[j-nsp] PPTP VPN through NAT on M10i

[Jo Rhett]

Does that mean that it is supported from 11.2R1 up, or does that mean it's never supported this way?  Did I misread this page, which says that outside source dynamic nat is supported?
   https://www.juniper.net/techpubs/en_US/junose10.1/information-products/topic-collections/swconfig-ip-services/id-67401.html

Is there any way to do this without 1:1 static mapping? This site has very few external addresses, and hundreds of internal users. Mapping each possible VPN user to a static external IP is not possible here.  It's possible I'm just implementing this the wrong way...

On Jan 16, 2012, at 11:33 PM, Alex Arseniev wrote:
> PPTP ALG is supported from JUNOS 11.2R1
> GRE is not supported with "nat source dynamic"
> HTH
> Rgds
> Alex
> 
> ----- Original Message ----- From: "Jo Rhett" <jrhett at netconsonance.com>
> To: <juniper-nsp at puck.nether.net>
> Sent: Tuesday, January 17, 2012 3:19 AM
> Subject: [j-nsp] PPTP VPN through NAT on M10i
> 
> 
> I've got a problem with NAT on an M10i with Junos 10.4. Simple PNAP interface, works fine for TCP and UDP.  Doesn't work for PPTP or IPSEC. Way back in my mind I remember something about having to create a second nat rule without port mapping, but its not working. I'm pretty sure I'm forgetting something here.  Can someone spare a 2x4 and clue me over the head?
> 
> ---yes, I know that the filters in the configuration below aren't active.
> 
> Here's the configuration now:
> 
> interfaces {
>   ge-0/0/0 {
>       unit 0 {
>           family inet {
>               address 192.168.1.1/24;
>           }
>       }
>   }
>   ge-0/1/0 {
>       unit 0 {
>           family inet {
>               service {
>                   input {
>                       service-set NAT;
>                   }
>                   output {
>                       service-set NAT;
>                   }
>               }
>               address 192.168.2.1/24;
>           }
>       }
>   }
>   sp-0/3/0 {
>       unit 0 {
>           family inet;
>       }
>   }
> 
> ….
> 
> firewall {
>   filter UNTRUST-IN {
>       term ICMP {
>           from {
>               destination-address {
>                   192.168.2.1/4;
>               }
>               protocol icmp;
>           }
>           then accept;
>       }
>       term EVERYTHING-ELSE {
>           then {
>               discard;
>           }
>       }
>   }
>   filter TRUST-OUT {
>       term IPOUT {
>           from {
>               source-address {
>                   192.168.1.0/24;
>               }
>               destination-address {
>                   0.0.0.0/0;
>               }
>           }
>           then accept;
>       }
>   }
> }
> services {
>  service-set NAT {
>       nat-rules Outbound;
>       interface-service {
>           service-interface sp-0/3/0.0;
>       }
>   }
>   nat {
>       pool NATPOOL {
>           address 192.168.2.3/32
>           port {
>               automatic;
>           }
>       }
>       pool GRE-NATPOOL {
>           address 192.168.2.3/32
>       }
>       rule Outbound {
>           match-direction output;
>           term PPTP_VPNs {
>               from {
>                   source-address {
>                       192.168.1.0/24;
>                   }
>                   applications GRE-PPTP;
>               }
>               then {
>                   translated {
>                       source-pool GRE-NATPOOL;
>                       translation-type {
>                           source dynamic;
>                       }
>                   }
>               }
>           }
>           term Else {
>               from {
>                   source-address {
>                       192.168.1.0/24;
>                   }
>               }
>               then {
>                   translated {
>                       source-pool NATPOOL;
>                       translation-type {
>                           source dynamic;
>                       }
>                   }
>               }
>           }
>       }
>   }
>   adaptive-services-pics {
>       traceoptions {
>           flag all;
>       }
>   }
> }
> applications {
>   application GRE-PPTP {
>       protocol gre;
>   }
> }
> 
> -- 
> Jo Rhett
> Net Consonance : consonant endings by net philanthropy, open source and other randomness
> 
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/juniper-nsp
> 

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source and other randomness