Creating NAT Policy Rules
NAT processing centers on the evaluation of NAT rule sets and rules. A rule set determines the overall direction of the traffic to be processed. After a rule set that matches the traffic is found, each rule in the rule set is evaluated for a match. NAT rules can match on the following packet information:
Source and destination address
Source port (for source and static NAT only)
The first rule in the rule set that matches the traffic is used. If a packet matches a rule in a rule set during session establishment, traffic is processed according to the action specified by that rule.
To create a new NAT rule, click the NAT policy name. The Single NAT Policy page appears, providing your with options to configure NAT rules. Alternately, you can click on the rule number listed under Rules against the policy, to create a new rule. You can configure the following types of NAT rules:
Static—To add a static NAT rule, click Add Static NAT Rule or click Create on the top right corner and select Static.
Source—To add a source NAT rule, click Add Source NAT Rule or click Create on the top right corner and select Source.
Destination—To add a destination NAT rule, click Add Destination NAT Rule or click Create on the top right corner and select Destination.
Depending on the type of rule you have chosen, some fields in the rule will not be applicable. In addition to defining rules between zones and interfaces, you can define NAT rules with virtual routers defined on the device. These rules can be successfully published and updated on the device.
To create a NAT policy rule:
- Select Configuration > NAT > NAT Policies.
The NAT Policies page appears, displayed the existing NAT policies.
- Click the name of the NAT policy for which you want to
create rules. Alternately, you can click on the number listed under Rules against a NAT policy.
The Single NAT Policy page appears.
- Click Create and select either Source, Static, or Destination. The page displays fields for creating a NAT rule.
- Complete the configuration according to the guidelines provided in Table 1.
- Click OK to save the changes. If you want to discard your changes, click Cancel instead.
A NAT rule with the configuration you provided is created.
Table 1 provides guidelines on using the fields on the Single NAT Policy page.
Table 1: Fields on the Single NAT Policy Page for Creating NAT Rules
Click the add icon (+) to select the source endpoints on which the NAT policy rule applies, from the displayed list of addresses, protocols, interfaces, routing instances, zones, or ports.
The possible endpoints for source differ based on whether the NAT rule is a source, destination, or static NAT rule.
You can also select a source endpoint by using the methods described in Selecting NAT Source.
Click the add icon (+) to select the destination endpoints on which the NAT policy rule applies, from the displayed list of addresses, interfaces, services, routing instances, zones, or ports.
The possible endpoints for destination differ based on whether the NAT rule is a source, destination, or static NAT rule.
You can select a destination endpoint by using the methods described in Selecting NAT Destination.
Note: When you create a destination NAT rule for traffic arriving on an interface that terminates a VPN link, the translation process may break the VPN link. This will happen if the destination address in a destination NAT rule is specified only as the WAN-facing IP address of that interface. For example, in the following NAT rule, any traffic destined to Wan.IP will get translated to the destination pool and will break functionality of the VPN link packets terminating on this interface.
Therefore, the recommendation in such cases is to use a destination
NAT rule with destination field as
Specify the translation type for the incoming traffic. The translation options vary based on whether you are creating a source, static, or destination NAT rule.
Chose one among the following translation types for a source NAT rule:
Chose one among the following translation types for a static NAT rule:
Chose one among the following translation types for a destination NAT rule:
Advanced Settings (Optional)
Click Configure to configure advance settings for a source or static NAT rule. For more information about advanced settings for the translation types Interface and Pool for a source NAT rule, see Table 2. For more information about advanced settings for the translation types Interface and Pool for a static NAT rule, see Table 3
Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed and the maximum length is 255 characters.
Enter a description for the policy intent; maximum length is 1024 characters.
Create source and destination endpoints such as addresses and services.
To edit the configured parameters of an address or service, hover over it and click on the edit icon (pencil symbol).
Table 2 provides guidelines on using the fields on the Advanced Settings page for a source NAT rule.
Table 2: Fields on the Advanced Settings Page for Source NAT Rule
Enable the check box to ensure that all requests from the same internal transport address are mapped to the same reflexive transport address.
Note: For persistence to be applicable for the NAT policy, ensure that port overloading is turned off for the device to which the NAT policy is applicable. Use the following command to turn off port overloading for a device:
set security nat source interface port-overloading off
Persistent NAT Type
Configure persistent NAT mappings.
The amount of time, in seconds, that the persistent NAT binding remains in the site’s memory when all the sessions of the binding entry have ended. When the configured timeout is reached, the binding is removed from memory. The value of the inactivity timeout can range from 60 through 7200 seconds. The default value of the inactivity timeout is 60 seconds.
Maximum Session Number
Maximum session number—The maximum number of sessions with which a persistent NAT binding can be associated. For example, if the maximum session number of the persistent NAT rule is 65,536, then a 65,537th session cannot be established if that session uses the persistent NAT binding created from the persistent NAT rule.
The range is 8 through 65,536. The default is 30 sessions.
Select an address from the available list.
Displays the NAT pool address.
Host Address Base
Displays the base address of the original source IP address range. The host address base is used for IP address shifting.
Displays whether port translation is enabled or disabled for this NAT rule.
Overflow Pool Type
Displays the source pool to be used when the current address pool is exhausted.
Overflow Pool Name
Displays the name of the overflow pool.
Mapped Port Type
Specify the type of port mapping:
Table 3 provides guidelines on using the fields on the Advanced Settings page for a static NAT rule.
Table 3: Fields on the Advanced Settings Page for Static NAT Rule
Mapped Port Type
Specify the type of port mapping:
Select the routing instance for the static NAT rule.