Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

NAT Policies Overview

Network Address Translation (NAT) is a form of network masquerading where you can hide devices or sites between zones or interfaces. A trusted zone is a segment of a network on which security measures are applied. It is usually assigned to the internal LAN. An example of an untrusted zone is the internet. NAT modifies the IP addresses of the packets moving between the trusted and untrusted zones.

Whenever a packet exits a NAT device (when traversing from the internal LAN to the external WAN), the device performs a translation on the packet's IP address. The packet's IP address rewritten with an IP address that was specified for external use. After translation, the packet appears to have originated from the gateway rather than from the original device within the network. This process hides your internal IP addresses from the other networks and keeps your network secure.

Using NAT also enables you to use more internal IP addresses. As these IP addresses are hidden, there is no risk of conflict with an IP address from a different network. This helps you conserve IP addresses.

Use the NAT Policies page to create, modify, clone, and delete NAT policies and policy rules. You can filter and sort this information to get a better understanding of what you want to configure.

To access the page, select SRX > NAT > NAT Policies.

Click on a NAT policy to view the rules associated with it. The NAT policy rules page displays the NAT rules associated with the NAT policy and keep track of the number and order of rules for each policy.

Supported NAT Types

Juniper Security Director Cloud supports configuring three types of NAT on the SRX Series Firewalls:

  • Source NAT—Translates the source IP address of a packet leaving a trust zone (outbound traffic). It translates the traffic originating from the device in the trust zone. The source IP address of the traffic (which is a private IP address), is translated to a public IP address that can be accessed by the destination device specified in the NAT rule. The destination IP address is not translated.

    The following uses cases show the support for source NAT translation between IPv6 and IPv4 address domains:

    • Translation from one IPv6 subnet to another IPv6 subnet without Network Address Port Translation (NAPT), also known as Port Address Translation (PAT).

    • Translation from IPv4 addresses to IPv6 prefixes along with IPv4 address translation.

    • Translation from IPv6 hosts to IPv6 hosts with or without NAPT.

    • Translation from IPv6 hosts to IPv4 hosts with or without NAPT.

    • Translation from IPv4 hosts to IPv6 hosts with or without NAPT.

  • Destination NAT—Translates the destination IP address of a packet. Using destination NAT, an external device can send packets to a hidden internal device. As an example, consider the case of a webserver behind a NAT device. Traffic to the WAN-facing public IP address (the destination IP address) is translated to the internal webserver private IP address.

    The following uses cases show the support for destination NAT translation between IPv6 and IPv4 address domains:

    • Mapping of one IPv6 subnet to another IPv6 subnet

    • Mapping between one IPv6 host and another IPv6 host

    • Mapping of one IPv6 host (and optional port number) to another special IPv6 host (and optional port number)

    • Mapping of one IPv6 host (and optional port number) to another special IPv4 host (and optional port number)

    • Mapping of one IPv4 host (and optional port number) to another special IPv6 host (and optional port number)

  • Static NAT—Always translates a private IP address to the same public IP address. It translates traffic from both sides of the network (both source and destination). For example, a web-server with a private IP address can access the Internet using a static, one-to-one address translation. In this case, outgoing traffic from the web-server undergoes source NAT translation, and incoming traffic to the web-server undergoes destination NAT translation.

    The following uses cases show the support for static NAT translation between IPv6 and IPv4 address domains:

    • Mapping of one IPv6 subnet to another IPv6 subnet.

    • Mapping between one IPv6 host and another IPv6 host.

    • Mapping between IPv4 address a.b.c.d and IPv6 address Prefix::a.b.c.d.

    • Mapping between IPv4 hosts and IPv6 hosts.

    • Mapping between IPv6 hosts and IPv4 hosts.

Juniper Security Director Cloud also supports configuring persistent NAT where address translations are maintained in the database for a configurable amount of time after a session ends.

Table 1: Persistent NAT Support for Different Source NAT and Destination NAT Addresses

Source NAT Address

Translated Address

Destination NAT Address

Persistent NAT Support

IPv4

IPv6

IPv4

No

IPv4

IPv6

IPv6

No

IPv6

IPv4

IPv4

Yes

IPv6

IPv6

IPv6

No
Table 2: Translated Address Pool Selection for Source NAT

Source NAT Address

Destination Address

Pool Address

IPv4

IPv4

IPv4

IPv4

IPv6 - Subnet must be greater than 96

IPv6

IPv6

IPv4

IPv4

IPv6

IPv6

IPv6
Table 3: Translated Address Pool Selection for Destination NAT and Static NAT

Source NAT Address

Destination Address

Pool Address

IPv4

IPv4

IPv4 or IPv6

IPv4

IPv6 - Subnet must be greater than 96

IPv4 or IPv6

IPv6

IPv4

IPv4

IPv6

IPv6

IPv4 or IPv6
Note:

  • For source NAT, the proxy Neighbor Discovery Protocol (NDP) is available for NAT pool addresses. For the destination NAT and the static NAT, the proxy NDP is available for destination NAT addresses.

  • A NAT pool can have a single IPv6 subnet or multiple IPv6 hosts.

  • You cannot configure the overflow pool if the address type is IPv6.

  • NAT pools permit the address entries of only one version type: IPv4 or IPv6.

Field Descriptions - NAT Policies Page

Table 4: Fields on the NAT Policies Page

Field

Description

Seq.

Order number for the NAT policy.

Name

Displays the name of the NAT policy.

Rules

Number of rules assigned to the NAT policy.

Devices

Device on which the NAT policy will be deployed.

Status

Deployment status for the NAT policy.

Modified By

The user who modified the policy.

Last Modified

The date and time when the policy was modified.

Description

Description of the NAT policy.

Field Descriptions - NAT Policy Rules Page

Table 5: Fields on the NAT Policy Rules Page

Field

Description

Seq.

Order number for the NAT policy.

Rule Name

NAT policy rule name.

Type

Type of the NAT rule such as source, destination, or static.

Sources

Displays the source endpoints on which the NAT policy applies. A source endpoint can be zone, interface, routing instance, zone, addresses or ports.

Destinations

Displays the destination endpoints on which the NAT policy applies. A destination endpoint can be zone, interface, routing instance, zone, addresses or ports.

Services/Protocols

Services and protocols to permit or deny for the source and destination type NAT rules.

Translation

Displays the translation type applied on the incoming or outgoing traffic.

The Total Rules field on the top right corner of the page displays the total number of rules associated with the NAT policy. The Deploy pending field displays the deploy status of the rules associated with the NAT policy.

Related Documentation