How do you implement NAT-T passthrough on a Juniper SRX series Firewall?

Question

We have 3 juniper SRX-100 firewalls, they are configured like so:

FW1 -> FW2 -> INTERNET -> FW3

We would like to create an IPSEC tunnel between FW3 and FW1 passing through FW2 preferably using NAT-T. Is this possible?

FW1 and FW2 have some strict access rules only allowing 1 port connected (it's a DMZ with a server in) so we can't just create a route based vpn between FW1 and FW2 to forward the traffic (otherwise all traffic will be forwarded)

We know the tunnel is fine because we have managed to test it between FW1 and FW3 (without FW2 in the middle) so we know that the issue is to do with the 'passthrough' on FW2.

Essentially, the question is - What options do we need to select on FW2 to enable it to pass through the IPSEC traffic straight to FW1?

Answer 1

if its anything like the SSG's then you could just create a port forward though (possibly)

Set a destination on VIP on the 'Dirty' side of FW2, with the 'host' being FW1, then just policy it through.

I'm no juniper expert, but it should let you forward through like that

Answer 2

The default settings that you used on the SRX will work fine (just don't set no-nat-transversal, which isn't default). As long as FW3 has a public, non-natted IP, the VPN will just come up. Also make sure you are in aggressive mode rather than main mode for the VPN.

And lastly, make sure you have 'ike' allowed in the host-inbound-services on the untrust side of FW1. I had some issues that had me scratching my head for a while that would allow a public ip<->public ip vpn come up, but when connecting behind a NAT, VPN wouldn't come up without IKE being allowed.