- play_arrow Administration Portal
- play_arrow Introduction
- Unified Administration and Customer Portal Overview
- Administration Portal Overview
- Logging in to Administration Portal
- Switching the Tenant Scope
- Changing the Administration Portal Password
- Changing the Password on First Login
- Resetting the Password
- Setting Password Duration
- Extending the User Login Session
- Setting Up the Cloud CPE Centralized Deployment Model with Administration Portal
- Setting Up the Cloud CPE Distributed Deployment Model with Administration Portal
- play_arrow Managing Objects
- play_arrow Using the Dashboard
- play_arrow Monitoring Alerts, Alarms, and Device Events
- play_arrow Monitoring Tenants SLA Performance
- Multidepartment CPE Device Support
- About the SLA Performance of All Tenants Page
- About the SLA Performance of a Single Tenant Page
- Monitoring Application-Level SLA Performance for real time-optimized SD-WAN
- Viewing the SLA Performance of a Site
- Viewing the SLA Performance of an Application or Application Group
- Understanding SLA Performance Score for Applications, Links, Sites, and Tenants
- play_arrow Monitoring Jobs
- play_arrow Managing POPs
- About the POPs Page
- Creating a Single POP
- Importing Data for Multiple POPs
- Viewing the History of POP Data Imports
- Viewing the History of POP Data Deletions
- Managing a Single POP
- About the VIMs Page
- Creating a Cloud VIM
- About the EMS Page
- Creating an EMS
- Changing the Junos Space Virtual Appliance Password
- About the Routers Page
- Creating Devices
- Configuring Devices
- View the History of Device Data Deletions
- play_arrow Managing Devices
- About the Tenant Devices Page
- About the Cloud Hub Devices Page
- Managing a Tenant Device
- Managing a Cloud Hub Device
- Device Redundancy Support Overview
- Viewing the History of Tenant Device Activation Logs
- Viewing the History of Cloud Hub Device Activation Logs
- Secure OAM Network Overview
- Adding a Cloud Hub Device
- Upgrading a Cloud Hub Device
- Rebooting a CPE Device
- play_arrow Managing Device Templates
- play_arrow Managing Software Images
- play_arrow Configuring Network Services in a Centralized Deployment
- Network Services Overview
- About the Network Services Page
- About the Service Overview Page
- About the Service Instances Page
- Configuring VNF Properties
- Allocating a Service to Tenants
- Removing a Service from Tenants
- Viewing a Service Configuration
- vSRX VNF Configuration Settings
- LxCIPtable VNF Configuration Settings
- Cisco CSR-1000v VNF Configuration Settings
- Riverbed Steelhead VNF Configuration Settings
- Managing a Single Service
- play_arrow Configuring Application SLA Profiles
- Application Quality of Experience (AppQoE) Overview
- About the Application Traffic Type Profiles Page
- Creating Traffic Type Profiles
- Editing and Deleting Traffic Type Profiles
- SLA Profiles and SD-WAN Policies Overview
- Cost-Based Link Switching
- Local Breakout Overview
- About the Application SLA Profiles Page
- Creating SLA Profiles
- Editing and Deleting SLA Profiles
- play_arrow Configuring Application Signatures
- play_arrow Managing Tenants
- play_arrow Managing Operating Companies
- play_arrow Configuring SP Users
- play_arrow Managing Audit Logs
- play_arrow Managing Roles
- play_arrow Configuring Authentication
- play_arrow Configuring Licenses
- play_arrow Customizing the Unified Portal
- play_arrow Managing Signature Database
-
- play_arrow Designer Tools
- play_arrow Configuration Designer
- Configuration Designer Overview
- Accessing the Configuration Designer
- Using the Configuration Designer
- Changing Your Password
- About the Requests Page for the Configuration Designer
- Creating Requests for Configuration Templates
- Designing Templates with a YANG Configuration
- Designing Templates with a Configuration
- Publishing Configuration Templates
- About the Designs Page for the Configuration Designer
- Cloning Configuration Templates
- Deleting Configuration Template Designs
- play_arrow Resource Designer
- Resource Designer Overview
- Using the Resource Designer
- Accessing the Resource Designer
- About the Requests Page for the Resource Designer
- VNF Overview
- Creating Requests for VNF Packages
- Designing VNF Packages
- Adding VNF Managers
- Publishing VNF Packages
- About the Designs Page for the Resource Designer
- Cloning VNF Packages
- Importing VNF Packages
- Exporting VNF Packages
- Deleting VNF Packages
- play_arrow Network Service Designer introduction
- play_arrow Creating Requests for Network Services
- play_arrow Creating Network Services
- About the Build Page for the Network Service Designer
- Viewing Information About VNFs
- Designing Network Services
- Connecting VNFs in a Service Chain
- Defining Ingress and Egress Points for a Service Chain
- Monitoring Performance Goals
- Configuring Network Services
- vSRX Configuration Settings
- LxCIPtable VNF Configuration Settings
- Cisco CSR-1000v VNF Configuration Settings
- Riverbed Steelhead VNF Configuration Settings
- Fortinet VNF Configuration Settings
- Ubuntu VNF Configuration Settings
- play_arrow Managing Network Services
-
- play_arrow Downloads
NAT Policies Overview
Network Address Translation (NAT) is a form of network masquerading where you can hide devices or sites between zones or interfaces. A trusted zone is a segment of a network on which security measures are applied. It is usually assigned to the internal LAN. An example of an untrusted zone is the internet. NAT modifies the IP addresses of the packets moving between the trusted and untrusted zones.
