Srx Nat

SRX NAT

Overview

SRX NAT is flow-based translation performed during first-packet session setup. Use this skill to reason about how Junos chooses a NAT rule, how translated addresses affect route and policy lookup, and how to verify the resulting session wings.

Core SRX NAT types:

• Source NAT changes the client/source address after route and security policy lookup. It is used for Internet access, carrier-grade NAT, NAT64 source translation, and hairpin return symmetry.
• Destination NAT changes the destination before route and security policy lookup. It is used for publishing inside servers behind public or shared addresses.
• Static NAT is bidirectional 1:1 or prefix translation. It has higher precedence than destination NAT, and reverse static NAT has higher precedence than source NAT.
• NAT64 on SRX is usually built with static NAT inet destination extraction from 64:ff9b::/96 plus a normal source NAT action to a reachable IPv4 source.

Always inspect the translated session, not only the configuration. Correct NAT configuration with wrong routes, policy, proxy ARP, or return path still fails.

Scope and routing

Use this skill for SRX NAT behavior after relevant configuration is identified. Use parsing-srx-configs for full-config extraction and srx-policy for post-translation policy design.

NAT Processing Order

For the first packet of a flow, SRX processes NAT and lookup in this order:

1. Static NAT rules
2. Destination NAT rules
3. Route lookup
4. Security policy lookup
5. Reverse mapping of static NAT rules
6. Source NAT rules

Operational consequences:

• Static NAT takes precedence over destination NAT.
• Destination NAT and static NAT happen before route lookup. Their rule sets match source interface, source zone, or source routing instance; they cannot match destination zone/interface/routing-instance because that has not been resolved yet.
• Security policy lookup happens after destination/static NAT, so the policy usually matches the translated destination and the post-NAT egress zone.
• Source NAT happens after route and policy lookup, so source NAT rule sets use both from and to contexts.
• Reverse static NAT takes precedence over source NAT for return traffic.
• NAT64 source NAT must match an IPv4 destination because static NAT64 translated the destination from 64:ff9b::/96 to IPv4 before source NAT evaluation.

Rule-Set Selection and Rule Order

Static and Destination NAT Rule-Set Specificity

For static NAT and destination NAT, if multiple rule sets match, SRX chooses the more specific source-side match:

1. Source interface
2. Source zone
3. Source routing instance

Source NAT Rule-Set Specificity

Source NAT rule-set choice considers source and destination context. In decreasing specificity:

1. Source interface + destination interface
2. Source zone + destination interface
3. Source routing instance + destination interface
4. Source interface + destination zone
5. Source zone + destination zone
6. Source routing instance + destination zone
7. Source interface + destination routing instance
8. Source zone + destination routing instance
9. Source routing instance + destination routing instance

Rule Order Within a Rule Set

Within the chosen rule set, rules are evaluated top-down and the first matching rule wins.

Design rules:

• Put no-NAT and exception rules above broad NAT rules.
• Put persistent NAT / gaming / special application rules above normal CGN rules.
• Put specific host/server rules above subnet or any rules.
• Use distinct rule-set names that encode direction, such as TRUST_TO_UNTRUST, DNAT_IN, or HAIRPIN.
• After reordering, generate traffic and check translation hits rather than assuming the intended rule is used.

Basic Source NAT Patterns

Interface Source NAT

Use this when inside clients should overload on the egress interface address.

set security nat source rule-set TRUST_TO_UNTRUST from zone trust
set security nat source rule-set TRUST_TO_UNTRUST to zone untrust
set security nat source rule-set TRUST_TO_UNTRUST rule SRC_NAT match source-address 192.168.1.0/24
set security nat source rule-set TRUST_TO_UNTRUST rule SRC_NAT match destination-address 0.0.0.0/0
set security nat source rule-set TRUST_TO_UNTRUST rule SRC_NAT then source-nat interface

Verify:

show security nat source rule all
show security flow session source-prefix 192.168.1.10 extensive

Pool Source NAT

Use a pool when the translated source must be a specific address or prefix.

set security nat source pool SRC_POOL address 203.0.113.10/32
set security nat source rule-set TRUST_TO_UNTRUST from zone trust
set security nat source rule-set TRUST_TO_UNTRUST to zone untrust
set security nat source rule-set TRUST_TO_UNTRUST rule SRC_POOL_NAT match source-address 192.168.1.0/24
set security nat source rule-set TRUST_TO_UNTRUST rule SRC_POOL_NAT match destination-address 0.0.0.0/0
set security nat source rule-set TRUST_TO_UNTRUST rule SRC_POOL_NAT then source-nat pool SRC_POOL

If the pool address is on a directly connected external subnet and the upstream device expects ARP for it, configure proxy ARP or, preferably, route the pool prefix to the SRX.

