# Srx Nat > Design, configure, audit, and troubleshoot Juniper SRX NAT. Use when handling source, destination, static, NAT64, DNS64, CGN, PBA, persistent or address-persistent NAT, hairpinning, proxy ARP, rule order, pool exhaustion, security nat configuration, show security nat output, sessions, or RT_NAT logs. - **Type:** Skill - **Install:** `agentstack add skill-fastrevmd-lab-fwskillsshare-srx-nat` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [fastrevmd-lab](https://agentstack.voostack.com/s/fastrevmd-lab) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [fastrevmd-lab](https://github.com/fastrevmd-lab) - **Source:** https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-nat - **Website:** https://mechub.org ## Install ```sh agentstack add skill-fastrevmd-lab-fwskillsshare-srx-nat ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # SRX NAT ## Overview SRX NAT is flow-based translation performed during first-packet session setup. Use this skill to reason about how Junos chooses a NAT rule, how translated addresses affect route and policy lookup, and how to verify the resulting session wings. Core SRX NAT types: - **Source NAT** changes the client/source address after route and security policy lookup. It is used for Internet access, carrier-grade NAT, NAT64 source translation, and hairpin return symmetry. - **Destination NAT** changes the destination before route and security policy lookup. It is used for publishing inside servers behind public or shared addresses. - **Static NAT** is bidirectional 1:1 or prefix translation. It has higher precedence than destination NAT, and reverse static NAT has higher precedence than source NAT. - **NAT64** on SRX is usually built with static NAT `inet` destination extraction from `64:ff9b::/96` plus a normal source NAT action to a reachable IPv4 source. Always inspect the translated session, not only the configuration. Correct NAT configuration with wrong routes, policy, proxy ARP, or return path still fails. ## Scope and routing Use this skill for SRX NAT behavior after relevant configuration is identified. Use `parsing-srx-configs` for full-config extraction and `srx-policy` for post-translation policy design. ## NAT Processing Order For the first packet of a flow, SRX processes NAT and lookup in this order: 1. Static NAT rules 2. Destination NAT rules 3. Route lookup 4. Security policy lookup 5. Reverse mapping of static NAT rules 6. Source NAT rules Operational consequences: - Static NAT takes precedence over destination NAT. - Destination NAT and static NAT happen before route lookup. Their rule sets match source interface, source zone, or source routing instance; they cannot match destination zone/interface/routing-instance because that has not been resolved yet. - Security policy lookup happens after destination/static NAT, so the policy usually matches the translated destination and the post-NAT egress zone. - Source NAT happens after route and policy lookup, so source NAT rule sets use both `from` and `to` contexts. - Reverse static NAT takes precedence over source NAT for return traffic. - NAT64 source NAT must match an IPv4 destination because static NAT64 translated the destination from `64:ff9b::/96` to IPv4 before source NAT evaluation. ## Rule-Set Selection and Rule Order ### Static and Destination NAT Rule-Set Specificity For static NAT and destination NAT, if multiple rule sets match, SRX chooses the more specific source-side match: 1. Source interface 2. Source zone 3. Source routing instance ### Source NAT Rule-Set Specificity Source NAT rule-set choice considers source and destination context. In decreasing specificity: 1. Source interface + destination interface 2. Source zone + destination interface 3. Source routing instance + destination interface 4. Source interface + destination zone 5. Source zone + destination zone 6. Source routing instance + destination zone 7. Source interface + destination routing instance 8. Source zone + destination routing instance 9. Source routing instance + destination routing instance ### Rule Order Within a Rule Set Within the chosen rule set, rules are evaluated top-down and the first matching rule wins. Design rules: - Put no-NAT and exception rules above broad NAT rules. - Put persistent