Description

If there is a source NAT rule that includes "junos-host" in the list of source zones, this can result in an effective PAT only translation on the IPSec traffic, which results in the VPN being established with NAT-T detected.

Symptoms

SRXA 1.1.1.1 <---> Internet <---> 2.2.2.2 SRXB

 

SRXA relevant config:

set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.1/24

set security ike gateway vpn-gateway external-interface ge-0/0/0.0

set security zones security-zone untrust interfaces ge-0/0/0.0

 

 

When the iked/kmd process on SRX1 initiates the tunnel, it will do it as 1.1.1.1/500 > 2.2.2.2/500.

 

If SRXA has the following NAT rule, it will result in PAT only translation.

 

set security nat source rule-set nat-out from zone junos-host

set security nat source rule-set nat-out from zone trust

set security nat source rule-set nat-out to zone untrust

set security nat source rule-set nat-out rule host-out match source-address 0.0.0.0/0

set security nat source rule-set nat-out rule host-out then source-nat interface

 

All self traffic is generated from the default hidden zone junos-host. Therefore, when the this packet is generated by iked/kmd it will match the source NAT rule. In both cases, the IP address will be 1.1.1.1. Therefore the IP will have source NAT of 1.1.1.1 > 1.1.1.1. But then we have the port address translation. Source port UDP 500 will be assigned a random high port, for example 500 > 23764.

So the iked/kmd process on SRXA will create its NAT-T hash based on 1.1.1.1/500 > 2.2.2.2/500. However, SRXB will receive 1.1.1.1/23764 > 2.2.2.2/500. When it runs a hash against the new port, it will not match, and therefore SRXB will detect NAT-T. The negotiation will now be NAT-T.

Solution

It may be necessary to retain the source NAT rule matching on source zone junos-host. For example, traffic may be generated from the loopback with a private IP address such as 10.0.0.1/32 and must have source NAT to go to the internet.

 

Therefore the solution is to create a NAT exception rule.

 

set security nat source rule-set no-nat-vpn from zone junos-host

set security nat source rule-set no-nat-vpn to zone untrust

set security nat source rule-set no-nat-vpn rule no-nat-vpns match source-address 1.1.1.1/32

set security nat source rule-set no-nat-vpn rule no-nat-vpns then source-nat off

 

Then we place this rule-set above the normal source NAT.

 

insert security nat source rule-set no-nat-vpn before rule-set nat-out

 

The VPNs may beed to be cleared at both ends after this to then renegotiate without NAT-T.

 

 

NOTE: There are cases where there is a similar PAT only process being done externally but the ISP or other entity. In this situation, you may not be able to eliminate the NAT and then we must allow nat-traversal and the VPN should always be initiated, and rekeyed from the device behind the NAT.

Modification History

2024-01-30 : Article Created