set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.10/32

Destination NAT and Static NAT Patterns

Destination NAT for a Published Server

Example: public 203.0.113.20:443 to inside server 192.168.10.20:443.

set security nat destination pool WEB_SERVER address 192.168.10.20/32
set security nat destination rule-set DNAT_IN from zone untrust
set security nat destination rule-set DNAT_IN rule WEB_HTTPS match destination-address 203.0.113.20/32
set security nat destination rule-set DNAT_IN rule WEB_HTTPS match destination-port 443
set security nat destination rule-set DNAT_IN rule WEB_HTTPS then destination-nat pool WEB_SERVER

Port translation (port forwarding, e.g. public :8443 → inside :443) is configured on the pool, not the rule (verified on vSRX 24.4R1 — ... pool port on the rule is a syntax error):

set security nat destination pool WEB_SERVER_443 address 192.168.10.20/32 port 443
set security nat destination rule-set DNAT_IN rule WEB_ALT match destination-port 8443
set security nat destination rule-set DNAT_IN rule WEB_ALT match destination-address 203.0.113.20/32
set security nat destination rule-set DNAT_IN rule WEB_ALT then destination-nat pool WEB_SERVER_443

Security policy must permit the translated path:

set security policies from-zone untrust to-zone trust policy ALLOW_WEB match source-address any
set security policies from-zone untrust to-zone trust policy ALLOW_WEB match destination-address WEB_SERVER_ADDR
set security policies from-zone untrust to-zone trust policy ALLOW_WEB match application junos-https
set security policies from-zone untrust to-zone trust policy ALLOW_WEB then permit
set security policies from-zone untrust to-zone trust policy ALLOW_WEB then log session-init
set security policies from-zone untrust to-zone trust policy ALLOW_WEB then log session-close

Important checks:

• Is the public IP routed to the SRX, assigned to the external interface, or answered by proxy ARP?
• Does show security nat destination rule all show translation hits?
• Does the session show the post-DNAT destination and expected egress zone?
• Does the inside server route its return traffic back through the SRX?

Static NAT One-to-One

set security nat static rule-set STATIC_IN from zone untrust
set security nat static rule-set STATIC_IN rule SERVER_1 match destination-address 203.0.113.30/32
set security nat static rule-set STATIC_IN rule SERVER_1 then static-nat prefix 192.168.10.30/32

Use static NAT when both inbound and outbound flows should map predictably. Remember that static NAT can override destination NAT for overlapping public addresses.

Static NAT for Overlapping Networks

For tenant or VPN designs with overlapping prefixes, use static NAT prefixes and explicit routing-instance/routing-group context. Keep the synthetic prefixes routable and documented.

Conceptual pattern:

set security l3vpn vrf-group VRF-GRP-TENANT-1 vrf tenant-1
set security nat static rule-set TENANT1_TO_TENANT3 from routing-group VRF-GRP-TENANT-1
set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 match source-address 10.1.0.0/16
set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 match destination-address 10.23.0.0/16
set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 then static-nat prefix 10.1.0.0/16
set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 then static-nat prefix routing-instance tenant-3

Live-verified on vSRX 24.4R1: from routing-group references a security l3vpn vrf-group name, not a routing-instance — pointing it at a routing instance fails commit with Vrf-group must be defined.

Verify route tables and session wings in every routing instance involved.

Proxy ARP Decision

Use proxy ARP only when the upstream L2 segment expects the SRX to answer ARP for translated public addresses that are not configured on the SRX interface.

set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.20/32
set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.30/32

Prefer routing a NAT pool prefix to the SRX when possible. Proxy ARP is easy to forget, hard to see in the session table, and risky in HA/MNHA designs where multiple nodes can answer for the same translated address.

Hairpin NAT

Hairpin NAT is needed when inside clients access an inside server through its public/NAT address.

Required pieces:

1. A destination NAT rule that matches the inside source zone as well as the outside zone.
2. A source NAT rule for the inside-to-inside hairpin flow so the server replies to the SRX, not directly to the client.
3. A security policy for the resulting inside-to-inside path.
4. Correct server default gateway or route back to the SRX.