NAT / gaming / special application rules above normal CGN rules. - Put specific host/server rules above subnet or `any` rules. - Use distinct rule-set names that encode direction, such as `TRUST_TO_UNTRUST`, `DNAT_IN`, or `HAIRPIN`. - After reordering, generate traffic and check translation hits rather than assuming the intended rule is used. ## Basic Source NAT Patterns ### Interface Source NAT Use this when inside clients should overload on the egress interface address. ```junos set security nat source rule-set TRUST_TO_UNTRUST from zone trust set security nat source rule-set TRUST_TO_UNTRUST to zone untrust set security nat source rule-set TRUST_TO_UNTRUST rule SRC_NAT match source-address 192.168.1.0/24 set security nat source rule-set TRUST_TO_UNTRUST rule SRC_NAT match destination-address 0.0.0.0/0 set security nat source rule-set TRUST_TO_UNTRUST rule SRC_NAT then source-nat interface ``` Verify: ```text show security nat source rule all show security flow session source-prefix 192.168.1.10 extensive ``` ### Pool Source NAT Use a pool when the translated source must be a specific address or prefix. ```junos set security nat source pool SRC_POOL address 203.0.113.10/32 set security nat source rule-set TRUST_TO_UNTRUST from zone trust set security nat source rule-set TRUST_TO_UNTRUST to zone untrust set security nat source rule-set TRUST_TO_UNTRUST rule SRC_POOL_NAT match source-address 192.168.1.0/24 set security nat source rule-set TRUST_TO_UNTRUST rule SRC_POOL_NAT match destination-address 0.0.0.0/0 set security nat source rule-set TRUST_TO_UNTRUST rule SRC_POOL_NAT then source-nat pool SRC_POOL ``` If the pool address is on a directly connected external subnet and the upstream device expects ARP for it, configure proxy ARP or, preferably, route the pool prefix to the SRX. ```junos set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.10/32 ``` ## Destination NAT and Static NAT Patterns ### Destination NAT for a Published Server Example: public `203.0.113.20:443` to inside server `192.168.10.20:443`. ```junos set security nat destination pool WEB_SERVER address 192.168.10.20/32 set security nat destination rule-set DNAT_IN from zone untrust set security nat destination rule-set DNAT_IN rule WEB_HTTPS match destination-address 203.0.113.20/32 set security nat destination rule-set DNAT_IN rule WEB_HTTPS match destination-port 443 set security nat destination rule-set DNAT_IN rule WEB_HTTPS then destination-nat pool WEB_SERVER ``` Port translation (port forwarding, e.g. public `:8443` → inside `:443`) is configured on the **pool**, not the rule (verified on vSRX 24.4R1 — `... pool port ` on the rule is a syntax error): ```junos set security nat destination pool WEB_SERVER_443 address 192.168.10.20/32 port 443 set security nat destination rule-set DNAT_IN rule WEB_ALT match destination-port 8443 set security nat destination rule-set DNAT_IN rule WEB_ALT match destination-address 203.0.113.20/32 set security nat destination rule-set DNAT_IN rule WEB_ALT then destination-nat pool WEB_SERVER_443 ``` Security policy must permit the translated path: ```junos set security policies from-zone untrust to-zone trust policy ALLOW_WEB match source-address any set security policies from-zone untrust to-zone trust policy ALLOW_WEB match destination-address WEB_SERVER_ADDR set security policies from-zone untrust to-zone trust policy ALLOW_WEB match application junos-https set security policies from-zone untrust to-zone trust policy ALLOW_WEB then permit set security policies from-zone untrust to-zone trust policy ALLOW_WEB then log session-init set security policies from-zone untrust to-zone trust policy ALLOW_WEB then log session-close ``` Important checks: - Is the public IP routed to the SRX, assigned to the external interface, or answered by proxy ARP? - Does `show security nat destination rule all` show translation hits? - Does the session show the post-DNAT destination and expected egress zone? - Does the inside server route its return traffic back through the SRX? ### Static NAT One-to-One ```junos set security nat static rule-set STATIC_IN from zone untrust set security nat static rule-set STATIC_IN rule SERVER_1 match destination-address 203.0.113.30/32 set security nat static rule-set STATIC_IN