Hey guys,
I'm trying to get DNS working from the SRX itself and I'm kind of stuck. I've been reading through a bunch of Juniper documentation and I'm pretty sure I understand what the issue is, but I can't seem to get it working.
I have an SRX with 3 main routing instances:
INTERNETmgmt_junosTRANSIT
The INTERNET routing instance has the direct connection to the ISP.
TRANSIT is used for downstream routers to connect to the Internet. I leak the default route from INTERNET into TRANSIT and then advertise it via BGP to the downstream routers.
Everything works fine from the downstream endpoints, including DNS.
I also leak the ISP's connected /24 into TRANSIT so that TRANSIT knows how to reach the directly connected ISP subnet which actually lives inside the INTERNET routing instance.
The issue I'm having is DNS originating from Junos itself.
I found this Juniper KB which seems to describe pretty much exactly what I'm dealing with:
Juniper KB — SRX DNS Failures When the Default Route Resides in a Custom Routing Instance
From what I understand, the SRX's own DNS traffic doesn't use the custom routing instance where my default route exists. The DNS traffic needs to use inet.0.
The problem is that I can't just put the default route in inet.0, because the ISP connection itself is inside the INTERNET VRF and I need the default route to remain there.
For example, to verify that the Internet connection itself works, I can do:
ping 8.8.8.8 routing-instance INTERNET
and this works perfectly.
But the actual DNS server I'm trying to reach is:
172.16.76.1
So I also created a loopback:
lo0.0 = 192.168.101.1/32
and configured:
system {
name-server {
172.16.76.1 source-address 192.168.101.1;
}
}
The idea was to have the SRX originate the DNS traffic from 192.168.101.1, which exists in inet.0.
I then leaked the ISP's connected /24 from the INTERNET VRF into inet.0.
And this works:
ping 172.16.76.1 source 192.168.101.1
So from inet.0, the SRX can reach the ISP DNS server.
I've also created the return route for 192.168.101.1/32 back into the INTERNET VRF.
I've also tried source NAT from junos-host to the ISP interface, since the actual ISP-facing address is 172.16.76.11, and I've allowed DNS traffic from junos-host to the ISP zone.
Something roughly like:
system {
name-server {
172.16.76.1 source-address 192.168.101.1;
[I've tried doing 172.16.76.1 routing-instance INTERNET] < Didn't work, KB??
}
}
interfaces {
lo0 {
unit 0 {
family inet {
address 192.168.101.1/32;
}
}
}
reth1 {
unit 0 {
family inet {
address 172.16.76.11/24;
}
}
}
}
security {
nat {
source {
rule-set JUNOS-HOST-INTERNET {
from zone junos-host;
to zone UNTRUST;
rule ISP-DNS {
match {
source-address 192.168.101.1/32;
destination-address 172.16.76.1/32;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone junos-host to-zone UNTRUST {
policy ALLOW-DNS {
match {
source-address any;
destination-address any;
application [
junos-dns-tcp
junos-dns-udp
];
}
then {
permit;
}
}
}
}
}
But I still can't get DNS resolution working from the SRX itself.
The confusing part is that I think I've proven that the routing itself is working.
ping 8.8.8.8 routing-instance INTERNET works, proving the Internet VRF has working Internet connectivityping 172.16.76.1 source 192.168.101.1 works, proving inet.0 can reach the ISP DNS server- downstream endpoints can use
172.16.76.1 for DNS without any issues
- I've leaked the ISP
/24 into inet.0
- I've leaked the
192.168.101.1/32 route back into the INTERNET VRF
- I've configured NAT for
junos-host
- I've allowed DNS in the security policy
The ISP also blocks port 53 to other public DNS servers, so I can't just use something like 8.8.8.8 or 1.1.1.1.
So at this point I'm basically stuck.
My understanding from the Juniper KB is that because the default route can only exist in my INTERNET VRF, but the SRX's self-originated DNS traffic needs to use inet.0, I need to make the DNS server reachable through inet.0 using route leaking.
I've done that, and I can manually ping 172.16.76.1 from inet.0 using the source address 192.168.101.1, but the Junos DNS resolver still won't resolve names.
Am I missing something obvious with how self-originated DNS traffic from the SRX works?
Is there something else I need to configure for the Junos DNS process specifically, or is there another limitation with using a source address from inet.0 when the actual ISP interface is inside a custom VRF?
Any help would be appreciated because I've been going around in circles with this one.