}
ICMP
The Internet Control Message Protocol (ICMP) is defined in RFC 792. The Junos OS allows
ICMP messages to be filtered by specific type or specific type code value. ICMP error
packets that lack a specifically configured type and code are matched against any existing
flow in the opposite direction to check for the legitimacy of the error packet. ICMP error
packets that pass the filter matching are subject to NAT translation.
The ICMP ALG always tracks ping traffic statefully using the ICMP sequence number.
Each echo reply is forwarded only if there is an echo request with the corresponding
sequence number. For any ping flow, only 20 echo requests can be forwarded without
receiving an echo reply. When you configure dynamic NAT, the PING packet identifier is
translated to allow additional hosts in the NAT pool to use the same identifier.
Support for NAT services requires that you configure the ICMP ALG if the protocol is
needed. You can configure the ICMP type and code for additional filtering.
TFTP
The Trivial File Transfer Protocol (TFTP) is specified in RFC 1350. The initial TFTP requests
are sent to UDP destination port 69. Additional flows can be created to get or put individual
files. Support of NAT services requires that you configure the TFTP ALG for UDP
destination port 69.
The following is an example for configuring TFTP ALG:
1. Creating NAT interface.
[edit]
services {
service-set set-tftp {
nat-rules nat-tftp;
interface-service {
service-interface ms-0/2/0;
}
}
2. Configuring NAT pool.
[edit]
services {
nat {
pool p-napt {
address 1.1.1.1/32;
}
}
}
3. Defining NAT rules for TFTP ALG.
[edit]
services {
Copyright © 2017, Juniper Networks, Inc.1016
ACX Series Universal Access Router Configuration Guide
To Next Page
Loading...
Need help?
General
