Re: No ping Proxy-ARP from LAN/DMZ

Hello,  

Thank you for your answer.

My config (partially) :

interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address XXX.XX.XX.90/29;
            }
        }
    }
    [...]
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop XXX.XX.XX.89;
    }
}

nat {
        source {
            pool IP_XXX_90 {
                description "IP XXX principale";
                address {
                    XXX.XX.XX.90/32 to XXX.XX.XX.90/32;
                }
            }
            pool IP_XXX_92 {
                description "IP XXX Extranet";
                address {
                    XXX.XX.XX.92/32 to XXX.XX.XX.92/32;
                }
            }
          
            rule-set DMZ_TO_WAN-XXX {
                description "DMZ to WAN XXX ";
                from zone [ DMZ LAN ];
                to zone Internet;
                rule Rule_Extranet {
                    description "Extranet NAT src";
                    match {
                        source-address 10.100.45.2/32;
                    }
                    then {
                        source-nat {
                            pool {
                                IP_XXX_92;
                            }
                        }
                    }
                }
            }
            rule-set LAN_TO_WAN-XXX {
                description "LAN to WAN XXX";
                from zone LAN;
                to zone Internet;
                rule Rule_LAN {
                    description "LAN NAT src";
                    match {
                        source-address 10.1.0.0/16;
                    }
                    then {
                        source-nat {
                            pool {
                                IP_XXX_90;
                            }
                        }
                    }
                }
            }
        
        destination {
            
            pool EXT-srv_any {
                address 10.100.45.2/32;
            }
           
            rule-set NAT-dst_WAN-XXX {
                description "NAT IP WAN XXX to expose server ";
                from zone Internet;
                
                rule Extranet-http {
                    description "Access Extranet server http";
                    match {
                        destination-address XXX.XX.XX.92/32;
                        destination-port 80;
                    }
                    then {
                        destination-nat {
                            pool {
                                EXT-srv_any;
                            }
                        }
                    }
                }
                rule Extranet-https {
                    description "Access Extranet server https";
                    match {
                        destination-address XXX.XX.XX.92/32;
                        destination-port 443;
                    }
                    then {
                        destination-nat {
                            pool {
                                EXT-srv_any;
                            }
                        }
                    }
                }
                rule Extranet-ping {
                    description "Access Extranet server ping";
                    match {
                        destination-address XXX.XX.XX.92/32;
                        protocol icmp;
                    }
                    then {
                        destination-nat {
                            pool {
                                EXT-srv_any;
                            }
                        }
                    }
                }
            }
        }
        proxy-arp {
            interface ge-0/0/0.0 {
                address {
                    XXX.XX.XX.91/32 to XXX.XX.XX.91/32;
                    XXX.XX.XX.92/32 to XXX.XX.XX.92/32;
                    XXX.XX.XX.93/32 to XXX.XX.XX.93/32;
                    XXX.XX.XX.94/32 to XXX.XX.XX.94/32;
                }
            }
        }
    }

[...]

zones {

        security-zone DMZ {
            description "DMZ Trimaran";
            interfaces {
                ge-0/0/4.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
            application-tracking;
        }
        security-zone Internet {
            description "WAN XXX";
            screen untrust-screen;
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
            application-tracking;
        }
        security-zone junos-host;
    }

Tkanks for KB article, i will read that :-)

Best regards.

Charlie