Sunday 22 April 2018

Making Use of Multiple Public IP addresses - Static NAT - Juniper SRX

Here's a little blog post on an application for making use of multiple external public IP addresses. Seems simple now that I know but like with many things if you don't know it can be frustrating trying to find the answer, so if someone stumbles across this blog post and it helps them then it's done its job.

When you buy a business internet connection, in my case a VDSL broadband service, you have the options of a static IP address or perhaps multiple static IP addresses. The classic use for these static IP addresses would be "mapping" one of them to an internal IP address of a server / appliance without using port forwarding. Port forwarding is great, but you can't forward the same port to two different servers, so it's more tricky to have resiliency. Having additional public IP addresses gets around this problem.

So how do you actually do it? The principle is straightforward. You use Static NAT in your edge router / firewall so that when it receives traffic destined for a particular public IP address it forwards the traffic to a defined private IP address. I.E. all traffic destined for 1.2.3.4 is forwarded to 192.168.1.100. And this applies in reverse, traffic from 192.168.1.100 is translated to 1.2.3.4 when it hits the public internet.

The reason this was ever in question for me was that try as I might I couldn't get the ISP supplied router to do this. It's a Huawei HG633 and there is no option to configure Static NAT. There are weird things like multi-NAT, one to many NAT and other variants. Some of which sound like they should work, none of which I could get to work.

And then enter my new SRX110, which I am loving more and more as I use it.

A great page from Juniper detailing static NAT works and a configuration example and it's working in all of 20 minutes. I love the way the page gives all the information you need to process the feature and get it working: A description, a simple picture, a dump of all the command you need, and then a step by step showing what each section of the configuration does. Ace.
https://www.juniper.net/documentation/en_US/junos/topics/example/nat-security-static-single-address-translation-configuring.html

I've pasted the picture and quick commands below just in case Juniper does something silly like changing the URL. Obviously, all credit goes to Juniper for the below, this good work is not me I'm just reposting it for reference:
 Static NAT Single
Address Translation


Quick Configuration:

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.
set security nat static rule-set rs1 from zone untrust
set security nat static rule-set rs1 rule r1 match destination-address 203.0.113.200/32
set security nat static rule-set rs1 rule r1 then static-nat prefix 192.168.1.200/32
set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.200/32
set security address-book global address server-1 192.168.1.200/32
set security policies from-zone trust to-zone untrust policy permit-all match source-address server-1
set security policies from-zone trust to-zone untrust policy permit-all match destination-address any
set security policies from-zone trust to-zone untrust policy permit-all match application any
set security policies from-zone trust to-zone untrust policy permit-all then permit
set security policies from-zone untrust to-zone trust policy server-access match source-address any
set security policies from-zone untrust to-zone trust policy server-access match destination-address server-1
set security policies from-zone untrust to-zone trust policy server-access match application any
set security policies from-zone untrust to-zone trust policy server-access then permit

Friday 20 April 2018

Talktalk Business VDSL Configuration for Juniper SRX110H

I've recently upgraded my broadband internet connection from a consumer grade connection with Talktalk "residential" to a business grade connection with Talktalk Business. The primary reason for this is because I want a number of static IP addresses to run applications, such as remote access VPN and a number of Unified Comms features. Plus I've always been curious about how it all works with multiple public IPs. I know you can do quite a lot with dynamic DNS, such as DYNDNS or noip, but there are quite a few advantages from a small number of static IPs for me so I'm giving it a go.

The router supplied with the broadband is a standard "budget" router, a Huawei HG633, which is ok but it's not intuitive and there's almost no assistance available. Plus as an IT professional I feel I should be using something a little more "real" anyway :) Traditionally I've used a Cisco 867VAE for ADSL / VDSL but I've run into a few issues, hopefully more in another post coming soon, so I'm decided to have a crack with a Juniper SRX110V-HA. And I have to say it's working brilliantly and it was easier than I thought to set up. So I wanted to write up a post with my configuration and a few experiences in case it helps anyone else in the future.

Talktalk Business Settings:
So starting off the TalkTalk Business VDSL settings for Simply Fibre as of April 2018:

Encapsulation Type: PPPoE
MTU: 1492
VDSL VLAN tag: 101
PPP Authentication mode: Chap
Internet Account username: phonenumber@talktalkbusiness.net
Internet Account Password: contact talktalk support for this
IP Address: negotiated

Juniper Configuration:
Now the Juniper specific Configuration.
The PT interface is the Physical VDSL Interface and the "unit 0" is default subinterface.

 pt-1/0/0 {
        vlan-tagging;
        mtu 1492;
        vdsl-options {
            vdsl-profile auto;
        }
        unit 0 {
            encapsulation ppp-over-ether;
            vlan-id 101;
        }

The PP interface is the Logical VDSL interface, similar to a dialer on a Cisco Box. This interface is linked to the Physical interface using the "underlying-interface" command:
 pp0 {
        unit 0 {
            ppp-options {
                chap {
                    default-chap-secret "xxxxxxxxxxxxx";
                    local-name "xxxxxxxxxxx@talktalkbusiness.net";
                    passive;
                }
            }
            pppoe-options {
                underlying-interface pt-1/0/0.0;
                auto-reconnect 10;
                client;
            }
            family inet {
                mtu 1492;
                negotiate-address;
            }
        }
    }

Set your local DHCP scope:
vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;

And your default route and your done:
routing-options {
    static {
        route 0.0.0.0/0 next-hop x.x.x.x (ISPs next hop address);

You will have to setup NAT and security zones but it is done by default in the SRX so that's nice and easy, although for completeness here is the config below.

NAT:
 nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }

Security Zones:
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
                 pp0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
                pt-1/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }

   screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
    pp0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
                pt-1/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }

Please note you can't just paste the above config into your device you have to edit and set the commands, this is how JunOS works, it's actually a great OS and I'd be happy to lend a hand if anyone is new and wants a pointer. I'm no master but I'm enjoying the OS and the way it works.

Lessons Learned:
One gotcha I learned on the way. JunOS doesn't support VLAN tagging on the VDSL interface until Release 12.1. Originally my SRX shipped with 11.x and I had to upgrade this in order to get it working.

Juniper References:
SRX110 Software Config Guide (see the tabs on the left hand side):
https://www.juniper.net/documentation/en_US/release-independent/junos/topics/concept/services-gateway-srx110-configuration-preparing.html

Configuring PPPoE Interfaces:
https://www.juniper.net/documentation/en_US/junos/topics/example/pppoe-security-interface-configuring.html

Configuring Ethernet Switch Ports:
https://kb.juniper.net/InfoCenter/index?page=content&id=KB16667&actp=METADATA

Configuring a static route:
https://kb.juniper.net/InfoCenter/index?page=content&id=KB16572&actp=METADATA

Configuring OSPF:
https://www.juniper.net/documentation/en_US/junos/topics/example/ospf-single-area-configuring.html