Junos SRX Source NAT and Destination NAT Configuration

NAT on a Juniper SRX is configured under the security nat hierarchy and split into two independent rule-sets: source NAT, which rewrites the source address of traffic leaving a zone, and destination NAT, which rewrites the destination address of traffic arriving from an untrusted network. Unlike a simple firewall rule, NAT rules are evaluated in order and matched by zone pair, so a missing from zone or to zone statement is the most common reason a translation silently never happens. This guide walks through interface-based and pool-based source NAT, static and pool-based destination NAT, the proxy ARP requirement that catches most engineers out, and the show commands that prove which rule actually matched a flow.

How SRX NAT Rule Evaluation Works

Every NAT rule lives inside a rule-set, and each rule-set is bound to a zone pair with from zone and to zone statements. Traffic is matched top-down inside the rule-set, so order matters: a broad rule placed first will shadow a more specific rule below it. Source and destination NAT are evaluated separately, which is why a single packet can be translated twice.

Both rule types use the same building blocks: a match condition (source address, destination address, or application) and an action (translate to an interface, or translate to a pool). A pool is a named object holding one or more addresses, optionally with a port range and with PAT enabled or disabled.

Configuring Source NAT with an Interface

Interface source NAT, also called interface overload, translates all matching traffic to the IP address of the egress interface. It is the standard way to give an internal network internet access through a single public address:

set security nat source rule-set TRUST-TO-UNTRUST from zone trust
set security nat source rule-set TRUST-TO-UNTRUST to zone untrust
set security nat source rule-set TRUST-TO-UNTRUST rule SNAT-1 match source-address 192.168.1.0/24
set security nat source rule-set TRUST-TO-UNTRUST rule SNAT-1 then source-nat interface

Interface overload versus pool-based translation

Two things trip people up here. First, no source NAT pool is required for egress-interface translation, and second, proxy ARP is not needed for that interface. Adding proxy ARP to the interface that already holds the translated address produces a commit error like Proxy ARP IP address range overlaps with interface IP address range, because a /30 or /31 interface has no spare addresses to answer for.

Configuring Source NAT with an Address Pool

Pool-based source NAT is used when you own a block of public addresses, need to preserve source ports for logging, or want to separate traffic from different internal subnets across different public addresses. Define the pool first, then reference it from a rule:

set security nat source pool SNAT-POOL-1 address 203.0.113.10 to 203.0.113.20
set security nat source rule-set TRUST-TO-UNTRUST rule SNAT-2 match source-address 10.10.0.0/16
set security nat source rule-set TRUST-TO-UNTRUST rule SNAT-2 then source-nat pool SNAT-POOL-1

PAT is enabled by default on a pool. To keep a one-to-one mapping without port translation, disable PAT and make the pool the same size as the translated subnet:

set security nat source pool SNAT-NOPAT-1 address 203.0.113.30 to 203.0.113.40
set security nat source pool SNAT-NOPAT-1 port no-translation

If the pool is exhausted, an overflow pool of type interface lets the SRX fall back to the egress interface address rather than dropping traffic:

set security nat source pool SNAT-OVERFLOW address 203.0.113.50/32
set security nat source pool SNAT-OVERFLOW overflow-pool interface

Configuring Destination NAT for Inbound Servers

Destination NAT publishes an internal server on a public address. Static NAT is the right tool for one-to-one publishing, while destination pools support many-to-many or port-restricted mapping. A static NAT with the port mapping creates the inbound and outbound translations at once:

set security nat static rule-set INBOUND-RS from zone untrust
set security nat static rule-set INBOUND-RS rule WEB-SERVER match destination-address 203.0.113.80/32
set security nat static rule-set INBOUND-RS rule WEB-SERVER then static-nat prefix 10.10.20.5/32

When the public address differs from the interface address, the SRX must answer ARP on behalf of the translated address. This is the one case where proxy ARP is required:

set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.80/32

Static NAT versus destination pool

For a destination pool, map the public address to the private server with an explicit port:

set security nat destination pool DNAT-WEB address 10.10.20.5/32
set security nat destination pool DNAT-WEB address port 8080
set security nat destination rule-set INBOUND from zone untrust
set security nat destination rule-set INBOUND rule WEB match destination-address 203.0.113.80/32
set security nat destination rule-set INBOUND rule WEB match destination-port 80
set security nat destination rule-set INBOUND rule WEB then destination-nat pool DNAT-WEB

Security Policy Is Still Required

NAT does not grant access by itself. You still need a security policy permitting the post-translation zones and the translated addresses, which is why a working NAT rule can still show zero sessions:

set security policies from-zone untrust to-zone trust policy ALLOW-WEB match source-address any
set security policies from-zone untrust to-zone trust policy ALLOW-WEB match destination-address 10.10.20.5/32
set security policies from-zone untrust to-zone trust policy ALLOW-WEB match application junos-http
set security policies from-zone untrust to-zone trust policy ALLOW-WEB then permit

Verifying NAT on an SRX

Check the configuration, then confirm the runtime translation tables are actually populated:

show configuration security nat
show security nat source summary
show security nat source rule all
show security nat source pool all
show security nat destination summary
show security nat static rule all
show security nat proxy-arp
show security flow session summary

The per-rule output includes translation and session counters. If a rule shows zero sessions while traffic is definitely arriving, walk the list in this order: zone pair on the rule-set, address match in the rule, security policy, then session setup. If the translation is happening but the return path fails, look at show security flow session for the session state and confirm the proxy ARP entry exists for the translated destination.

Operational Notes

• Rule order is evaluated top-down within a rule-set — put specific rules above catch-all rules.
• Interface source NAT needs no pool and no proxy ARP; pool-based NAT needs proxy ARP only when the translated addresses are not on the egress interface.
• Disabling PAT requires a pool at least as large as the translated address range, otherwise sessions are dropped once addresses run out.
• Use secure-wire or a dedicated zone pair rather than mixing translated and untranslated traffic in the same rule-set to keep troubleshooting simple.

For related reading see our Junos SRX security policy configuration guide, the Junos firewall filter term from/then reference, and the Junos static route and qualified next-hop guide.

原文链接：https://www.juniper.net/documentation/en_US/junos/topics/topic-map/nat-security-source-and-source-pool.html