Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: NAPT Configuration for the MS-MPC

Requirements

• MX-series router
• MultiServices Modular Port Concentrator (MS-MPC)
• Junos OS Release 13.2R1 or higher

Overview

A service provider has chosen an MS-MPC as a platform to provide NAT services to accommodate new subscribers.

Configuration

To configure NAPT44 using the MS-MPC as a services interface card, perform these tasks:

• Configuring Interfaces
• Configure an Application Set of Acceptable ALG traffic
• Configuring a Stateful Firewall Rule
• Configuring NAT Pool and Rule
• Configuring the Service Set

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Configuring Interfaces

Step-by-Step Procedure

1. Configure the interface for the customer-facing interface.
   user@host# edit[edit ]user@host# set interfaces xe-1/1/0 unit 0 family inet address 10.255.247.2/24user@host# set interfaces xe-1/1/0 unit 0 family inet service input service-set sset1user@host# set interfaces xe-1/1/0 unit 0 family inet service output service-set sset1
2. Configure the interface for the Internet-facing interface.
   [edit ]set interfaces ge-0/2/0 unit 0 family inet address 10.255.248.2/24
3. Configure the interface for the service set that will connect services to the customer-facing interface. In our example, the interface resides on an MS-MPC.
   [edit ]user@host# set interfaces ms-3/0/0 unit 0 family inet

Results

Configure an Application Set of Acceptable ALG traffic

Step-by-Step Procedure

1. Specify an application set that contains acceptable incoming ALG traffic.
   user@host# set applications application-set accept-algs application junos-httpuser@host# set applications application-set accept-algs application junos-ftpuser@host# set applications application-set accept-algs application junos-tftpuser@host# set applications application-set accept-algs application junos-telnetuser@host# set applications application-set accept-algs application junos-sipuser@host# set applications application-set accept-algs application junos-rtcp

Results

application junos-http;
application junos-ftp;
application junos-tftp;
application junos-telnet;
application junos-sip;
application junos-

Configuring a Stateful Firewall Rule

Step-by-Step Procedure

1. Specify firewall matching for all input and output
   user@hos#t set services stateful-firewall rule sf-rule1 match-direction input-output
2. Identify source-address and acceptable ALG traffic from the customer-facing interface.
   user@host# set services stateful-firewall rule sf-rule1 term sf-term1 from source-address 10.255.247.0/24user@host# set services stateful-firewall rule sf-rule1 term sf-term1 from application-sets accept-algsuser@host# set services stateful-firewall rule sf-rule1 term sf-term1 then accept

Results

rule sf-rule1 {
    match-direction input-output;
    term sf-term1 {
        from {
            source-address {
                10.255.247.0/24;
            }
            application-sets accept-algs;
        }
        then {
            accept;
        }
    }
}

Configuring NAT Pool and Rule

Step-by-Step Procedure

1. Configure the NAT pool with automatic port assignment.
   user@host# set services nat pool napt-pool address 1.1.1.0/24user@host# set services nat pool napt-pool port automatic
2. Configure a NAT rule that applies translation type napt-44 using the defined NAT pool.
   user@host# set services nat rule nat-rule1 term nat-term1 from application-sets accept-algsuser@host# set services nat rule nat-rule1 term nat-term1 then translated source-pool napt-pooluser@host# set services nat rule nat-rule1 term nat-term1 then translated translation-type napt-44

Results

pool napt-pool {
    address 1.1.1.0/24;
    port {
        automatic;
    }
}
rule nat-rule1 {
    match-direction input;
    term nat-term1 {
        from {
            source-address {
                10.255.247.0/24;
            }
            application-sets accept-algs; 
        }
        then {
            translated {
                source-pool napt-pool;                 
                translation-type {
                    napt-44;
                }
            }
        }
    }
}

Configuring the Service Set

Step-by-Step Procedure

1. Specify the NAT and stateful firewall rules that apply to customer traffic.
   user@host set services service-set sset1 stateful-firewall-rules sf-rule1user@host set services service-set sset1 nat-rules bat-rule1
2. Specify the services interface that applies the rules to customer traffic.
   set services service-set sset1 interface-service service-interface ms-3/0/0

Results

set services service-set sset1 stateful-firewall-rules sf-rule1
set services service-set sset1 nat-rules nat-rule1
set services service-set sset1 interface-service service-interface ms-3/0/0