Snat

These scenarios show how to configure SNAT (Source Network Address Translation) on OSDx.

Test SNAT 

Description 

In this scenario, DUT0 modifies the source address of outgoing packets generated at the LAN side. The address is translated to a custom one: 10.0.0.1.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat source rule 1 address 10.0.0.2
set interfaces ethernet eth1 traffic nat source rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 8080 tcp
admin@DUT2$ monitor test connection client 10.0.0.22 8080 tcp

Step 7: Initiate a udp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 5050 udp
admin@DUT2$ monitor test connection client 10.0.0.22 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=192.168.100.2 dst=10.0.0.22
src=10.0.0.22 dst=10.0.0.2

This scenario is similar to the previous one, but when masquerade is specified, the route uses the IP address of the outgoing interface. Therefore, masquerading should be configured if the outgoing interface uses a dynamic IP address.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 traffic nat source rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 8080 tcp
admin@DUT2$ monitor test connection client 10.0.0.22 8080 tcp

Step 7: Initiate a udp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 5050 udp
admin@DUT2$ monitor test connection client 10.0.0.22 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=192.168.100.2 dst=10.0.0.22
src=10.0.0.22 dst=10.0.0.2

Test SNAT Port Pool 

Description 

In this scenario, the translation is performed using masquerade with a pool of 3 ports. If at any time there are 3 active connections, the next one will be rejected.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 traffic nat source rule 1 port 1000-1003
set interfaces ethernet eth1 traffic nat source rule 1 protocol tcp
set interfaces ethernet eth1 traffic nat source rule 1 selector SEL
set interfaces ethernet eth1 traffic nat source rule 2 address masquerade
set interfaces ethernet eth1 traffic nat source rule 2 port 1000-1003
set interfaces ethernet eth1 traffic nat source rule 2 protocol udp
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 8080 tcp
admin@DUT2$ monitor test connection client 10.0.0.22 8080 tcp

Step 7: Initiate a udp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 5050 udp
admin@DUT2$ monitor test connection client 10.0.0.22 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=192.168.100.2 dst=10.0.0.22
src=10.0.0.22 dst=10.0.0.2

Test SNAT Network Prefix 

Description 

In this scenario, the translation is performed using a network prefix. The host part of the original IP address is kept, but the network part is mangled using a subnet prefix.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat source rule 1 network 10.0.0.0/24
set interfaces ethernet eth1 traffic nat source rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 8080 tcp
admin@DUT2$ monitor test connection client 10.0.0.22 8080 tcp

Step 7: Initiate a udp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 5050 udp
admin@DUT2$ monitor test connection client 10.0.0.22 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=192.168.100.2 dst=10.0.0.22
src=10.0.0.22 dst=10.0.0.2

Test SNAT Address Pool 

Description 

In this scenario, the translation is performed using a pool of IP addresses. The kernel picks one address from the pool per connection based on a hash of the source flow.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 address 10.0.0.3/24
set interfaces ethernet eth1 traffic nat source rule 1 address 10.0.0.2-10.0.0.3
set interfaces ethernet eth1 traffic nat source rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 8080 tcp
admin@DUT2$ monitor test connection client 10.0.0.22 8080 tcp

Step 7: Initiate a udp connection from DUT2 to DUT1 and exchange messages between both endpoints

admin@DUT1$ monitor test connection server 5050 udp
admin@DUT2$ monitor test connection client 10.0.0.22 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output matches the following regular expressions:

src=192.168.100.2 dst=10.0.0.22
src=10.0.0.22 dst=10.0.0.[23]