SRX

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

Hello,

File attached.

Seems it all dropped by default deny policy..

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

the 2nd log file. it's more likely the matched traffic 

Hello,

File attached.

Seems it all dropped by default deny policy..

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

the 2nd log file. it's more likely the matched traffic 

Hello,

File attached.

Seems it all dropped by default deny policy..

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

Hello. I checked the first article prior your reply. But can't fully understand what I should do. Would you mind give me some clear instructions?

Should I create a new Firewall Rules for Outgoing traffic from DMZ1 to Internet and enable Packet mode?

Sorry..I'm relatively new to it.

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

the 2nd log file. it's more likely the matched traffic 

Hello,

File attached.

Seems it all dropped by default deny policy..

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

the 2nd log file. it's more likely the matched traffic 

Hello,

File attached.

Seems it all dropped by default deny policy..

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

the 2nd log file. it's more likely the matched traffic 

Hello,

File attached.

Seems it all dropped by default deny policy..

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-04-2025 00:45
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 00:33
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 23:56
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 12:01
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 11:43
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-04-2025 00:45
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 00:33
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 23:56
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 12:01
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 11:43
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Hello,

Just complete the configuration. 

What I removed so far.

1.Static Route section

2. FBF-1

Progress file upload again with Policy options, Route instances and Route options.

Will commit the change now

PS. Somehow first issue found. DHCP service for Line2's Trust Zone didn't work at all after reconfiguration. while DHCP services for Line1 works properly. Did touch anything related to DHCP or FBF-2 at all....

Been working for some time since 2 FBF created..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 01:05
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-04-2025 00:45
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 00:33
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 23:56
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 12:01
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 11:43
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

You shouldn't need this any more:

02011987@srx340# show routing-optionsinterface-routes {    rib-group inet IMPORT-PHY;}static {    route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];}rib-groups {    IMPORT-PHY {        import-rib [ inet.0 FBF-2.inet.0 ];    }}

and you don't need this:

FBF-2 {    routing-options {        static {            route 0.0.0.0/0 next-hop 10.254.254.1;        }

Also, what is "Line2's Trust Zone" ? The configuration you attached is only partial.

Hello,

Just complete the configuration. 

What I removed so far.

1.Static Route section

2. FBF-1

Progress file upload again with Policy options, Route instances and Route options.

Will commit the change now

PS. Somehow first issue found. DHCP service for Line2's Trust Zone didn't work at all after reconfiguration. while DHCP services for Line1 works properly. Did touch anything related to DHCP or FBF-2 at all....

Been working for some time since 2 FBF created..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 01:05
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-04-2025 00:45
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 00:33
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 23:56
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 12:01
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 11:43
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

Hello,

Please find the masked configuration file attached. the reply above sent yesterday. 

Static Route been removed yesterday , so it is fine.

Now I should remove entire interface-routes section?

as well as removing FBF2 ?

Please confirm because I'm not confident at all

Lastly,  the DHCP problem at irb.2  DHCP pool jdhcp-group - irb.2 , junosDHCPPool3 (junosRange3)  because this DHCP configured for zone Trust1. It worked in the past and after completed the reconfiguration, DHCP failed.

Thx again.

You shouldn't need this any more:

02011987@srx340# show routing-optionsinterface-routes {    rib-group inet IMPORT-PHY;}static {    route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];}rib-groups {    IMPORT-PHY {        import-rib [ inet.0 FBF-2.inet.0 ];    }}

and you don't need this:

FBF-2 {    routing-options {        static {            route 0.0.0.0/0 next-hop 10.254.254.1;        }

Also, what is "Line2's Trust Zone" ? The configuration you attached is only partial.

Hello,

Just complete the configuration. 

What I removed so far.

1.Static Route section

2. FBF-1

Progress file upload again with Policy options, Route instances and Route options.

