Understanding Rule-Based Destination NAT on SRX-series Services Gateways

JUNOS software with enhanced services allows you to create NAT rules to translate the destination address from one IP address to another. For SRX-series devices (unlike J-series), NAT is de-coupled from policies. SRX-series NAT has its own NAT rules to regulate traffic and to perform address translation.

Note: When performing destination NAT on SRX-series devices, the address in question is first translated according to configured NAT destination rules and then security policies are applied.

The following types of destination NAT are supported on SRX-series services gateway:

• Translation of the original destination IP address to an IP address from a defined pool. This type of translation is one-to-one and does not include Port Address Translation (PAT).
• Translation of the original destination IP address (and optional port number) to one specific IP address (and port number) from a defined pool.

The main configuration tasks for destination NAT on SRX-series services gateways are as follows:

• Configure a destination NAT pool that aligns with your network and security requirements.
• Configure destination NAT rules that align with your network and security requirements.
• Configure NAT proxy ARP entries for IP addresses in the same subnet of the ingress interface.

Note: When you configure a security policy on SRX-series services gateways, each policy optionally indicates whether it allows NAT translation, does not allow NAT translation, or does not care.