rule SERVER_1 then static-nat prefix 192.168.10.30/32 ``` Use static NAT when both inbound and outbound flows should map predictably. Remember that static NAT can override destination NAT for overlapping public addresses. ### Static NAT for Overlapping Networks For tenant or VPN designs with overlapping prefixes, use static NAT prefixes and explicit routing-instance/routing-group context. Keep the synthetic prefixes routable and documented. Conceptual pattern: ```junos set security l3vpn vrf-group VRF-GRP-TENANT-1 vrf tenant-1 set security nat static rule-set TENANT1_TO_TENANT3 from routing-group VRF-GRP-TENANT-1 set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 match source-address 10.1.0.0/16 set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 match destination-address 10.23.0.0/16 set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 then static-nat prefix 10.1.0.0/16 set security nat static rule-set TENANT1_TO_TENANT3 rule T1_TO_T3 then static-nat prefix routing-instance tenant-3 ``` Live-verified on vSRX 24.4R1: `from routing-group` references a `security l3vpn vrf-group` name, not a routing-instance — pointing it at a routing instance fails commit with `Vrf-group must be defined`. Verify route tables and session wings in every routing instance involved. ## Proxy ARP Decision Use proxy ARP only when the upstream L2 segment expects the SRX to answer ARP for translated public addresses that are not configured on the SRX interface. ```junos set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.20/32 set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.30/32 ``` Prefer routing a NAT pool prefix to the SRX when possible. Proxy ARP is easy to forget, hard to see in the session table, and risky in HA/MNHA designs where multiple nodes can answer for the same translated address. ## Hairpin NAT Hairpin NAT is needed when inside clients access an inside server through its public/NAT address. Required pieces: 1. A destination NAT rule that matches the inside source zone as well as the outside zone. 2. A source NAT rule for the inside-to-inside hairpin flow so the server replies to the SRX, not directly to the client. 3. A security policy for the resulting inside-to-inside path. 4. Correct server default gateway or route back to the SRX. Destination NAT from inside: ```junos set security nat destination rule-set DNAT_HAIRPIN from zone trust set security nat destination rule-set DNAT_HAIRPIN rule WEB_HAIRPIN match destination-address 203.0.113.20/32 set security nat destination rule-set DNAT_HAIRPIN rule WEB_HAIRPIN match destination-port 443 set security nat destination rule-set DNAT_HAIRPIN rule WEB_HAIRPIN then destination-nat pool WEB_SERVER ``` Source NAT for return symmetry: ```junos set security nat source pool HAIRPIN_SRC address 192.168.10.1/32 set security nat source rule-set HAIRPIN_SNAT from zone trust set security nat source rule-set HAIRPIN_SNAT to zone trust set security nat source rule-set HAIRPIN_SNAT rule HAIRPIN match source-address 192.168.1.0/24 set security nat source rule-set HAIRPIN_SNAT rule HAIRPIN match destination-address 192.168.10.20/32 set security nat source rule-set HAIRPIN_SNAT rule HAIRPIN then source-nat pool HAIRPIN_SRC ``` Policy: ```junos set security address-book global address LAN_CLIENTS 192.168.1.0/24 set security address-book global address WEB_SERVER_ADDR 192.168.10.20/32 set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN match source-address LAN_CLIENTS set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN match destination-address WEB_SERVER_ADDR set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN match application junos-https set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN then permit set security policies from-zone trust to-zone trust policy PERMIT_HAIRPIN then log session-close ``` For CGN or persistent NAT hairpin cases, use a dedicated inside-to-inside policy and inspect session-close/update logs. Avoid broad `any any permit` hairpin policy without logging and a change record. ## Advanced NAT Read `references/advanced-nat.md` for NAT64/DNS64, CGN capacity planning, port block allocation, persistent NAT, pool port behavior, and address-persistent troubleshooting. Load only the relevant subsection for the