This blog post was spurred on by a recent real-world experience where I had to configure a primary IP address on an ISP facing interface. In this scenario, we needed to maintain the corporate ARIN assigned IP on an interface for VPN traffic to originate from and terminate on. Yet the ISP would only allow the customer to use the ISP provided IP address for BGP peering.
Fair warning, this is a bit of a long one and has a twist and turn. Also, take note that I am using interface overload NAT only for demonstration purposes.
There was some discussion around the primary and preferred interface commands, so why not learn more about it and, in turn, write a blog post about it.
Below is the lab diagram we will use for this blog post. I have preconfigured the devices to pass traffic with vSRX2 set to NAT all internal traffic to its outside (ge-0/0/2) interface. vSRX1, vSRX3, and vSRX4 are all configured in packet mode to keep the configurations simple. You can find a copy of the eve-ng topology, starting configs, and ending configs at the end of this post.
The subnets we are using for this lab are 192.0.2.0/24, 203.0.113.0/24, 204.0.113.0/24, 192.18.0.2/32, and 198.51.100.0/24. Each router is using the router number as its last octet (e.g. vSRX2 = 198.51.100.2/24). For the lab on vSRX2, we will be using an IP of 192.18.0.2/24, a primary address of 204.0.113.2/24, and preferred internal addresses of 198.51.100.102.
Preferred Command Section
Before we start to layer on the internal commands, let’s just take a look and see what the router uses with a simple interface config on ge-0/0/0.
root@vSRX2> show configuration interfaces ge-0/0/0
unit 0 {
family inet {
address 198.51.100.2/24;
}
}
A great thing with using eve-ng is that we can create a Wireshark capture on vSRX2 ge-0/0/0. This will allow us to see what is really happening on-the-wire.
To see what IP vSRX2 uses for communication to the internal network, we will ping vSRX3 (198.51.100.3) and vSRX4 (198.51.100.4). I am using the rapid command to just send a few, quick pings on Junos.
root@vSRX2> ping 198.51.100.3 rapid PING 198.51.100.3 (198.51.100.3): 56 data bytes !!!!! --- 198.51.100.3 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 3.867/4.669/5.009/0.412 ms root@vSRX2> ping 198.51.100.4 rapid PING 198.51.100.4 (198.51.100.4): 56 data bytes !!!!! --- 198.51.100.4 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss
Now we can take a quick look at our Wireshark capture to see what IP is being reported on the wire. As you can see, we are sourcing our traffic from the 198.51.100.2 IP address as expected.
Now we can go ahead and add another IP address of 198.51.100.102 to the vSRX2 ge-0/0/0 interface. We will just add the IP to the configuration.
[edit]
root@vSRX2# set interfaces ge-0/0/0.0 family inet address 198.51.100.102/24
[edit]
root@vSRX2# show interfaces ge-0/0/0.0
family inet {
address 198.51.100.2/24;
address 198.51.100.102/24;
}
Now that we have that committed on the device, time for another ping to see if there have been any changes. To keep things simple, I will just be pinging vSRX3 for the rest of this post.
root@vSRX2> ping 198.51.100.3 rapid PING 198.51.100.3 (198.51.100.3): 56 data bytes !!!!! --- 198.51.100.3 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.490/41.232/189.840/74.316 ms
Now when we check our Wireshark pcap, we can see that we are still souring our internal traffic from the 198.51.100.2 address.
It is time to set the preferred command for the 198.51.100.102 address and see what the results are.
[edit interfaces ge-0/0/0]
root@vSRX2# set unit 0 family inet address 198.51.100.102/24 preferred
[edit interfaces ge-0/0/0]
root@vSRX2# show
unit 0 {
family inet {
address 198.51.100.2/24;
address 198.51.100.102/24 {
preferred;
}
}
}
Once we have committed that, we can ping vSRX3 again.
root@vSRX2> ping 198.51.100.3 rapid PING 198.51.100.3 (198.51.100.3): 56 data bytes !!!!! --- 198.51.100.3 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.893/11.629/38.365/13.368 ms
When we examine the capture, we can see that vSRX2 is now, by default, sourcing its traffic from the 198.51.100.102 address, the one that we configured preferred on.
Now, what happens if we configure the 192.18.0.2/24 address under ge-0/0/0 and set it to primary? Well, let’s find out!
[edit interfaces ge-0/0/0]
root@vSRX2# set unit 0 family inet address 192.18.0.2/24 primary
[edit interfaces ge-0/0/0]
root@vSRX2# show
unit 0 {
family inet {
address 198.51.100.2/24;
address 198.51.100.102/24 {
preferred;
}
address 192.18.0.2/24 {
primary;
}
}
}
root@vSRX2> ping 198.51.100.3 rapid
PING 198.51.100.3 (198.51.100.3): 56 data bytes
!!!!!
--- 198.51.100.3 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 4.689/5.124/6.096/0.498 ms
When we look at our Wireshark capture, we see that we are still sourcing the traffic from the 198.51.100.102 address. This is because the preferred command is used for same-subnet (198.51.100.0/24) traffic.
Ok, we can remove that primary configuration under ge-0/0/0 so we can re-use that IP on ge-0/0/2 later on.
