[j-nsp] MX, Nat + BGP

[Alex]

Hello there,
I assume you are trying interface-style service- set (NH-style does not 
support service-filters).
Four things you can try:

1/ don't use same subnet on the link and for NAT pool. This is possible but 
you have to configure proxy-arp for every host in this subnet.

2/ if you have to use, say 150.150.150.0/30 for link subnet and 
150.150.150.0/24 as NAT pool,
configure NAT pool to exclude 150.150.150.0/30:

set services nat pool pool1 address-range low 150.150.150.4 high 
150.150.150.255

3/ NAT source interface lo0 does not work by design on M/T/MX, period.

4/ Exclude BGP from being serviced:
set service-filter sf1-in term 1 from protocol tcp
set service-filter sf1-in term 1 from port 179
set service-filter sf1-in term 1 then skip
set service-filter sf1-in term 2 then service
set service-filter sf1-out term 1 from protocol tcp
set service-filter sf1-out term 1 from port 179
set service-filter sf1-out term 1 then skip
set service-filter sf1-out term 2 then service


hth
Rgds
Alex

----- Original Message ----- 
From: "OBrien, Will" <ObrienH at missouri.edu>
To: <juniper-nsp at puck.nether.net>
Sent: Wednesday, May 18, 2011 1:34 AM
Subject: [j-nsp] MX, Nat + BGP


> I've been working through a nat configuration on my lab MX960 with a 
> MS-DPC blade that I've borrowed.
> To start, I'm trying to create a simple nat'd subnet. However, the NAT 
> guide that I've been provided doesn't really fit my current design.
>
> The example I'm looking at uses a nat pool that's defined like so:
> 150.150.150.0/24
>
> with an outside interface that has say, 150.150.150.1/24 on it,
>
> Ok.
>
> Well, in my world, I use MX's for BGP announcements. So I'm trying to put 
> the NAT source interface on a lo0 instead of a normal interface.
>
> Is anyone else doing it this way or is there some other sneaky trick I'm 
> missing? So far applying the service filter only seems to break traffic.
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/juniper-nsp
>