Junos NAT
Doing NAT is very easy with SRX indeed. For example:
SOURCE NAT (INTERFACE BASED)
[edit security nat]
root@host# show | display set
set security nat source rule-set rs1 from zone trust
set security nat source rule-set rs1 to zone untrust
set security nat source rule-set rs1 rule rl1 match source-address 10.200.2.0/24
set security nat source rule-set rs1 rule rl1 then source-nat interface
We create one rule (rl1) inside a rule set (rs1) and NATing 10.200.20.0/24 network to the address of the exit interface. Pretty easy.
SOURCE NAT (WITH POOL)
[edit security nat]
root@host# show | display set
set security nat source pool pool-admins address 212.23.2.1 to 212.23.2.20
set security nat source rule-set rs1 from zone trust
set security nat source rule-set rs1 to zone untrust
set security nat source rule-set rs1 rule rl1 match source-address 10.200.2.0/24
set security nat source rule-set rs1 rule rl1 then source-nat pool pool-admins
In this pool example, instead of using interface address, we use addresses in the range 212.23.2.1 – 212.23.2.20
**TIP: If you need address persistence you should to set the following;
set security nat source address-persistent
STATIC NAT
Can you see the mistake here? I thought that I can configure static nat just like above and Junos complaint because it is obligatory to have a one-to-one match in masks. We can use this NAT, from untrust to inside network in the following way;
This is a very nice summary of NAT for JUNOS. Thank you! My only question, how would you do a port forward in JUNOS?
Hi Jimmy,
If you use destination-port option in your rule in addition to destination address and add “port” option into the pool, that should work I guess for your destination nat.
rule rl1 {
match {
destination-address 172.30.73.78/32;
destination-port 8080;
}