SRX for beginners #2

After my srx for beginners post has become the most popular article of this blog, I have decided to improve it a little bit as it is missing some vital information. Without talking too much let’s summarize what we will do in this post

• What is a flow session?
• How can we interpret a flow session entry?
• How can we open a standard port/application on SRX and do destination NAT?
• How can we open a non-standard port and do destination NAT?
• How can we do proxy-arp?

In this post, we will use the same topology like previous post but I have added three new devices in this new topology so that I can show source/destination nat and proxy arp.

Let’s get started:

What is a flow session?

Juniper SRX is a stateful firewall hence box doesn’t forward an IP packet and forgets it. It has to remember which IP packets it has received and which packets it is expecting. It isn’t exactly like this but for the sake of simplicity let’s assume like this now. So what does a session look like on an SRX firewall. In order to show this from PC1 device, I telnet to TCP port 80 of www.example.com host which is outside my test network and see how the flow session looks like on our SRX firewall.

TCP 80 connection is established towards the host 93.184.216.34

pc1>telnet www.example.com 80
Trying 93.184.216.34...
Connected to www.example.com.
Escape character is '^]'.

Now let’s see how this session looks like on our firewall

root@srx220> show security flow session destination-port 80 
Session ID: 109, Policy name: allow-internal-clients/4, Timeout: 294, Valid
  In: 192.168.239.3/47715 --> 93.184.216.34/80;tcp, If: ge-0/0/1.0, Pkts: 2, Bytes: 112
  Out: 93.184.216.34/80 --> 192.168.100.38/20201;tcp, If: ge-0/0/0.0, Pkts: 1, Bytes: 60
Total sessions: 1

As you can see, we can display sessions by “show security flow session” command and by giving more options e.g destination-port you can filter session table.

How can we interpret a flow session entry?

Now let’s drill down this single flow session entry line by line.

Line 1

• 109 : Each session is given a session identifier by the firewall, here 109
• allow-internal-clients/4 : Security which exactly matches this specific traffic and number 4 is the policy index.
• 294 : When a session is created it starts with default timeout and counts down to zero as long as no packet is seen. If it reaches 0 session is removed

Line 2

• 192.168.239.3/47715 : Source IP address/Port of the source host which created the session
• 93.184.216.34/80;tcp : Destination IP address/Port of the destination host and the transport layer protocol which is tcp here
• ge-0/0/1.0 : The ingress interface of the packet
• Pkts: 2, Bytes: 112 Number of packets and Bytes received on this direction

Line 3
A flow session has two wings and this one is the wing on the reverse direction.

• 93.184.216.34/80 : This is the same as our destination address
• 192.168.100.38/20201 : This is the address to which 93.184.216.34 replies back but it is different than our source IP address 192.168.239.3 since we are doing source NAT and port translation
• ge-0/0/0.0 : Ingress interface of the return packets
• Pkts: 1, Bytes: 60 : IP packet and Bytes received from the destination

How can we open a default/standard port/application on SRX and do destination NAT?

In the topology, we have a Web server and we would like to allow public HTTP service i.e anyone who types http://192.168.100.38 on their browser from Internet will be redirected to our internal web server i.e we will create a destination NAT rule and a security policy allowing this HTTP traffic.

First thing we should go to configuration mode

root@srx220> configure                                      
Entering configuration mode

Then we can paste the following commands to configure destination NAT

Destination NAT

set security nat destination pool webserver-internal address 192.168.239.10/32
set security nat destination rule-set internal-servers from zone internet
set security nat destination rule-set internal-servers rule webserver match destination-address 192.168.100.38/32
set security nat destination rule-set internal-servers rule webserver match destination-port 80
set security nat destination rule-set internal-servers rule webserver then destination-nat pool webserver-internal

Note: In order to forward traffic to the internal server, a pool is required

Security Policy
If you don’t permit the HTTP traffic in a security policy, destination NAT has no use.
On this setup I am moving from zone specific address groups to global addresses for which I am moving my old address book to global level and I am adding new address entry for webserver.

delete security zones security-zone internal address-book address network_239
set security address-book global address network_239 192.168.239.0/24
set security address-book global address webserver 192.168.239.10/32

Now we can create the security policy.

set security policies from-zone internet to-zone internal policy allow-web-service match source-address any
set security policies from-zone internet to-zone internal policy allow-web-service match destination-address webserver
set security policies from-zone internet to-zone internal policy allow-web-service match application junos-http
set security policies from-zone internet to-zone internal policy allow-web-service then permit

Note: On SRX, default applications are prefixed by junos- as you can see for junos-http application.

Finally commit your changes. Now we telnet to the IP 192.168.100.38 from outside network (10.100.100.10) and check the session table.

root@srx220> show security flow session destination-port 80 
Session ID: 147, Policy name: allow-web-service/5, Timeout: 286, Valid
  In: 10.100.100.10/36120 --> 192.168.100.38/80;tcp, If: ge-0/0/0.0, Pkts: 3, Bytes: 164
  Out: 192.168.239.10/80 --> 10.100.100.10/36120;tcp, If: ge-0/0/1.0, Pkts: 2, Bytes: 120
Total sessions: 1

As you can see request for 192.168.100.38:80 is translated to 192.168.239.10:80 by SRX.

How can we open a non-standard port and do destination NAT?

Now we have a different requirement. There is an SMTP server which is listening on port default port 25 but we somehow want everyone to access this host on port 2025 instead of the default port. Now we will configure this scenario.