[edit]
root@vSRX2# rollback 1
load complete
[edit]
root@vSRX2# show | compare
[edit interfaces ge-0/0/0 unit 0 family inet]
address 192.18.0.2/24 {
primary;
}
Primary Command Section
Below is the interesting configuration on vSRX2 that we will be working with. You will notice that we have two security zones — TRUST ge-0/0/0 — and UNTRUST ge-0/0/2. We have an interface overload NAT configured that will NAT our internal network of 198.51.100.0/24 to our outside ge-0/0/2 IP address. Based on the initial configuration, that would be 203.0.113.2.
[edit]
root@vSRX2# show interfaces ge-0/0/2
unit 0 {
family inet {
address 203.0.113.2/24;
}
}
[edit]
root@vSRX2# show security nat
source {
rule-set Overload {
from zone TRUST;
to zone UNTRUST;
rule Overload {
match {
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
[edit]
root@vSRX2# show security zones
security-zone TRUST {
interfaces {
ge-0/0/0.0;
}
}
security-zone UNTRUST {
interfaces {
ge-0/0/2.0;
}
}
To verify that our NAT is working correctly, we can perform a PING from R3 to vSRX1 at 192.0.2.1.
root@vSRX3> ping 192.0.2.1 rapid PING 192.0.2.1 (192.0.2.1): 56 data bytes !!!!! --- 192.0.2.1 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 8.193/9.571/10.000/0.691 ms
Looking at the below packet capture we can see that we are NAT our traffic to the outside interface IP address, 203.0.113.2.
Now we can try and add the IP address of 204.0.113.2/32 to the ge-0/0/2 interface. Note that this will fail as the router will not permit a /32 host IP on a subnetted interface. A /25 will work, but not a /32.
[edit interfaces ge-0/0/2]
root@vSRX2# set unit 0 family inet address 204.0.113.2/32
[edit interfaces ge-0/0/2]
root@vSRX2# show
unit 0 {
family inet {
address 203.0.113.2/24;
address 204.0.113.2/32;
}
}
[edit interfaces ge-0/0/2]
root@vSRX2# commit check
[edit interfaces ge-0/0/2 unit 0 family inet]
'address 204.0.113.2/32'
A host address isn't allowed with any other address on the same family
error: configuration check-out failed
[edit interfaces ge-0/0/2]
root@vSRX2# set unit 0 family inet address 204.0.113.2/25 primary
[edit interfaces ge-0/0/2]
root@vSRX2# show
unit 0 {
family inet {
address 203.0.113.2/24;
address 204.0.113.2/25 {
primary;
}
}
}
[edit interfaces ge-0/0/2]
root@vSRX2# commit check
configuration check succeeds
[edit]
root@vSRX2# rollback 0
Ok, now we can go and add the IP address of 204.0.113.2/24to the outside interface configuration and PING again.
root@vSRX2# set interfaces ge-0/0/2.0 family inet address 192.18.0.2/24
[edit]
root@vSRX2# show interfaces ge-0/0/2
unit 0 {
family inet {
address 203.0.113.2/24;
address 204.0.113.2/24;
}
}
root@vSRX3> ping 192.0.2.1 rapid
PING 192.0.2.1 (192.0.2.1): 56 data bytes
!!!!!
--- 192.0.2.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 9.733/10.742/14.299/1.784 ms
As the packet captures shows, we are still NATing our traffic to 203.0.113.2.
So what happens when we add the primary keyword to the 204.0.113.2 address? Let’s find out.
[edit interfaces ge-0/0/2]
root@vSRX2# set unit 0 family inet address 204.0.113.2/24 primary
[edit interfaces ge-0/0/2]
root@vSRX2# show
unit 0 {
family inet {
address 203.0.113.2/24;
address 204.0.113.2/24 {
primary;
}
}
}
root@vSRX3> ping 192.0.2.1 rapid
PING 192.0.2.1 (192.0.2.1): 56 data bytes
!!!!!
--- 192.0.2.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 9.733/10.742/14.299/1.784 ms
After we performed our ping we review the Wireshark capture. As you can see, the SRX is now using the IP we set as primary (204.0.113.2) instead.
Twist time!
Now for a curious twist. What happens if, instead of 204.0.113.2 we use 192.18.0.2/24, and leave out the primary command?
[edit interfaces ge-0/0/2]
root@vSRX2# delete unit 0 family inet address 204.0.113.2/24
[edit interfaces ge-0/0/2]
root@vSRX2# set unit 0 family inet address 192.18.0.2/24
[edit interfaces ge-0/0/2]
root@vSRX2# show
unit 0 {
family inet {
address 203.0.113.2/24;
address 192.18.0.2/24;
}
}
As you can see, the SRX chooses the 192.18.0.2 address automatically. Why you may ask because lowest IP on an interface wins.
To sum it up
Use preferred when the destination is on the same subnet.
Use primary when the destination is on a different subnet.
And remember that Lowest IP wins.
| Starting Configs | Ending Configs |
| vSRX1 Starting vSRX2 Starting vSRX3 Starting vSRX4 Starting Lab Topology | vSRX1 Ending vSRX2 Ending vSRX3 Ending vSRX4 Ending |