Configuring Static Source NAT44 or NAT66 for Next Gen Services
Configuring the Source Pool for Static Source NAT44 or NAT66
To configure the source pool for static source NAT44 or NAT66:
- Create a source pool.
user@host# edit services nat source pool nat-pool-name
- Define the addresses or subnets to which source addresses
are translated.
[edit services nat source pool nat-pool-name] user@host# set address address-prefix
or
[edit services nat source pool nat-pool-name] user@host# set address address-prefix to address address-prefix
- Configure a one-to-one static shifting of a range of original
source addresses to the range of addresses in the source pool by specifying
the base address of the original source address range.
[edit services nat source pool nat-pool-name] user@host# set host-address-base ip-address
For example, if the host address base is 198.51.100.30 and the NAT pool uses the range 203.0.113.10 to 203.0.113.20, then 198.51.100.30 translates to 203.0.113.10, 198.51.100.31 translates to 203.0.113.11, and so on.
- To allow the IP addresses of a NAT source pool to overlap
with IP addresses in pools used in other service sets, configure
allow-overlapping-pools.[edit services nat] user@host# set allow-overlapping-pools
Configuring the NAT Rule for Static Source NAT44 or NAT66
To configure the NAT source rule for static source NAT44 or NAT66 :
- Configure the NAT rule name.
[edit services nat source] user@host# set rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the NAT rule set
applies.
[edit services nat source rule-set rule-set-name] user@host# set match-direction (in | out | in-out)
- Specify the addresses that are translated by the source
NAT rule.
To specify one address or prefix value:
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address address
To specify a range of addresses, configure an address book global address with the desired address range, and assign the global address to the NAT rule:
[edit services address-book global] user@host# set address address-name range-address lower-limit to upper-limit [edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address-name address-name
To specify any unicast address:
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address any-unicast
- Specify one or more application protocols to which the
NAT rule applies. The number of applications listed in the rule must
not exceed 3072.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match application [application-name]
- Specify the NAT pool that contains the addresses for translated
traffic.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set then source-nat pool nat-pool-name
- Configure the address-pooling
paired feature if you want to ensure assignment of the same external
IP address for all sessions originating from the same internal host.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat mapping-type] user@host# set address-pooling-paired
- Specify the timeout period for
address-pooling-pairedmappings that use the NAT pool. The range is 120 through 86,400 seconds, and the default is 300. Mappings that are inactive for this amount of time are dropped.[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations. - Configure the generation of a syslog when traffic matches
the NAT rule conditions.
[edit services nat source rule-set rule-set-name rule rule-name then] user@host# set syslog
Configuring the Service Set for Static Source NAT44 or NAT66
To configure the service set for static source NAT44 or NAT66:
- Define the service set.
[edit services] user@host# edit service-set service-set-name
- Configure either an interface service, which requires
a single service interface, or a next-hop service, which requires
an inside and outside service interface.
[edit services service-set service-set-name] user@host# set interface-service service-interface interface-name
or
[edit services service-set service-set-name] user@host# set next-hop-service inside-service-interface interface-name outside-service-interface interface-name
- Specify the NAT rule sets to be used with the service
set.
[edit services service-set service-set-name] user@host# set nat-rule-sets rule-set-name