Here is my issue: JunOS 10.3R4 based firewall device that doesn't do source based routing. For this they recommend filtering. I have a guest wireless that is now 'working' with 2 zones (other zones are internal.)
IE
ArubaGuest > NAT table > Untrust and a policy that (at the moment) is Any:any ArubaGuest to Untrust. What I want to do is force *all* traffic out to the internet from that range and for it to ignore any routing tables it finds otherwise. The BGP routing table contains address that would route data from the guest wireless (which is basically 'untrust') through the internal networks. I would rather that data go out to the internet and land on the Datacenters firewalls. I did this on the netscreen's using a source based route that forced it in to 'untrust' which then dumped it to the internet. The JunOS unit recommends doing a forwarding routing instance that forwards packets.
IE:
Putting this in the config makes the traffic go to the router but skips the NAT. I really need the guest network to NAT then be forced to the internet. All the examples only show redirecting to IPs.
Ideas?
IE
ArubaGuest > NAT table > Untrust and a policy that (at the moment) is Any:any ArubaGuest to Untrust. What I want to do is force *all* traffic out to the internet from that range and for it to ignore any routing tables it finds otherwise. The BGP routing table contains address that would route data from the guest wireless (which is basically 'untrust') through the internal networks. I would rather that data go out to the internet and land on the Datacenters firewalls. I did this on the netscreen's using a source based route that forced it in to 'untrust' which then dumped it to the internet. The JunOS unit recommends doing a forwarding routing instance that forwards packets.
IE:
Code:
firewall {
filter ArubaGuest {
term 1 {
from {
source-address {
172.17.0.0/16;
}
}
then {
routing-instance ArubaGuestRedirect;
}
}
term 2 {
then accept;
}
}
}
routing-instances {
ArubaGuestRedirect {
instance-type forwarding;
routing-options {
static {
route 0.0.0.0/0 next-hop 1.2.3.4;
}
}
}
}Putting this in the config makes the traffic go to the router but skips the NAT. I really need the guest network to NAT then be forced to the internet. All the examples only show redirecting to IPs.
Ideas?
Facebook
Twitter