Will commit the change now

PS. Somehow first issue found. DHCP service for Line2's Trust Zone didn't work at all after reconfiguration. while DHCP services for Line1 works properly. Did touch anything related to DHCP or FBF-2 at all....

Been working for some time since 2 FBF created..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 01:05
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-04-2025 00:45
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 00:33
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 23:56
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 12:01
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Unfortunately, the description of what you did is not enough to tell what's going on.  Feel free to include configuration file along with description of the problem.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 11:43
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

Thanks for your advice. I'll try to configure it as I can.

But the first question came to mind. Is there any configuration I need to remove? Let's say the default route? because I've created 2 routing instances with their default route, respectively. Then I removed the default route without any Firewall filter, applied it. Then my site-to-site VPN dropped immediately.

Just wanna confirm any config needs to remove. Thx

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-03-2025 01:53
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

The quirk that's not very obvious here is that when creating a session, the SRX performs a routing lookup for the reverse path of the session (i.e. traffic from your server back to the external client) in the routing instance to which the incoming interface (ge-0/0/1.0) belongs to (the default inet.0). In your case, inet.0 says route 0.0.0.0/0 should use ge-0/0/0.0 but you're trying to send traffic out of ge-0/0/1.0 and because the two interfaces are in different zones, your return traffic is dropped.

Packet-mode is the workaround suggested by the other forum thread. In packet mode, there's no session to speak of, no route look-ups recorded, no nothing. In fact, most if not all features you could possibly configure under security will not apply to packet-mode traffic. That's why I, personally, don't like it very much.

My personal preference is instead:

• Create routing-instance ISP of type virtual-router (allows you to add interfaces):
  • add interface ge-0/0/0.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.6
• Create routing-instance ISP1 of type virtual-router:
  • add interface ge-0/0/1.0
  • add static route 0.0.0.0/0 next-hop 10.254.254.1
• Define policies for route redistribution:
  • policy-options policy-statement ISP-first-then-ISP1
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
    • term isp1
      • from instance ISP1
      • from router-filter 0.0.0.0/0 exact
      • then preference 10
      • then accept
    • term isp
      • from instance ISP
      • from router-filter 0.0.0.0/0 exact
      • then preference 20
      • then accept
    • term else then reject
  • policy-statement needed-direct-routes
    • term direct
      • from instance master
      • from protocol direct
      • then accept
    • term else then reject
• Apply the policies:
  • set routing-instance ISP routing-options instance-import needed-direct-routes <-- you need this because traffic from the internet needs to know how to reach internal server
  • set routing-instance ISP1 routing-options instance-import needed-direct-routes
  • set routing-options instance-import ISP-first-then-ISP1
  • set routing-instance FBF2 routing-options instance-import ISP1-first-then-ISP
  • you don't really need FBF1 ... whatever doesn't use FBF2 will use the default inet.0 table to do the look-up that FBF1 would be doing.
• You'll also have to adjust your RPM problems to use the correct routing-instance (ISP or ISP1).
  • you can use RPM and IP-Monitoring to flag an ISP as broken, and then prevent broken routes from being exported:
    • let's pretend that 10.255.255.255/32 means "the internet is broken"
    • set services ip-monitoring policy Server-Tracking then preferred-route routing-instances ISP route 10.255.255.255/32 discard <-- it doesn't matter where the route goes; it only matters that it will exist when the RPM probe fails
    • set services ip-monitoring policy Server-Tracking1 then preferred-route routing-instances ISP1 route 10.255.255.255/32 discard
    • set policy-options condition ISP-is-broken if-route-exists 10.255.255.255/32 table ISP.inet.0
    • set policy-options condition ISP1-is-broken if-route-exists 10.255.255.255/32 table ISP1.inet.0
    • now we need to define a policy that will stop broken routes from being exported
    • policy-options policy-statement ISP-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP-is-broken
        • then reject
      • term else then accept
    • policy-options policy-statement ISP1-export
      • term stop-broken-routes
        • from router-filter 0.0.0.0/0 exact
        • from condition ISP1-is-broken
        • then reject
      • term else then accept
    • set routing-instance ISP routing-options instance-export ISP-export
    • set routing-instance ISP1 routing-options instance-export ISP1-export
  • with the export policy in place, even though the master and FBF2 routing instances will try to get route 0.0.0.0/0, the export policy prevent that route from showing up in inet.0 and FBF2.inet.0 if the conditions are true = if route 10.255.255.255/32 exists = if IP-Monitoring action is active = if RPM probes fail

