Routing, Interfaces, and NAT for User Logical Systems
The user logical system enables you to configure routing protocols, interfaces and NAT. Routing protocols handles all routing messages. NAT is a mechanism to translate the IP address of a computer or group of computers into a single public address when the packets are sent out to the internet. For more information, see the following topics:
Understanding Logical Systems Network Address Translation
Network Address Translation (NAT) is a method for modifying or translating network address information in packet headers. Either or both source and destination addresses in a packet may be translated. NAT can include the translation of port numbers as well as IP addresses.
Any combination of static, destination, or source NAT can be configured in the root or user logical systems. Configuring NAT in a logical system is the same as configuring NAT in a root system. The primary administrator can configure and monitor NAT in the primary logical system as well as any user logical system.
Starting in Junos OS Release 18.2R1, the NAT functionality is supported for logical systems on SRX4100, and SRX4200 devices in addition to existing support on SRX1500, SRX5400, SRX5600, and SRX5800 devices.
For each user logical system, the primary administrator can configure the maximum and reserved numbers for the following NAT resources:
Source NAT pools and destination NAT pools
IP addresses in source NAT pools with and without port address translation
Rules for source, destination, and static NAT
Persistent NAT bindings
IP addresses that support port overloading
From a user logical system, the user logical system administrator
can use the operational command show system security-profile with a NAT option to view the number of NAT resources allocated
to the user logical system.
The primary administrator can configure a security profile for the primary logical system that specifies the maximum and reserved numbers of NAT resources applied to the primary logical system. The number of resources configured in the primary logical system count toward the maximum number of NAT resources available on the device.
From a user logical system, the user logical system
administrator can use the show security nat command to
view the information about NAT for the user logical system. From the
primary logical system, the primary administrator can use the same
command to view information for the primary logical system, a specific
user logical system, or all logical systems.
See Also
Example: Configuring Network Address Translation for a User Logical Systems
This example shows how to configure static NAT for a user logical system.
Requirements
Before you begin:
Log in to the user logical system as the logical system administrator. See User Logical Systems Configuration Overview.
Use the
show system security-profile nat-static-rulecommand to see the static NAT resources allocated to the logical system.Configure security policies. See Example: Configuring Security Policies in a User Logical Systems.
Overview
This example configures the ls-product-design user logical system shown in Example: Creating User Logical Systems, Their Administrators, Their Users, and an Interconnect Logical System.
Devices in the ls-product-design-untrust zone access a specific host in the ls-product-design-trust zone by way of the address 12.1.1.200/32. For packets that enter the ls-product-design logical system from the ls-product-design-untrust zone with the destination IP address 12.1.1.200/32, the destination IP address is translated to the 12.1.1.100/32. This example configures the static NAT described in Table 1.
Feature |
Name |
Configuration Parameters |
|---|---|---|
Static NAT rule set |
rs1 |
|
Proxy ARP |
Address 12.1.1.200 on interface lt-0/0/0.3. |
Configuration
Procedure
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
set security nat static rule-set rs1 from zone ls-product-design-untrust set security nat static rule-set rs1 rule r1 match destination-address 12.1.1.200/32 set security nat static rule-set rs1 rule r1 then static-nat prefix 12.1.1.100/32 set security nat proxy-arp interface lt-0/0/0.3 address 12.1.1.200/32
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure NAT in a user logical system:
Log in to the user logical system as the logical system administrator and enter configuration mode.
lsdesignadmin1@host:ls-product-design> configure lsdesignadmin1@host:ls-product-design#
Configure a static NAT rule set.
[edit security nat static] lsdesignadmin1@host:ls-product-design# set rule-set rs1 from zone ls-product-design-untrust
Configure a rule that matches packets and translates the destination address in the packets.
[edit security nat static] lsdesignadmin1@host:ls-product-design# set rule-set rs1 rule r1 match destination-address 12.1.1.200/32 lsdesignadmin1@host:ls-product-design# set rule-set rs1 rule r1 then static-nat prefix 12.1.1.100/32
Configure proxy ARP.
[edit security nat] lsdesignadmin1@host:ls-product-design# set proxy-arp interface lt-0/0/0.3 address 12.1.1.200/32
Results
From configuration mode, confirm your configuration
by entering the show security nat command. If the output
does not display the intended configuration, repeat the configuration
instructions in this example to correct it.
lsdesignadmin1@host:ls-product-design# show security nat
static {
rule-set rs1 {
from zone ls-product-design-untrust;
rule r1 {
match {
destination-address 12.1.1.200/32;
}
then {
static-nat prefix 12.1.1.100/32;
}
}
}
}
proxy-arp {
interface lt-0/0/0.3 {
address {
12.1.1.200/32;
}
}
}
If you are done configuring the device, enter commit from configuration mode.
Verification
To confirm that the configuration is working properly, perform these tasks:
Verifying Static NAT Configuration
Purpose
Verify that there is traffic matching the static NAT rule set.