task. ## Verification Commands Configuration: ```text show configuration security nat | display set show configuration security policies | display set show configuration security zones | display set show route show route table .inet.0 ``` Rule counters: ```text show security nat source rule all show security nat destination rule all show security nat static rule all show security nat proxy-arp ``` Sessions: ```text show security flow session source-prefix extensive show security flow session destination-prefix extensive show security flow session destination-port extensive show security flow session | match "Session ID|In:|Out:|NAT|Policy name|Timeout" ``` CGN/PBA: ```text show security nat source pool all show security nat source persistent-nat-table summary show security flow statistics show security log statistics show snmp mib walk jnxUtil ascii | match block | match value ``` Traceoptions, when counters and sessions do not explain the drop: ```junos set security flow traceoptions file flow-nat-debug size 10m files 5 set security flow traceoptions flag basic-datapath set security flow traceoptions packet-filter NAT-DEBUG source-prefix /32 set security flow traceoptions packet-filter NAT-DEBUG destination-prefix /32 ``` Use traceoptions for short maintenance windows only. Remove or deactivate them after collecting evidence. ## Troubleshooting Matrix | Symptom | Likely Cause | Check | Fix | |---|---|---|---| | Source NAT translation hits do not increase | Wrong rule-set context or rule order | `show security nat source rule all` | Fix `from`/`to` context, move specific rule above catch-all | | Source NAT hits increase but traffic fails | Route, policy, return path, or egress filtering | Session extensive, route table, policy log | Fix policy/route/upstream path | | Pool source NAT fails on connected public subnet | Missing proxy ARP | `show security nat proxy-arp`, upstream ARP table | Add proxy ARP or route the prefix to SRX | | Destination NAT hits do not increase | Wrong public IP/port/source zone, traffic not reaching SRX | `show security nat destination rule all`, ingress filter counters | Fix DNAT match or upstream forwarding | | DNAT hits but policy denies | Policy matches wrong destination or zone | `show security flow session extensive` | Permit translated destination in post-DNAT zone | | DNAT is ignored | Overlapping static NAT takes precedence | `show security nat static rule all` | Remove or redesign overlapping static NAT | | Published server replies directly | Asymmetric return path | Server gateway and flow session | Route return traffic through SRX | | Hairpin fails | Missing inside DNAT, source NAT, or trust-to-trust policy | Session In/Out tuples | Add inside-sourced DNAT, hairpin SNAT, and policy | | NAT64 DNS works but traffic fails | Static NAT64 or source NAT rule mismatch | Static/source NAT counters and session | Match `64:ff9b::/96` in static NAT, IPv4 destination in source NAT | | Native IPv6 breaks after NAT64 change | Over-broad source NAT | Session table | Ensure source NAT only matches post-static-NAT IPv4 destination | | Source pool port exhaustion | Too few pool IPs for the session load | `show security nat source pool all` (ports used/available), `show security nat source summary`, RT_NAT syslog drops | Add pool IPs, raise `port-overloading-factor`, or narrow the rule match | | PBA users cannot open new sessions | Pool/block exhaustion or max blocks per host | `show security nat source pool all`, PBA stats | Add public IPs, tune block size/max blocks/recycle timeout | | Gaming/P2P fails behind CGN | No persistent NAT or rule too low in order | Persistent NAT table, rule hits | Add selective persistent NAT before broad NAT rule | | Persistent NAT table high | Persistent NAT applied too broadly | `show security nat sour … ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [fastrevmd-lab](https://github.com/fastrevmd-lab) - **Source:** [fastrevmd-lab/fwskillsshare](https://github.com/fastrevmd-lab/fwskillsshare) - **License:** Apache-2.0 - **Homepage:** https://mechub.org Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-fastrevmd-lab-fwskillsshare-srx-nat - Seller: https://agentstack.voostack.com/s/fastrevmd-lab - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.