Configuring Deterministic NAPT for Next Gen Services
To configure deterministic NAPT on Next Gen Services, perform the following:
Configuring the NAT Pool for Deterministic NAPT for Next Gen Services
To configure the NAT pool for deterministic NAPT:
- Create a pool.user@host# edit services nat source pool nat-pool-name
- Define the addresses or subnets to which source addresses
are translated.[edit services nat source pool nat-pool-name]user@host# set address address-prefix
or
[edit services nat source pool nat-pool-name]user@host# set address address-prefix to address address-prefix - Configure deterministic port block allocation for the
pool.[edit services nat source pool nat-pool-name port]user@host# set deterministic
- If you want the lowest and highest IPv4 addresses (the
network and broadcast addresses) in the source address range of a
NAT rule to be translated when the NAT pool is used, configure include-boundary-address.[edit services nat source pool nat-pool-name port deterministic]user@host# set include-boundary-addresses
- Configure the port block size. The range is 1 to 64,512.
The default block size is 256.[edit services nat source pool nat-pool-name port deterministic]user@host# set block-size block-size
- Configure the first usable pre-NAT subscriber address,
which is used in calculating the offset value for a pre-NAT address
that is being translated. This offset is used to perform the deterministic
NAT mapping.[edit services nat source pool nat-pool-name port deterministic]user@host# set host address host-addr
- Configure the interval at which the syslog is generated
for the deterministic NAT configuration.[edit services nat source pool nat-pool-name port deterministic]user@host# set deterministic-nat-configuration-log-interval seconds
- To configure automatic port assignment for the pool, specify
either random allocation or round-robin allocation.[edit services nat source pool nat-pool-name port]user@host# set automatic (random-allocation | round-robin)
Random allocation randomly assigns a port from the range 1024 through 65535 for each port translation. Round robin allocation first assigns port 1024, and uses the next higher port for each successive port assignment. Round robin allocation is the default.
- To disable round-robin port allocation for all NAT pools
that do not specify an automatic (random-allocation | round-robin) setting, configure the global setting.[edit services nat source]user@host# set port-round-robin disable
Configuring the NAT Rule for Deterministic NAPT44 for Next Gen Services
To configure the NAT rule for deterministic NAPT44:
- Configure the NAT rule name.[edit services nat source]user@host# set rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the NAT rule set
applies.[edit services nat source rule-set rule-set-name]user@host# set match-direction (in | out | in-out)
- Specify the addresses that are translated by the source
NAT rule.
To specify one address or prefix value:
[edit services nat source rule-set rule-set-name rule rule-name]user@host# set match source-address addressTo specify a range of addresses, configure an address book global address with the desired address range, and assign the global address to the NAT rule:
[edit services address-book global]user@host# set address address-name range-address lower-limit to upper-limit[edit services nat source rule-set rule-set-name rule rule-name]user@host# set match source-address-name address-nameTo specify any unicast address:
[edit services nat source rule-set rule-set-name rule rule-name]user@host# set match source-address any-unicast - Specify one or more application protocols to which the
NAT rule applies. The number of applications listed in the rule must
not exceed 3072.[edit services nat source rule-set rule-set-name rule rule-name]user@host# set match application [application-name]
- Specify the NAT pool that contains the addresses for translated
traffic.[edit services nat source rule-set rule-set-name rule rule-name]user@host# set then source-nat pool nat-pool-name
Configuring the NAT Rule for Deterministic NAPT64 for Next Gen Services
To configure the NAT rule for deterministic NAPT64:
- Configure the source NAT rule name.[edit services nat source]user@host# set rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the NAT rule set
applies.[edit services nat source rule-set rule-set-name]user@host# set match-direction (in | out | in-out)
- Specify the IPv6 prefix for the source addresses that
are translated by the NAT rule.[edit services nat source rule-set rule-set-name rule rule-name]user@host# set match source-address address
- Specify one or more application protocols to which the
NAT rule applies. The number of application terms must not exceed
3072.[edit services nat source rule-set rule-set-name rule rule-name]user@host# set match application [application-name]
- Specify the NAT source pool that contains the addresses
for translated source addresses.[edit services nat source rule-set rule-set-name rule rule-name]user@host# set then source-nat pool nat-pool-name
Configuring the Service Set for Deterministic NAT for Next Gen Services
To configure the service set for deterministic NAPT:
- Define the service set.[edit services]user@host# edit service-set service-set-name
- Configure either an interface service, which requires
a single service interface, or a next-hop service, which requires
an inside and outside service interface.[edit services service-set service-set-name]user@host# set interface-service service-interface interface-name
or
[edit services service-set service-set-name]user@host# set next-hop-service inside-service-interface interface-name outside-service-interface interface-name - Specify the NAT rule sets to be used with the service
set.[edit services service-set service-set-name]user@host# set nat-rule-sets rule-set-name
Clearing the Don’t Fragment Bit
If you configured deterministic NAPT64, specify that the don’t fragment (DF) bit for IPv4 packet headers is cleared when the packet length is less than 1280 bytes.
[edit services nat natv6v4]
user@host# set clear-dont-fragment-bit
This prevents unnecessary creation of an IPv6 fragmentation header when translating IPv4 packets that are less than 1280 bytes.