It looks more convoluted, but I find this to be a lot more flexible. With this, no matter what 0.0.0.0/0 route is in inet.0 and FBF2.inet.0, when traffic arrives on ge-0/0/1.0 in routing-instance ISP1, there's is only one 0.0.0.0/0 route in ISP1.inet.0 so when the session performs reverse route lookup, it will necessarily select the same interface where traffic came in and you won't have the problem you're facing.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 00:33
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

I'm not clearly understand your meaning of create separate routing for both internet... because from my config. it didn't covered?

and I should configure something like below?

{device R1}

set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 from source-address 0.0.0.0/0
set firewall family inet filter bypass-flow-filter term bypass-flow-term–1 from destination-address 192.168.10.71/32
set firewall family inet filter bypass-flow-filter term bypass-flow-term-1 then packet-mode
set firewall family inet filter bypass-flow-filter term accept-rest then accept
set interfaces ge-0/0/1 description "Internal 1" unit 0 family inet filter input bypass-flow-filer   needed ?
set interfaces ge-0/0/2 description "Internal 2" unit 0 family inet filter input bypass-flow-filer   needed ?

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 12:14
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

This confirms my suspicion. See https://supportportal.juniper.net/s/article/FLOW-fast-path-pkt-reroute-failed?language=en_US

The FBF rules you have apply to connections initiated from the dmz1 server, but not to return traffic for a session initiated from the internet.

See this thread for a discussion of a similar problem: https://community.juniper.net/discussion/srx-pbr-or-fbf-for-retrurn-static-routing

You can place your two internet connections in separate routing instances, or, as that other thread suggests, use packet mode for these particular connections. Personally, I prefer the separate routing instances solution.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:49
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

the 2nd log file. it's more likely the matched traffic 

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:42
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,

File attached.

Seems it all dropped by default deny policy..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:36
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you will have connections attempts coming from the internet ALL the time. We're only interested in the lines that show server-host (whatever IP address that actually is, you have masked it in the configuration) and ports 443 and 8443. We have to see why those are dropped.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 11:28
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Thank you for your reply and reminder. Just modify the preshared key

Just ran the command and return a lot with   >>>     ",ge-0/0/1.0,Dropped by POLICY:Denied by Policy default-policy-logical-system-00"

Could you provide more information on why causing this and how to overcome.

regarding your message. I can let you know it is not the case. When traffic came in from Untrust1 to DMZ1 , the traffic on came from the same Broadband .  I'm not going let the traffic from Ge-0/0/0.0,  the traffic from Untrust1 is GE-0/0/1.0

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-02-2025 11:10
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

You didn't mask your IPsec pre-shared key. You should change it.

Use show security packet-drop records to see why the firewall is dropping packets. You can add | match server-host to get only the entries of interest. I suspect you will see messages about IP spoofing. When a packet for server-host arrives on ge-0/0/1.0, a route lookup shows that the route to the source of the packet is on ge-0/0/0.0 which is in a totally different zone. NOTE: the list of dropped packets will get filled up very quickly, so you should run the command as soon as possible after a failed connection.

To avoid this, I personally like placing different ISP connections in different routing instances and then use instance-import and instance-export rules to exchange routes between them as needed.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-02-2025 02:21
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello All,

This is my first post here. Recently I picked a SRX340 from a customer and trying  to replace 2 of SSG5 firewall & merge everything into a single box.

