Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Configuring MX Series Router Cloud CPE NAT Services on the PE1 Router to Route Internet Traffic

Complete the following tasks to configure the PE1 router at Site 1:

1. Configuring MX Series Router Cloud CPE NAT Services
2. Configuring the Service Interfaces for NAT
3. Defining the Service Rules
4. Configuring the Interface, Bridge Domain, and IRB Interface

Configuring MX Series Router Cloud CPE NAT Services

1. Configure the properties for the MS-DPC and enable the extension provider service package application.
   [edit]edit chassis fpc 4 pic 0 adaptive-services service-package layer-3
2. Verify the configuration.
   user@host# show

   chassis {
   fpc 4 {
       pic 0 {
           adaptive-services {
               service-package layer-3;
           }
       }
   }
   }

Configuring the Service Interfaces for NAT

1. Configure the inside interface.
   [edit]user@host# set interfaces sp-2/0/0 unit 1 family inetuser@host# set interfaces sp-2/0/0 unit 1 service-domain inside
2. Configure the outside interface.
   [edit]user@host# set interfaces sp-2/0/0 unit 2 family inetuser@host# set interfaces sp-2/0/0 unit 2 service-domain outside

Defining the Service Rules

1. Configure the next-hop service set.
   1. Configure a name for the service set.
      [edit]user@host# edit services service-set acme-services
   2. Configure a name for the NAT rules.
      [edit services service-set acme-services]user@host# set nat-rules acme-nat-rule
   3. Define the next-hop service for the inside service interface.
      [edit services service-set acme-services]user@host# set next-hop-service inside-service-interface sp-2/0/0.1
   4. Define the next-hop service for the outside service interface.
      [edit services service-set acme-services]user@host# set next-hop-service outside-service-interface sp-2/0/0.2
2. Configure the public address pool and ports.
   1. Configure the public address pool name.
      user@host# top [edit]user@host# edit services nat pool acme-public-pool
   2. Specify the address or address prefix for NAT.
      [edit services nat pool acme-public-pool]user@host# set address public-address
   3. Configure the NAT port to be assigned automatically by the router.
      [edit services nat pool acme-public-pool]user@host# set port automatic
3. Configure the NAT rules.
   1. Specify the name of the NAT rule.
      user@host# top [edit]user@host# edit services nat rule acme-nat-rule
   2. Specify the direction in which the rule match is applied.
      [edit services nat rule acme-nat-rule]user@host# set match-direction input
   3. Define the NAT term actions.
      [edit services nat rule acme-nat-rule]user@host# set term translate then translated source-pool acme-public-pooluser@host# set translation-type napt-44

Configuring the Interface, Bridge Domain, and IRB Interface

1. Configure the interface for VLAN tagging and flexible Ethernet services encapsulation.
   [edit]user@host# edit interfaces ge-1/2/3 user@host# set vlan-tagginguser@host# set encapsulation flexible-ethernet-services
2. Configure the subscriber VLAN.
   1. Configure the logical interface.
      [edit interfaces ge-1/2/3]user@host# edit unit 105
   2. Configure the encapsulation for the logical interface.
      [edit interfaces ge-1/2/3 unit 105 ]user@host# set encapsulation vlan-bridge
   3. Bind an 802.1Q VLAN tag ID to the logical interface.
      [edit interfaces ge-1/2/3 unit 105]user@host# set vlan-id 105
   4. Configure the logical interface for Layer 2 bridging.
      [edit interfaces ge-1/2/3 unit 105]user@host# set family bridge
3. Configure the IRB interface.
   1. Configure the logical interface used for internal VPN traffic as the IRB interface.
      user@host# top[edit]user@host# set interfaces irb unit 105
   2. Specify the private subnet of the VPN site on the IRB interface.
      [edit interfaces irb unit 105]user@host# set family inet address 192.168.1.1/24
4. Configure the bridge domain.
   1. Configure the bridge domain name.
      user@host# top[edit]user@host# edit bridge-domains bd-105
   2. Associate the subscriber’s VLAN ID with the bridge domain.
      [edit bridge-domains bd-105]user@host# set vlan-id 105
   3. Specify the interface name for the bridge domain.
      [edit bridge-domains bd-105]user@host# set interface ge-1/2/3.105
   4. Specify the routing interface to include in the bridge domain.
      [edit bridge-domains bd-105]user@host# set routing-interface irb.105
5. Configure the routing instance.
   1. Configure the name of the routing instance.
      user@host# top[edit]user@host# edit routing-instances acme
   2. Configure the routing instance as a VRF instance.
      [edit routing-instances acme]user@host# set instance-type vrf
   3. Reference the IRB interface by specifying irb.vlan-id.
      [edit routing-instances acme]user@host# set interface irb.105
   4. Add the NAT inside interface to the routing instance by specifying the inside interface name and route distinguisher attached to the route.
      [edit routing-instances acme]user@host# set interface sp-2/0/0.1user@host# set route-distinguisher 65535:1
   5. Specify the VPN’s community. VRF import and export policies are automatically generated.
      [edit routing-instances acme]user@host# set vrf-target target:65535:5
   6. Map the inner label of a packet to a specific VRF table. This enables examination of the encapsulated IP header.
      [edit routing-instances acme]user@host# set vrf-table-label
   7. Add a static route to send Internet traffic to the inside interface of NAT service.
      [edit routing-instances acme]user@host# set routing-options static route 0.0.0.0/0 next-hop sp-2/0/0.1

      Note: You must advertise this route to remote PE routers through a VPN export policy.