API tools faq
paste
danhoutz

MX NAPT Example

danhoutz
Sep 11th, 2015
130
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.41 KB | None | 0 0
raw download clone embed print report
  1. INTERFACE STYLE:
  2. =========================
  3.  
  4. root@gw2z0# show | compare
  5. [edit]
  6. + services {
  7. + service-set SSET1 {
  8. + nat-rules nat-rule-1;
  9. + interface-service {
  10. + service-interface ms-0/2/0.0;
  11. + }
  12. + }
  13. + nat {
  14. + pool napt {
  15. + address 10.10.10.2/32;
  16. + port {
  17. + automatic {
  18. + random-allocation;
  19. + }
  20. + }
  21. + address-allocation round-robin;
  22. + }
  23. + rule nat-rule-1 {
  24. + match-direction input;
  25. + term term1 {
  26. + from {
  27. + source-address {
  28. + 192.168.1.0/24;
  29. + }
  30. + destination-address {
  31. + 192.168.1.0/24 except;
  32. + }
  33. + }
  34. + then {
  35. + translated {
  36. + source-pool napt;
  37. + translation-type {
  38. + napt-44;
  39. + }
  40. + }
  41. + }
  42. + }
  43. + }
  44. + }
  45. + }
  46. [edit interfaces ms-0/2/0]
  47. + unit 0 {
  48. + family inet;
  49. + }
  50. [edit interfaces]
  51. + irb {
  52. + unit 10 {
  53. + family inet {
  54. + service {
  55. + input {
  56. + service-set SSET1 service-filter SFILTER-IN;
  57. + }
  58. + output {
  59. + service-set SSET1 service-filter SFILTER-OUT;
  60. + }
  61. + }
  62. + address 192.168.1.1/24;
  63. + }
  64. + }
  65. + }
  66. [edit firewall family inet]
  67. + service-filter SFILTER-IN {
  68. + term term1 {
  69. + from {
  70. + source-address {
  71. + 192.168.1.0/24;
  72. + }
  73. + destination-address {
  74. + 0.0.0.0/0;
  75. + 192.168.1.0/24 except;
  76. + }
  77. + }
  78. + then service;
  79. + }
  80. + term term2 {
  81. + then skip;
  82. + }
  83. + }
  84. + service-filter SFILTER-OUT {
  85. + term term1 {
  86. + from {
  87. + destination-address {
  88. + 10.10.10.2/32;
  89. + }
  90. + }
  91. + then service;
  92. + }
  93. + term term2 {
  94. + then skip;
  95. + }
  96. + }
  97.  
  98. NEXT-HOP STYLE
  99. ==============================
  100.  
  101. + services {
  102. + service-set SSET1 {
  103. + nat-rules nat-rule1;
  104. + next-hop-service {
  105. + inside-service-interface ms-0/2/0.15;
  106. + outside-service-interface ms-0/2/0.16;
  107. + }
  108. + }
  109. + nat {
  110. + pool napt-pool {
  111. + address 10.10.10.2/32;
  112. + port {
  113. + automatic;
  114. + }
  115. + }
  116. + rule nat-rule1 {
  117. + match-direction input;
  118. + term nat-term1 {
  119. + inactive: from {
  120. + source-address {
  121. + 192.168.0.0/24;
  122. + }
  123. + destination-address {
  124. + 0.0.0.0/0;
  125. + }
  126. + }
  127. + then {
  128. + translated {
  129. + source-pool napt-pool;
  130. + translation-type {
  131. + napt-44;
  132. + }
  133. + }
  134. + }
  135. + }
  136. + }
  137. + }
  138. + }
  139. + interfaces {
  140. + irb {
  141. + unit 10 {
  142. + family inet {
  143. + address 192.168.1.1/24;
  144. + }
  145. + }
  146. + }
  147. + ms-0/2/0 {
  148. + inactive: unit 0 {
  149. + family inet;
  150. + }
  151. + unit 15 {
  152. + family inet;
  153. + service-domain inside;
  154. + }
  155. + unit 16 {
  156. + family inet;
  157. + service-domain outside;
  158. + }
  159. + }
  160. + ge-1/1/2 {
  161. + unit 0 {
  162. + family bridge {
  163. + interface-mode access;
  164. + vlan-id 10;
  165. + }
  166. + }
  167. + }
  168. + }
  169. + forwarding-options {
  170. + family inet {
  171. + filter {
  172. + input redirect_to_nat_outside_vr;
  173. + }
  174. + }
  175. + }
  176. + firewall {
  177. + family inet {
  178. + filter redirect_to_nat_outside_vr {
  179. + term term1 {
  180. + from {
  181. + destination-address {
  182. + 10.10.10.2/32;
  183. + }
  184. + }
  185. + then {
  186. + routing-instance NAT-OUTSDE-VR;
  187. + }
  188. + }
  189. + term default {
  190. + then accept;
  191. + }
  192. + }
  193. + service-filter SFILTER-IN {
  194. + term term1 {
  195. + from {
  196. + source-address {
  197. + 192.168.1.0/24;
  198. + }
  199. + destination-address {
  200. + 0.0.0.0/0;
  201. + 192.168.1.0/24 except;
  202. + }
  203. + }
  204. + then service;
  205. + }
  206. + term term2 {
  207. + then skip;
  208. + }
  209. + }
  210. + service-filter SFILTER-OUT {
  211. + term term1 {
  212. + from {
  213. + destination-address {
  214. + 10.10.10.2/32;
  215. + }
  216. + }
  217. + then service;
  218. + }
  219. + term term2 {
  220. + then skip;
  221. + }
  222. + }
  223. + }
  224. + }
  225. + routing-instances {
  226. + NAT-INSIDE-VR {
  227. + instance-type virtual-router;
  228. + interface ms-0/2/0.15;
  229. + interface irb.10;
  230. + routing-options {
  231. + static {
  232. + route 0.0.0.0/0 next-hop ms-0/2/0.15;
  233. + }
  234. + }
  235. + }
  236. + NAT-OUTSDE-VR {
  237. + instance-type virtual-router;
  238. + interface ms-0/2/0.16;
  239. + routing-options {
  240. + static {
  241. + route 10.10.10.2/32 next-hop ms-0/2/0.16;
  242. + route 0.0.0.0/0 next-table inet.0;
  243. + }
  244. + }
  245. + }
  246. + }
  247. + bridge-domains {
  248. + BD10 {
  249. + vlan-id 10;
  250. + routing-interface irb.10;
  251. + }
  252. + }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!