Out Policy With Snat

This scenario shows how important it is to choose the right priority when combining traffic policies and NAT configuration.

Test Interface Traffic Out Before SNAT

Description

This scenario shows the importance of configuring the different priorities of a traffic policy at the out hook when there’s also SNAT configuration.

Scenario

Example 1

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth1 address 20.0.0.1/24
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 traffic policy out POL priority high
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POL rule 1 selector SEL
set traffic selector SEL rule 1 source address 10.0.0.2

Step 2: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 3: Run command traffic policy show at DUT0 and check if output matches the following regular expressions:

1\s+SEL\s+[1-9]\d*\s+[1-9]\d*

Example 2

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth1 address 20.0.0.1/24
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 traffic policy out POL priority high
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POL rule 1 selector SEL
set traffic selector SEL rule 1 source address 20.0.0.1

Step 2: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 3: Run command traffic policy show at DUT0 and check if output matches the following regular expressions:

1\s+SEL\s+0\s+[1-9]\d*

Example 3

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth1 address 20.0.0.1/24
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 traffic policy out POL priority low
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POL rule 1 selector SEL
set traffic selector SEL rule 1 source address 10.0.0.2

Step 2: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 3: Run command traffic policy show at DUT0 and check if output matches the following regular expressions:

1\s+SEL\s+0\s+[1-9]\d*

Example 4

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.0.0.1/24
set interfaces ethernet eth1 address 20.0.0.1/24
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 traffic policy out POL priority low
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy POL rule 1 selector SEL
set traffic selector SEL rule 1 source address 20.0.0.1

Step 2: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1

Step 3: Run command traffic policy show at DUT0 and check if output matches the following regular expressions:

1\s+SEL\s+[1-9]\d*\s+[1-9]\d*