Action
From operational mode, enter the show security
nat static rule command. View the Translation hits field to
check for traffic that matches the rule.
Example: Configuring Interfaces and Routing Instances for a User Logical Systems
This example shows how to configure interfaces and routing instances for a tenant system.
Requirements
Before you begin:
Log in to the user logical system as the user logical system administrator. See User Logical Systems Configuration Overview.
Determine which logical interfaces and, optionally, which logical tunnel interfaces are allocated to your user logical system by the primary administrator. The primary administrator configures the logical tunnel interfaces. See Understanding the Primary Logical Systems and the Primary Administrator Role.
Overview
This example configures the ls-product-design user logical system shown in Example: Creating User Logical Systems, Their Administrators, Their Users, and an Interconnect Logical System.
This example configures the interfaces and routing instances described in Table 2.
Feature |
Name |
Configuration Parameters |
|---|---|---|
Interface |
ge-0/0/5.1 |
|
Routing instance |
pd-vr1 |
|
Configuration
Procedure
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
set interfaces ge-0/0/5 unit 1 family inet address 12.1.1.1/24 set interfaces ge-0/0/5 unit 1 vlan-id 700 set routing-instances pd-vr1 instance-type virtual-router set routing-instances pd-vr1 interface ge-0/0/5.1 set routing-instances pd-vr1 interface lt-0/0/0.3 set routing-instances pd-vr1 routing-options static route 13.1.1.0/24 next-hop 10.0.1.3 set routing-instances pd-vr1 routing-options static route 14.1.1.0/24 next-hop 10.0.1.4 set routing-instances pd-vr1 routing-options static route 12.12.1.0/24 next-hop 10.0.1.1
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure an interface and a routing instance in a user logical system:
Log in to the user logical system as the logical system administrator and enter configuration mode.
lsdesignadmin1@host:ls-product-design> configure lsdesignadmin1@host:ls-product-design#
Configure the logical interface for a user logical system.
[edit interfaces] lsdesignadmin1@host:ls-product-design# set ge-0/0/5 unit 1 family inet address 12.1.1.1/24 lsdesignadmin1@host:ls-product-design# set ge-0/0/5 unit 1 vlan-id 700
Configure the routing instance and assign interfaces.
[edit routing-instances] lsdesignadmin1@host:ls-product-design# set pd-vr1 instance-type virtual-router lsdesignadmin1@host:ls-product-design# set pd-vr1 interface ge-0/0/5.1 lsdesignadmin1@host:ls-product-design# set pd-vr1 interface lt-0/0/0.3
Configure static routes.
[edit routing-instances] lsdesignadmin1@host:ls-product-design# set pd-vr1 routing-options static route 13.1.1.0/24 next-hop 10.0.1.3 lsdesignadmin1@host:ls-product-design# set pd-vr1 routing-options static route 14.1.1.0/24 next-hop 10.0.1.4 lsdesignadmin1@host:ls-product-design# set pd-vr1 routing-options static route 12.12.1.0/24 next-hop 10.0.1.1
Results
From configuration mode, confirm your configuration
by entering the show interfaces and show routing-instances commands. If the output does not display the intended configuration,
repeat the configuration instructions in this example to correct it.
The primary administrator configures the lt-0/0/0.3 interface.
Thus, the lt-0/0/0.3 configuration appears in the show interfaces output even though you did not configure this item.
lsdesignadmin1@host:ls-product-design# show interfaces
ge-0/0/5 {
unit 1 {
vlan-id 700;
family inet {
address 12.1.1.1/24;
}
}
}
lt-0/0/0 {
unit 3 {
encapsulation ethernet;
peer-unit 2;
family inet {
address 10.0.1.2/24;
}
}
}
lsdesignadmin1@host:ls-product-design# show routing-instances
pd-vr1 {
instance-type virtual-router;
interface ge-0/0/5.1;
interface lt-0/0/0.3;
routing-options {
static {
route 13.1.1.0/24 next-hop 10.0.1.3;
route 14.1.1.0/24 next-hop 10.0.1.4;
route 12.12.1.0/24 next-hop 10.0.1.1;
}
}
}
If you are done configuring the device, enter commit from configuration mode.
Example: Configuring OSPF Routing Protocol for a User Logical Systems
This example shows how to configure OSPF for a user logical system.
Requirements
Before you begin:
Log in to the user logical system as the user logical system administrator. See User Logical Systems Configuration Overview.
Configure logical interface ge-0/0/5.1. Assign ge-0/0/5.1 and lt-0/0/0.3 to the pd-vr1 routing instance. See Example: Configuring Interfaces and Routing Instances for a User Logical Systems.
Overview
In this example, you configure OSPF for the ls-product-design user logical system, shown in Example: Creating User Logical Systems, Their Administrators, Their Users, and an Interconnect Logical System.
This example enables OSPF routing on the ge-0/0/5.1 and lt-0/0/0.3 interfaces in the ls-product-design user logical system. You configure the following routing policies to export routes from the Junos OS routing table into OSPF in the pd-vr1 routing instance:
ospf-redist-direct—Routes learned from directly connected interfaces.
ospf-redist-static—Static routes.
ospf-to-ospf—Routes learned from OSPF.
