SRX Plugin Cannot add Port Forwarding Rule

[richardlawley]

ISSUE TYPE

• Bug Report

COMPONENT NAME

SRX Plugin

CLOUDSTACK VERSION

4.11.2

CONFIGURATION

Advanced Networking

OS / ENVIRONMENT

Model: srx345-dual-ac
Junos: 15.1X49-D110.4
JUNOS Software Release [15.1X49-D110.4]

SUMMARY

When trying to add a port forwarding rule, it fails with a syntax error. If this ever worked, then I suspect the syntax of the API command has changed since JunOS 10, which from the hardware compatibility list may be what worked.

STEPS TO REPRODUCE

Add a port forwarding rule

EXPECTED RESULTS

Port Forwarding rule should be added, creating a destination nat rule on the SRX

ACTUAL RESULTS

2019-06-05 16:44:44,452 DEBUG [c.c.n.r.JuniperSrxResource] (DirectAgent-287:ctx-8a4e6665) (logid:be9407ed) Sending request:
<rpc>                                                                                                                                                                                                                                
    <load-configuration>                                                                                                                                                                                                             
    <configuration>                                                                                                                                                                                                                  
        <security>                                                                                                                                                                                                                   
            <nat>                                                                                                                                                                                                                    
                <destination>                                                                                                                                                                                                        
                    <rule-set>                                                                                                                                                                                                       
                    <name>untrust</name>                                                                                                                                                                                             
                    <from>                                                                                                                                                                                                           
                        <zone>untrust</zone>                                                                                                                                                                                         
                    </from>                                                                                                                                                                                                          
                    <rule>                                                                                                                                                                                                           
                        <name>destnatrule-1798423542</name>                                                                                                                                                                          
                        <dest-nat-rule-match><destination-address><dst-addr>XX.XX.XX.XX (XX-XX-XX-XX.XXXXXXXX.net)</dst-addr></destination-address><destination-port><dst-port>80</dst-port></destination-port></dest-nat-rule-match>
                        <then>                                                                                                                                                                                                       
                            <destination-nat>                                                                                                                                                                                        
                            <pool><pool-name>10-9-160-193-80</pool-name></pool>                                                                                                                                                      
                            </destination-nat></then>                                                                                                                                                                                
                    </rule>                                                                                                                                                                                                          
                    </rule-set></destination>                                                                                                                                                                                        
            </nat>                                                                                                                                                                                                                   
        </security>                                                                                                                                                                                                                  
    </configuration>                                                                                                                                                                                                                 
    </load-configuration></rpc>                                                                                                                                                                                                      
                                                                                                                                                                                                                                     
2019-06-05 16:44:44,495 DEBUG [c.c.n.r.JuniperSrxResource] (DirectAgent-287:ctx-8a4e6665) (logid:be9407ed)                                                                                                                           
 Checking response: <rpc-reply xmlns:junos="http://xml.juniper.net/junos/15.1X49/junos"><load-configuration-results>                                                                                                                 
<xnm:error xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juniper.net/xnm/1.1/xnm">                                                                                                                                
    <token>dst-port</token>                                                                                                                                                                                                          
    <message>syntax error</message>                                                                                                                                                                                                  
</xnm:error>                                                                                                                                                                                                                         
<xnm:error xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juniper.net/xnm/1.1/xnm">                                                                                                                                
    <token>dst-port</token>                                                                                                                                                                                                          
    <message>syntax error</message>                                                                                                                                                                                                  
</xnm:error>                                                                                                                                                                                                                         
<load-error-count>2</load-error-count></load-configuration-results></rpc-reply>     

[richardlawley]

I will attempt to fix this, hopefully in time for 4.11.3

[richardlawley]

This was fixable by changing the script template at scripts/network/juniper/dest-nat-rule-add.xml - replacing with .

Before submitting this as a PR, I would welcome thoughts on whether this is ever likely to have worked in the past - if so it may turn out that the fix for more modern JunOS breaks older versions. However, the version on the supported hardware list (JunOS 10) went EOL in 2014.

[rohityadavcloud]

@richardlawley can you start a discussion on dev and users ML. I don't think most of us have srx/infra to test your fix.

[richardlawley]

@rhtyd I've submitted which a fix that makes the plugin usable on later versions with one manual change to the script XML file - this was to not break compatibility for anyone still using the very old versions.

Need to work out how to address it going forward in the next version though.