How do you implement NAT-T passthrough on a Juniper SRX series Firewall?

Question

I've followed Codeigniter language and all seems to be setup as a hook.

function pick_language() {

    require_once(APPPATH.'/config/language.php');

    session_start();

    // Lang set in URL via ?lang=something
    if(!empty($_GET['lang']))
    {
        // Turn en-gb into en
        $lang = substr($_GET['lang'], 0, 2);
        $_SESSION['lang_code'] = $lang;
    }

    // Lang has already been set and is stored in a session
    elseif( !empty($_SESSION['lang_code']) )
    {
        $lang = $_SESSION['lang_code'];
    }

    // Lang has is picked by a user.
    // Set it to a session variable so we are only checking one place most of the time
    elseif( !empty($_COOKIE['lang_code']) )
    {
        $lang = $_SESSION['lang_code'] = $_COOKIE['lang_code'];
    }

    // Still no Lang. Lets try some browser detection then
    else if (!empty( $_SERVER['HTTP_ACCEPT_LANGUAGE'] ))
    {
        // explode languages into array
        $accept_langs = explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']);

        log_message('debug', 'Checking browser languages: '.implode(', ', $accept_langs));

        // Check them all, until we find a match
        foreach ($accept_langs as $lang)
        {
            // Turn en-gb into en
            $lang = substr($lang, 0, 2);

            // Check its in the array. If so, break the loop, we have one!
            if(in_array($lang, array_keys($config['supported_languages'])))
            {
                break;
            }
        }
    }

    // If no language has been worked out - or it is not supported - use the default
    if(empty($lang) or !in_array($lang, array_keys($config['supported_languages'])))
    {
        $lang = $config['default_language'];
    }

    // Whatever we decided the lang was, save it for next time to avoid working it out again
    $_SESSION['lang_code'] = $lang;

    // Load CI config class
    $CI_config =& load_class('Config');

    // Set the language config. Selects the folder name from its key of 'en'
    $CI_config->set_item('language', $config['supported_languages'][$lang]['folder']);

    // Sets a constant to use throughout ALL of CI.
    define('CURRENT_LANGUAGE', $lang);
}

Now when I try to access $config['supported_languages'] it returns null or errors. Why?

Solution 1

The default settings that you used on the SRX will work fine (just don't set no-nat-transversal, which isn't default). As long as FW3 has a public, non-natted IP, the VPN will just come up. Also make sure you are in aggressive mode rather than main mode for the VPN.

And lastly, make sure you have 'ike' allowed in the host-inbound-services on the untrust side of FW1. I had some issues that had me scratching my head for a while that would allow a public ip<->public ip vpn come up, but when connecting behind a NAT, VPN wouldn't come up without IKE being allowed.

Solution 2

if its anything like the SSG's then you could just create a port forward though (possibly)

Set a destination on VIP on the 'Dirty' side of FW2, with the 'host' being FW1, then just policy it through.

I'm no juniper expert, but it should let you forward through like that

Comments

[SpacemanSpiff]

I'm almost positive NAT-T is permitted by default.