Whenever a packet exits a NAT device (when traversing from the internal LAN to the external WAN), the device performs a translation on the packet’s IP address by rewriting it with an IP address that was specified for external use. After translation, the packet appears to have originated from the gateway rather than from the original device within the network. This process hides your internal IP addresses from the other networks and keeps your network secure.
Using NAT also enables you to use more internal IP addresses. As these IP addresses are hidden, there is no risk of conflict with an IP address from a different network. This helps you conserve IP addresses.
CSO supports three types of NAT:
Source NAT— Translates the source IP address of a packet leaving a trust zone (outbound traffic). It translates the traffic originating from the device in the trust zone. The source IP address of the traffic (which is a private IP address), is translated to a public IP address that can be accessed by the destination device specified in the NAT rule. The destination IP address is not translated.
The following uses cases show the support for source NAT translation between IPv6 and IPv4 address domains:
Translation from one IPv6 subnet to another IPv6 subnet without Network Address Port Translation (NAPT), also known as Port Address Translation (PAT).
Translation from IPv4 addresses to IPv6 prefixes along with IPv4 address translation.
Translation from IPv6 hosts to IPv6 hosts with or without NAPT.
Translation from IPv6 hosts to IPv4 hosts with or without NAPT.
Translation from IPv4 hosts to IPv6 hosts with or without NAPT.
Destination NAT—Translates the destination IP address of a packet. Using destination NAT, an external device can send packets to a hidden internal device. As an example, consider the case of a webserver behind a NAT device. Traffic to the WAN-facing public IP address (the destination IP address) is translated to the internal webserver private IP address.
The following uses cases show the support for destination NAT translation between IPv6 and IPv4 address domains:
Mapping of one IPv6 subnet to another IPv6 subnet
Mapping between one IPv6 host and another IPv6 host
Mapping of one IPv6 host (and optional port number) to another special IPv6 host (and optional port number)
Mapping of one IPv6 host (and optional port number) to another special IPv4 host (and optional port number)
Mapping of one IPv4 host (and optional port number) to another special IPv6 host (and optional port number)
Static NAT— Always translates a private IP address to the same public IP address. It translates traffic from both sides of the network (both source and destination). For example, a web-server with a private IP address can access the Internet using a static, one-to-one address translation. In this case, outgoing traffic from the web-server undergoes source NAT translation, and incoming traffic to the web-server undergoes destination NAT translation.
The following uses cases show the support for static NAT translation between IPv6 and IPv4 address domains:
Mapping of one IPv6 subnet to another IPv6 subnet.
Mapping between one IPv6 host and another IPv6 host.
Mapping between IPv4 address a.b.c.d and IPv6 address Prefix::a.b.c.d.
Mapping between IPv4 hosts and IPv6 hosts.
Mapping between IPv6 hosts and IPv4 hosts.
CSO also supports persistent NAT where address translations are maintained in the database for a configurable amount of time after a session ends.
Table 1 shows the persistent NAT support for different source NAT and destination NAT addresses.
Table 1: Persistent NAT Support
Source NAT Address | Translated Address | Destination NAT Address | Persistent NAT |
|---|---|---|---|
IPv4 | IPv6 | IPv4 | No |
IPv4 | IPv6 | IPv6 | No |
IPv6 | IPv4 | IPv4 | Yes |
IPv6 | IPv6 | IPv6 | No |
Table 2 and Table 3 show the translated address pool selection for source NAT, destination NAT, and static NAT addresses.
Table 2: Translated Address Pool Selection for Source NAT
Source NAT Address | Destination Address | Pool Address |
|---|---|---|
IPv4 | IPv4 | IPv4 |
IPv4 | IPv6 - Subnet must be greater than 96 | IPv6 |
IPv6 | IPv4 | IPv4 |
IPv6 | IPv6 | IPv6 |
Table 3: Translated Address Pool Selection for Destination NAT And Static NAT
Source NAT Address | Destination Address | Pool Address |
|---|---|---|
IPv4 | IPv4 | IPv4 or IPv6 |
IPv4 | IPv6 - Subnet must be greater than 96 | IPv4 or IPv6 |
IPv6 | IPv4 | IPv4 |
IPv6 | IPv6 | IPv4 or IPv6 |
For source NAT, the proxy Neighbor Discovery Protocol (NDP) is available for NAT pool addresses. For destination NAT and static NAT, the proxy NDP is available for destination NAT addresses.
A NAT pool can have a single IPv6 subnet or multiple IPv6 hosts.
You cannot configure the overflow pool if the address type is IPv6.
NAT pools permit address entries of only one version type: IPv4 or IPv6.
