Description

Under customer's situation, SRX1500 is configured with the source nat pool 10.10.0.5, and it is able to do source NAT for the traffic from source subnet 10.104.110.10/27 and reach the destination host 10.10.5.10, all the devices in the destination host cannot be configured with default gateway. The destination hosts just treat the destination IP 10.10.0.5 of the return traffic as the one in its same subnet and won't forward the traffic to the layer 3 router QFX5100. So the the return traffic won't go back to the source host.

 

To resolve this issue, we suggested the customer to connect the one of SRX interface to the destination host vlan of the layer 2 switch and configure the SRX interface IP in the subnet of 10.10.0.0/19(for example: 10.10.0.2), then configure the source NAT and translate the source subnet 10.104.110.10/27 to the SRX interface IP, in this way, the source subnet should be able to communicate with the destination net 10.10.0.0/19.

 

Source host(10.104.110.10/27)--->SRX1500(xe-0/0/16.6 25.0.0.1)---->(xe-0/0/1.6 25.0.0.2) QFX5100(irb.60 10.10.1.1/19)--->Layer 2 switch--->Destination host(10.10.5.10/19)

 

However, the customer is unable to connect the one of SRX interfaces to the layer 2 switch.

 

 

Solution

We can add the config below into the layer3 router(QFX5100), the destination host devices now can send back packets to the translated IP(10.10.0.5) without adding more links between SRX and layer 2 switch

 

set interfaces irb unit 60 proxy-arp unrestricted  #With this config, the switch will act as a proxy if the source and target IP addresses are on the same subnet. 

 

set routing-options static route 10.10.0.5/32 next-hop 25.0.0.1 # Add this static route so that the QFX5100 knows how to send the return packets from destination hosts back to the SRX's source NAT pool 10.10.0.5/32.

 

 

Modification History

2024-02-02 : Article Created