Destination NAT from inside:

set security nat destination rule-set DNAT_HAIRPIN from zone trust
set security nat destination rule-set DNAT_HAIRPIN rule WEB_HAIRPIN match destination-address 203.0.113.20/32
set security nat destination rule-set DNAT_HAIRPIN rule WEB_HAIRPIN match destination-port 443
set security nat destination rule-set DNAT_HAIRPIN rule WEB_HAIRPIN then destination-nat pool WEB_SERVER

Source NAT for return symmetry:

set security nat source pool HAIRPIN_SRC address 192.168.10.1/32
set security nat source rule-set HAIRPIN_SNAT from zone trust
set security nat source rule-set HAIRPIN_SNAT to zone trust
set security nat source rule-set HAIRPIN_SNAT rule HAIRPIN match source-address 192.168.1.0/24
set security nat source rule-set HAIRPIN_SNAT rule HAIRPIN match destination-address 192.168.10.20/32
set security nat source rule-set HAIRPIN_SNAT rule HAIRPIN then source-nat pool HAIRPIN_SRC

Policy:

set security address-book global address LAN_CLIENTS 192.168.1.0/24
set security address-book global address WEB_SERVER_ADDR 192.168.10.20/32
set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN match source-address LAN_CLIENTS
set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN match destination-address WEB_SERVER_ADDR
set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN match application junos-https
set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN then permit
set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN then log session-close

For CGN or persistent NAT hairpin cases, use a dedicated inside-to-inside policy and inspect session-close/update logs. Avoid broad any any permit hairpin policy without logging and a change record.

Advanced NAT

Read references/advanced-nat.md for NAT64/DNS64, CGN capacity planning, port block allocation, persistent NAT, pool port behavior, and address-persistent troubleshooting. Load only the relevant subsection for the task.

Verification Commands

Configuration:

show configuration security nat | display set
show configuration security policies | display set
show configuration security zones | display set
show route 
show route table .inet.0 

Rule counters:

show security nat source rule all
show security nat destination rule all
show security nat static rule all
show security nat proxy-arp

Sessions:

show security flow session source-prefix  extensive
show security flow session destination-prefix  extensive
show security flow session destination-port  extensive
show security flow session | match "Session ID|In:|Out:|NAT|Policy name|Timeout"

CGN/PBA:

show security nat source pool all
show security nat source persistent-nat-table summary
show security flow statistics
show security log statistics
show snmp mib walk jnxUtil ascii | match block | match value

Traceoptions, when counters and sessions do not explain the drop:

set security flow traceoptions file flow-nat-debug size 10m files 5
set security flow traceoptions flag basic-datapath
set security flow traceoptions packet-filter NAT-DEBUG source-prefix /32
set security flow traceoptions packet-filter NAT-DEBUG destination-prefix /32

Use traceoptions for short maintenance windows only. Remove or deactivate them after collecting evidence.

Troubleshooting Matrix

| Symptom | Likely Cause | Check | Fix | |---|---|---|---| | Source NAT translation hits do not increase | Wrong rule-set context or rule order | show security nat source rule all | Fix from/to context, move specific rule above catch-all | | Source NAT hits increase but traffic fails | Route, policy, return path, or egress filtering | Session extensive, route table, policy log | Fix policy/route/upstream path | | Pool source NAT fails on connected public subnet | Missing proxy ARP | show security nat proxy-arp, upstream ARP table | Add proxy ARP or route the prefix to SRX | | Destination NAT hits do not increase | Wrong public IP/port/source zone, traffic not reaching SRX | show security nat destination rule all, ingress filter counters | Fix DNAT match or upstream forwarding | | DNAT hits but policy denies | Policy matches wrong destination or zone | show security flow session extensive | Permit translated destination in post-DNAT zone | | DNAT is ignored | Overlapping static NAT takes precedence | show security nat static rule all | Remove or redesign overlapping static NAT | | Published server replies directly | Asymmetric return path | Server gateway and flow session | Route return traffic through SRX | | Hairpin fails | Missing inside DNAT, source NAT, or trust-to-trust policy | Session In/Out tuples | Add inside-sourced DNAT, hairpin SNAT, and policy | | NAT64 DNS works but traffic fails | Static NAT64 or source NAT rule mismatch | Static/source NAT counters and session | Match 64:ff9b::/96 in static NAT, IPv4 destination in source NAT | | Native IPv6 breaks after NAT64 change | Over-broad source NAT | Session table | Ensure source NAT only matches post-static-NAT IPv4 destination | | Source pool port exhaustion | Too few pool IPs for the session load | show security nat source pool all (ports used/available), show security nat source summary, RT_NAT syslog drops | Add pool IPs, raise port-overloading-factor, or narrow the rule match | | PBA users cannot open new sessions | Pool/block exhaustion or max blocks per host | show security nat source pool all, PBA stats | Add public IPs, tune block size/max blocks/recycle timeout | | Gaming/P2P fails behind CGN | No persistent NAT or rule too low in order | Persistent NAT table, rule hits | Add selective persistent NAT before broad NAT rule | | Persistent NAT table high | Persistent NAT applied too broadly | `show security nat sour

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fastrevmd-lab
• Source: fastrevmd-lab/fwskillsshare
• License: Apache-2.0
• Homepage: https://mechub.org

Install and usage instructions live in the source repository linked above.