Configuring Dynamic Address-Only Source NAT for Next Gen Services
Configuring the Source Pool for Dynamic Address-Only Source NAT
To configure the source pool for dynamic address-only source NAT:
- Create a source pool.
user@host# edit services nat source pool nat-pool-name
- Define the addresses or subnets to which source addresses
are translated.
[edit services nat source pool nat-pool-name] user@host# set address address-prefix
or
[edit services nat source pool nat-pool-name] user@host# set address address-prefix to address address-prefix
Note:The first and last address of the IP pool must be configured with /32 prefix.
- Disable port translation.
[edit services nat source pool nat-pool-name] user@host# set port no-translation
- Define the NAT pool utilization levels that trigger SNMP
traps. The
raise-thresholdis the pool utilization percentage that triggers the trap, and the range is 50 through 100. Theclear-thresholdis the pool utilization percentage that clears the trap, and the range is 40 through 100. The utilization is based on the number of addresses that are used.[edit services nat source pool nat-pool-name] user@host# set pool-utilization-alarm raise-threshold value user@host# set pool-utilization-alarm clear-threshold value
If you do not configure
pool-utilization-alarm, traps are not created. - To allow the IP addresses of a NAT source pool or destination
pool to overlap with IP addresses in pools used in other service sets,
configure
allow-overlapping-pools.[edit services nat] user@host# set allow-overlapping-pools
Configuring the NAT Source Rule for Dynamic Address-Only Source NAT
To configure the NAT source rule for dynamic address-only source NAT:
- Configure the NAT rule name.
[edit services nat source] user@host# set rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the NAT rule set
applies.
[edit services nat source rule-set rule-set-name] user@host# set match-direction (in | out | in-out)
- Specify the addresses that are translated by the source
NAT rule.
To specify one address or prefix value:
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address address
To specify a range of addresses, configure an address book global address with the desired address range, and assign the global address to the NAT rule:
[edit services address-book global] user@host# set address address-name range-address lower-limit to upper-limit [edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address-name address-name
To specify any unicast address:
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address any-unicast
- Specify one or more application protocols to which the
NAT rule applies. The number of applications listed in the rule must
not exceed 3072.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match application [application-name]
- Specify the NAT pool that contains the addresses for translated
traffic.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set then source-nat pool nat-pool-name
- Configure the address-pooling
paired feature if you want to ensure assignment of the same external
IP address for all sessions originating from the same internal host.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat mapping-type] user@host# set address-pooling-paired
- Specify the timeout period for
address-pooling-pairedmappings that use the NAT pool. The range is 120 through 86,400 seconds, and the default is 300. Mappings that are inactive for this amount of time are dropped.[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations. - Configure the generation of a syslog when traffic matches
the NAT rule conditions.
[edit services nat source rule-set rule-set-name rule rule-name then] user@host# set syslog
Configuring the Service Set for Dynamic Address-Only Source NAT
To configure the service set for dynamic address-only source NAT:
- Define the service set.
[edit services] user@host# edit service-set service-set-name
- Configure either an interface service, which requires
a single service interface, or a next-hop service, which requires
an inside and outside service interface.
[edit services service-set service-set-name] user@host# set interface-service service-interface interface-name
or
[edit services service-set service-set-name] user@host# set next-hop-service inside-service-interface interface-name outside-service-interface interface-name
- Specify the NAT rule sets to be used with the service
set.
[edit services service-set service-set-name] user@host# set nat-rule-sets rule-set-name