First Address book entry

set security address-book global address smtpserver 192.168.239.11 

set security nat destination pool smtpserver-internal address 192.168.239.11/32
set security nat destination pool smtpserver-internal address port 25
set security nat destination rule-set internal-servers rule smtpserver match destination-address 192.168.100.38/32
set security nat destination rule-set internal-servers rule smtpserver match destination-port 2025
set security nat destination rule-set internal-servers rule smtpserver then destination-nat pool smtpserver-internal

Note: Pay attention that pool we created is for port 25 but actual port match is for 2025

Now security policy

set security policies from-zone internet to-zone internal policy allow-smtp-service match source-address any
set security policies from-zone internet to-zone internal policy allow-smtp-service match destination-address smtpserver
set security policies from-zone internet to-zone internal policy allow-smtp-service match application junos-smtp
set security policies from-zone internet to-zone internal policy allow-smtp-service then permit

Note: You may be asking why do we use junos-smtp application which has port 25 instead of an application which has destination port 2025. The reason is that security policy processing is done after destination is processed hence when security policy does the match, port is already translated to 25 from 2025.

For example, if you were to redirect(port nat) 2025 port to another non-standard port e.g 2000 on this smtp server then you would have to create an application e.g named custom-smtp and permit this application on this policy.

set applications application custom-smtp protocol tcp
set applications application custom-smtp destination-port 2025

But this isn’t what we are configuring now. We just redirect outside 2025 port to internal 25 port.

Now we telnet from our Internet host

root@vHost2:~# vhost INTERNET1
INTERNET1>telnet 192.168.100.38 2025
Trying 192.168.100.38...
Connected to 192.168.100.38.
Escape character is '^]'.
220 vHost2 ESMTP Postfix (Debian/GNU)

Heyyy, we have got the smtp response on non-standard port 2025. Let’s check the flow session.

root@srx220> show security flow session destination-port 25      
Session ID: 151, Policy name: allow-smtp-service/6, Timeout: 1784, Valid
  In: 10.100.100.10/56967 --> 192.168.100.38/2025;tcp, If: ge-0/0/0.0, Pkts: 3, Bytes: 164
  Out: 192.168.239.11/25 --> 10.100.100.10/56967;tcp, If: ge-0/0/1.0, Pkts: 2, Bytes: 151
Total sessions: 1

Yes, port 2025 is translated to 25 as it can be seen in the flow session too.

You can also check the translation hits by the following command to see if the NAT rule is really being hit or not.

root@srx220> show security nat destination rule smtpserver 
 
Destination NAT rule: smtpserver           Rule-set: internal-servers 
  Rule-Id                    : 2  
  Rule position              : 2
  From zone                  : internet
    Destination addresses    : 192.168.100.38  - 192.168.100.38
    Destination port         : 2025            - 2025
  Action                     : smtpserver-internal 
  Translation hits           : 1    <---Here we can see the translation hits.
    Successful sessions      : 1
    Failed sessions          : 0
  Number of sessions         : 1

How can we do proxy-arp?

According to our topology, we have only one WAN IP assigned to the external interface which is 192.168.100.38 but our ISP has given us a /24 block from which now we also would like to use IP address 192.168.100.100 for some services. However we don't want to assign this IP address to the external interface. The problem is that if you don't assign an IP to an interface, you don't respond to ARP requests for that IP. In order to solve this problem we need to configure proxy arp. To demonstrate this, we have a scenario. We have an application server IP of which is 192.168.239.12 in the internal network and application is running on TCP port 8080. We would like everyone on Internet to access this application via TCP port 80 i.e we will redirect TCP80 requests coming to 192.168.100.100 to the internal 192.168.239.12 TCP8080.

#Configure Proxy-arp so that we can respond to ARP requests to this address
set security nat proxy-arp interface ge-0/0/0.0 address 192.168.100.100/32

#Configure TCP8080 custom application
set applications application TCP8080 protocol tcp
set applications application TCP8080 destination-port 8080

#We also need an address book entry for our policy
set security address-book global address appserver 192.168.239.12/32

#Here we configure our pool for nat
set security nat destination pool appserver-internal address 192.168.239.12/32
set security nat destination pool appserver-internal address port 8080

#Destination NAT rule
set security nat destination rule-set internal-servers rule appserver match destination-address 192.168.100.100/32
set security nat destination rule-set internal-servers rule appserver match destination-port 80
set security nat destination rule-set internal-servers rule appserver then destination-nat pool appserver-internal

#And finally security policy allowing TCP8080
set security policies from-zone internet to-zone internal policy allow-appserver match source-address any
set security policies from-zone internet to-zone internal policy allow-appserver match destination-address appserver
set security policies from-zone internet to-zone internal policy allow-appserver match application TCP8080
set security policies from-zone internet to-zone internal policy allow-appserver then permit

Now we do connect to TCP80 port of 192.168.100.100 from 10.100.100.10 Internet host and see the session table

root@srx220> show security flow session destination-port 80 
Session ID: 7, Policy name: allow-appserver/7, Timeout: 1792, Valid
  In: 10.100.100.10/45550 --> 192.168.100.100/80;tcp, If: ge-0/0/0.0, Pkts: 3, Bytes: 164
  Out: 192.168.239.12/8080 --> 10.100.100.10/45550;tcp, If: ge-0/0/1.0, Pkts: 2, Bytes: 120
Total sessions: 1

Yes it works! we redirect port 80 to internal 8080 port.

Now I am hoping that I have completed SRX for beginners posts!

Related