We had 2 Broadband and multiple IP address , multiple zones in each line (trust / dmz / untrust) in each line and link up both boxes(route between each other) for many years 

The SRC340 initial setup was completed while configured 2 Untrust / 2 Trust / 2 DMZ which similar to the past.  All outbound traffic to internet working properly with each Broadband properly.

However, I'm keep failing on the Inbound traffic while mostly of the traffic will be Static NAT for all the servers. Would like to seek some suggestions from expert.

. Below are the configuration in SRX configured so far

PS. there's a Huawei (ISP router) (what ever) while I configured a 10.254.254.1/32 & 10.254.254.5/30 IP to link up this router to SRX. I performed static NAT for the SRX untrust interface's IP.  while rest of the Public IP using static route to route them all to SRX untrust interface.  I did the same in SSG5 while I believe it should work the same in the SRX340

Thanks in advance

------------------------------
KWOK YIN WONG
------------------------------

You shouldn't need this any more:

02011987@srx340# show routing-optionsinterface-routes {    rib-group inet IMPORT-PHY;}static {    route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];}rib-groups {    IMPORT-PHY {        import-rib [ inet.0 FBF-2.inet.0 ];    }}

and you don't need this:

FBF-2 {    routing-options {        static {            route 0.0.0.0/0 next-hop 10.254.254.1;        }

Also, what is "Line2's Trust Zone" ? The configuration you attached is only partial.

Hello,

Just complete the configuration. 

What I removed so far.

1.Static Route section

2. FBF-1

Progress file upload again with Policy options, Route instances and Route options.

Will commit the change now

PS. Somehow first issue found. DHCP service for Line2's Trust Zone didn't work at all after reconfiguration. while DHCP services for Line1 works properly. Did touch anything related to DHCP or FBF-2 at all....

Been working for some time since 2 FBF created..

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 01:05
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

CLI only.

You can't configure it halfway when you're remote.

In general, whenever there's doubt the configuration change may interrupt your access to the device, you should use commit confirmed so that JunOS will rollback the changes if you lose access and are unable to confirm the changes.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-04-2025 00:45
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Sorry for my silly request.  Is all steps you mentioned before are configurable in SRX UI ? or I had to use the CLi ?

Seems I only have once chance to make it right if configuring it remotely. Because once I complete the first section (Virtual router with Static Route) and commit. I lost all internet access.

------------------------------
KWOK YIN WONG

Original Message:
Sent: 06-04-2025 00:33
From: Nikolay Semov
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Yes, you should remove that section, but not before everything else is added. Otherwise, you're losing your routes in the internet.

I may have typo here and there (e.g. the correct keyword is route-filter, not router-filter). The reason I presented this as bullet points instead of exact configuration is that I wrote it on the fly, and not copy-paste from JunOS, so it may contain silly mistakes like that.

------------------------------
Nikolay Semov

Original Message:
Sent: 06-03-2025 23:56
From: KWOK YIN WONG
Subject: Dual WAN / Static NAT not working. Inbound traffic not working

Hello,,

What I meant is there any lines of config required to remove, regarding to your suggestion.

Because last night I tried to remove the section below and lost all connectivity to SRX

Sorry, I'm able to understand the first section from your reply and not so sure what I need to add afterwards....

Section removed last night

static {
        route 0.0.0.0/0 next-hop [ 10.254.254.6 10.254.254.1 ];
    }

E.g dont know how to add "from router-filter 0.0.0.0/0 exact ??

• policy-statement ISP1-first-then-ISP   <-- same as above, but the preferences will be swapped
  • term isp1
    • from instance ISP1
    • from router-filter 0.0.0.0/0 exact                               >>>>> how to add ?
    • then preference 10
    • then accept
  • term isp
    • from instance ISP
    • from router-filter 0.0.0.0/0 exact
    • then preference 20
    • then accept
  • term else then reject
• policy-statement needed-direct-routes
  • term direct
    • from instance master
    • from protocol direct
    • then accept
  • term else then reject