Understanding Rule-Based Destination NAT

JUNOS software allows you to create NAT rules to translate the destination address from one IP address to another.

Note: When performing destination NAT, the address in question is first translated according to configured NAT destination rules and then security policies are applied.

The following types of destination NAT are supported on:

• Translation of the original destination IP address to an IP address from a defined pool. This type of translation is one-to-one and does not include Port Address Translation (PAT).
• Translation of the original destination IP address (and optional port number) to one specific IP address (and port number) from a defined pool.

The main configuration tasks for destination NAT are as follows:

• Configure a destination NAT pool that aligns with your network and security requirements.
• Configure destination NAT rules that align with your network and security requirements.
• Configure NAT proxy ARP entries for IP addresses in the same subnet of the ingress interface.

Note: When you configure a security policy on J-series or SRX-series devices, each policy optionally indicates whether it allows NAT translation, does not allow NAT translation, or does not care.