edit interfaces si-0/0/0]

user@MX# set unit 0 family inet

Configure NAT Rule and Pool

Step-by-Step Procedure

1. Configure a NAT rule that matches traffic arriving at the MX device from H1’s subnet (10.1.1.0/24), translates it using basic IPv4 NAT, and uses an IP address from pool p1.

[edit services nat]
user@MX# set rule SRC-NAT1 match-direction input
user@MX# set rule SRC-NAT1 term r1 from source-address 10.1.1.0/24
user@MX# set rule SRC-NAT1 term r1 then translated translation-type basic-nat44
user@MX# set rule SRC-NAT1 term r1 then translated source-pool p1

1. Configure the NAT pool.

[edit services nat]
user@MX# set pool p1 address 192.0.2.0/24

Configure the (Interface-style) Service Set

Step-by-Step Procedure

1. Configure a service set that uses the inline NAT service (nat-rules), and the inline interface defined above. Use the interface-service parameter to specify that this is an interface-style service set.
2. Traffic will flow into and out of the si- interface to access the inline NAT service.

[edit services]
user@MX# set service-set INT-STYLE-SS-NAT1 nat-rules SRC-NAT1
user@MX# set service-set INT-STYLE-SS-NAT1 interface-service service-interface si-0/0/0.0

Configure Physical Interfaces

Step-by-Step Procedure

1. Configure the physical interfaces.

[edit interfaces]
user@MX# set xe-0/0/0 unit 0 family inet address 10.1.1.1/24
user@MX# set xe-0/0/0 description INSIDE
user@MX# set xe-1/0/0 unit 0 family inet address 192.168.1.1/24
user@MX# set xe-1/0/0 description OUTSIDE

1. On the ’inside’ interface, specify that traffic will be sent through the service set defined above.

[edit interfaces xe-0/0/0 unit 0]
user@MX# set family inet service input service-set INT-STYLE-SS-NAT1
user@MX# set family inet service output service-set  INT-STYLE-SS-NAT1

Results

chassis {
    fpc 0 {
        pic 0 {
            inline-services {
                bandwidth 1g;
            }
        }
    }
}

services {
    service-set INT-STYLE-SS-NAT1 {
        nat-rules SRC-NAT1;
        interface-service {
            service-interface si-0/0/0.0;
        }
    }
    nat {
        pool p1 {
            address 192.0.2.0/24;
        }
        rule SRC-NAT1 {
            match-direction input;
            term r1 {
                from {
                    source-address {
                        10.1.1.0/24;
                    }
                }
                then {
                    translated {
                        source-pool p1;
                        translation-type {
                            basic-nat44;
                        }
                    }
                }
            }
        }
    }
}

interfaces {
    si-0/0/0 {
        unit 0 {
            family inet;
        }
    }
    xe-0/0/0 {
        description INSIDE;
        unit 0 {
            family inet {
                service {
                    input {
                        service-set INT-STYLE-SS-NAT1;
                    }
                    output {
                        service-set INT-STYLE-SS-NAT1;
                    }
                }
                address 10.1.1.1/24;
            }
        }
    }
    xe-1/0/0 {
        description OUTSIDE;
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}

On the MX device, verify that the inline NAT configuration details have been applied correctly.

user@MX> show services inline nat pool

Interface: si-0/0/0, Service set: INT-STYLE-SS-NAT1
  NAT pool: p1, Translation type: BASIC NAT44
    Address range: 192.0.2.0-192.0.2.255
    NATed packets: 5, deNATed packets: 5, Errors: 0

Note: The NAT pool cannot use an outgoing interface address facing server S1 and an separate address block is required, otherwise the traffic returned from the server S1 cannot distinguish packets.