Configuration
Procedure
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
set policy-options policy-statement ospf-redist-direct from protocol direct set policy-options policy-statement ospf-redist-direct then accept set policy-options policy-statement ospf-redist-static from protocol static set policy-options policy-statement ospf-redist-static then accept set policy-options policy-statement ospf-to-ospf from protocol ospf set policy-options policy-statement ospf-to-ospf then accept set routing-instances pd-vr1 protocols ospf export ospf-redist-direct set routing-instances pd-vr1 protocols ospf export ospf-redist-static set routing-instances pd-vr1 protocols ospf export ospf-to-ospf set routing-instances pd-vr1 protocols ospf area 0.0.0.1 interface ge-0/0/5.1 set routing-instances pd-vr1 protocols ospf area 0.0.0.1 interface lt-0/0/0.3
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure OSPF for the user logical system:
Log in to the user logical system as the user logical system administrator and enter configuration mode.
lsdesignadmin1@host:ls-product-design> configure lsdesignadmin1@host:ls-product-design#
Create routing policies that accept routes.
[edit policy-options] lsdesignadmin1@host:ls-product-design# set policy-statement ospf-redist-direct from protocol direct lsdesignadmin1@host:ls-product-design# set policy-statement ospf-redist-direct then accept lsdesignadmin1@host:ls-product-design# set policy-statement ospf-redist-static from protocol static lsdesignadmin1@host:ls-product-design# set policy-statement ospf-redist-static then accept lsdesignadmin1@host:ls-product-design# set policy-statement ospf-to-ospf from protocol ospf lsdesignadmin1@host:ls-product-design# set policy-statement ospf-to-ospf then accept
Apply the routing policies to routes exported from the Junos OS routing table into OSPF.
[edit routing-instances] lsdesignadmin1@host:ls-product-design# set pd-vr1 protocols ospf export ospf-redist-direct lsdesignadmin1@host:ls-product-design# set pd-vr1 protocols ospf export ospf-redist-static lsdesignadmin1@host:ls-product-design# set pd-vr1 protocols ospf export ospf-to-ospf
Enable OSPF on the logical interfaces.
[edit routing-instances] lsdesignadmin1@host:ls-product-design# set pd-vr1 protocols ospf area 0.0.0.1 interface ge-0/0/5.1 lsdesignadmin1@host:ls-product-design# set pd-vr1 protocols ospf area 0.0.0.1 interface lt-0/0/0.3
Results
From configuration mode, confirm your configuration
by entering the show policy-options and show routing-instances commands. If the output does not display the intended configuration,
repeat the configuration instructions in this example to correct it.
For brevity, this show command output includes only
the configuration that is relevant to this example. Any other configuration
on the system has been replaced with ellipses (...).
[edit]
lsdesignadmin1@host:ls-product-design# show policy-options
policy-statement ospf-redist-direct {
from protocol direct;
then accept;
}
policy-statement ospf-redist-static {
from protocol static;
then accept;
}
policy-statement ospf-to-ospf {
from protocol ospf;
then accept;
}
[edit]
lsdesignadmin1@host:ls-product-design# show routing-instances
pd-vr1 {
...
protocols {
ospf {
export [ ospf-redist-direct ospf-to-ospf ospf-redist-static ];
area 0.0.0.1 {
interface lt-0/0/0.3;
interface ge-0/0/5.1;
}
}
}
}
If you are done configuring the device, enter commit from configuration mode.
Verification
Confirm that the configuration is working properly.
Verifying OSPF Interfaces
Purpose
Verify OSPF-enabled interfaces.
Action
From the CLI, enter the show ospf interface instance
pd-vr1 command.
lsdesignadmin1@host:ls-product-design> show ospf interface instance pd-vr1 Interface State Area DR ID BDR ID Nbrs lt-0/0/0.3 DR 0.0.0.0 10.0.1.2 0.0.0.0 0 ge-0/0/5.1 DR 0.0.0.1 10.0.1.2 0.0.0.0 0
Verifying OSPF Neighbors
Purpose
Verify OSPF neighbors.
Action
From the CLI, enter the show ospf neighbor instance
pd-vr1 command.
lsdesignadmin1@host:ls-product-design> show ospf neighbor instance pd-vr1 Address Interface State ID Pri Dead 10.0.1.1 plt0.1 Full 0.0.0.0 128 39
Verifying OSPF Routes
Purpose
Verify OSPF routes.
Action
From the CLI, enter the show ospf route instance
pd-vr1 command.
lsdesignadmin1@host:ls-product-design> show ospf route instance pd-vr1 Topology default Route Table: Prefix Path Route NH Metric NextHop Nexthop Type Type Type Interface Address/LSP 10.0.1.0/24 Intra Network IP 1 lt-0/0/0.3 12.12.1.0/24 Intra Network IP 1 ge-0/0/5.1