[j-nsp] SRX ignores "then routing-instance" firewall action

Martin T m4rtntns at gmail.com
Thu Apr 9 10:16:24 EDT 2015


I have a Juniper SRX firewall cluster with interface reth2.28 facing
primary Internet connection, interface reth2.128 facing secondary
Internet connection and reth1.901 is facing LAN. Incoming traffic uses
reth2.28 interface. There is a static NAT configuration applied which
will change the destination IP address to if destination
port is 515:

static {
    rule-set nat {
        from interface reth2.28;
        rule nat {
            match {
                destination-port 515;
            then {
                static-nat {
                    prefix {
                        mapped-port 515;

Now host with IP address will send a reply(for example
TCP SYN+ACK) and SRX receives it on reth1.901 interface. I have an
input filter configured to reth1.901 which should force this traffic
to use routing instance DIA:

firewall {
    filter fallback-to-nat {
        term nat {
            from {
                destination-address {
                protocol tcp;
                source-port 515;
            then {
                routing-instance DIA;

However, according to flow traceoptions the router still uses inet.0
RIB for routing decisions and not the DIA.inet.0 RIB:

Apr  9 13:29:18 13:29:21.392241:CID-1:RT:
reth1.901:>, tcp, flag 12 syn ack
Apr  9 13:29:18 13:29:21.392241:CID-1:RT: find flow: table 0x5115c900,
hash 9435(0xffff), sa, da, sp 515, dp
56022, proto 6, tok 9
Apr  9 13:29:18 13:29:21.392241:CID-1:RT:  flow got session.
Apr  9 13:29:18 13:29:21.392241:CID-1:RT:  flow session id 132067
Apr  9 13:29:18 13:29:21.392241:CID-1:RT:  route lookup failed:
dest-ip orig ifp reth2.28 output_ifp reth2.128 fto
0x48bf7b50 orig-zone 7 out-zone 8 vsd 2
Apr  9 13:29:18 13:29:21.392241:CID-1:RT:  packet dropped,   pak
dropped since re-route failed

In case of DIA.inet.0 the interface for would be reth2.28.

Any ideas what might cause such behavior?


More information about the juniper-nsp mailing list