Configuring Network Address Port Translation for Next Gen Services
Configuring the Source Pool for NAPT
To configure the source pool for NAPT:
- Create a source pool.
user@host# edit services nat source pool nat-pool-name
- Define the addresses or subnets to which source addresses
are translated.
[edit services nat source pool nat-pool-name] user@host# set address address-prefix
or
[edit services nat source pool nat-pool-name] user@host# set address address-prefix to address address-prefix
- To configure automatic port assignment for the pool, specify
either random allocation or round-robin allocation. Round-robin allocation
is the default.
[edit services nat source pool nat-pool-name port] user@host# set automatic (random-allocation | round-robin)
Random allocation randomly assigns a port from the range 1024 through 65535 for each port translation. Round-robin allocation first assigns port 1024, and uses the next higher port for each successive port assignment.
- To disable round-robin port allocation for all NAT pools
that do not specify an
automatic (random-allocation | round-robin)setting, configure the global setting.[edit services nat source] user@host# set port-round-robin disable
- To configure a range of ports to assign to a pool, perform
the following:Note:
If you specify a range of ports to assign, the
automaticstatement is ignored.- Specify the low and high values for the port. If you do
not configure automatic port assignment, you must configure a range
of ports.
[edit services nat source pool nat-pool-name port] user@host# set range port-low to port-high
- Specify either random allocation or round-robin allocation.
Round-robin allocation is the default.
[edit services nat source pool nat-pool-name port range] user@host# set (random-allocation | round-robin)
- Specify the low and high values for the port. If you do
not configure automatic port assignment, you must configure a range
of ports.
- Assign a port within the same range as the incoming port—either
0 through 1023 or 1024 through 65,535. This feature is not available
if you configure port-block allocation.
[edit services nat source pool nat-pool-name port] user@host# set preserve-range
- Assign a port with the same parity (even or odd) as the
incoming source port. This feature is not available if you configure
port-block allocation.
[edit services nat source pool nat-pool-name port] user@host# set preserve-parity
- Configure a global default port range for NAT pools that
use port translation. This port range is used when a NAT pool does
not specify a port range and does not specify automatic port assignment.
The global port range can be from 1024 through 65,535.
[edit services nat source] user@host# set pool-default-port-range port-low to port-high
- If you want to allocate a block of ports for each subscriber
to use for NAPT, configure port-block allocation:
- Configure the number of ports in a block. The range is
1 through 64,512 and the default is 128.
[edit services nat source pool nat-pool-name port] user@host# set block-allocation block-size block-size
- Configure the interval, in seconds, for which the block
is active. After the timeout, a new block is allocated, even if ports
are available in the active block. If you set the timeout to 0, port
blocks are filled completely before a new port block is allocated,
and the last port block remains active indefinitely. The range is
0 through 86,400, and the default is 0.
[edit services nat source pool nat-pool-name port block-allocation] user@host# set active-block-timeout timeout-interval
- Specify the timeout period for address-pooling paired
mappings that use the NAT pool. The range is 120 through 86,400 seconds,
and the default is 300. Mappings that are inactive for this amount
of time are dropped.
[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations. - Configure the maximum number of blocks that can be allocated
to a user address. The range is 1 through 512, and the default is
8.
[edit services nat source pool nat-pool-name port block-allocation] user@host# set maximum-blocks-per-host maximum-block-number
- Specify how often to send interim system logs for active
port blocks and for inactive port blocks with live sessions. This
increases the reliability of system logs, which are UDP-based and
can get lost in the network. The range is 1800 through 86,400 seconds,
and the default is 0 (interim logs are disabled).
[edit services nat source pool nat-pool-name port block-allocation] user@host# set interim-logging-interval timeout-interval
- Configure the number of ports in a block. The range is
1 through 64,512 and the default is 128.
- Specify the timeout period for endpoint independent translations
that use the specified NAT pool. Mappings that are inactive for this
amount of time are dropped. The range is 120 through 86,400 seconds.
If you do not configure
ei-mapping-timeout, then themapping-timeoutvalue is used for endpoint independent translations.[edit services nat source pool nat-pool-name] user@host# set ei-mapping-timeout ei-mapping-timeout
- Specify the timeout period for address-pooling paired
mappings that use the NAT pool. The range is 120 through 86,400 seconds,
and the default is 300. Mappings that are inactive for this amount
of time are dropped.
[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations. - Define the NAT pool utilization levels that trigger SNMP
traps. The
raise-thresholdis the pool utilization percentage that triggers the trap, and the range is 50 through 100. Theclear-thresholdis the pool utilization percentage that clears the trap, and the range is 40 through 100. For pools that use port-block allocation, the utilization is based on the number of ports that are used; for pools that do not use port-block allocation, the utilization is based on the number of addresses that are used.[edit services nat source pool nat-pool-name] user@host# set pool-utilization-alarm raise-threshold value user@host# set pool-utilization-alarm clear-threshold value
If you do not configure
pool-utilization-alarm, traps are not created. - To allow the IP addresses of a NAT pool to overlap with
IP addresses in pools used in other service sets, configure
allow-overlapping-pools. However, pools that configure port-block allocation must not overlap with other pools.[edit services nat] user@host# set allow-overlapping-pools
Configuring the NAT Source Rule for NAPT
To configure the NAT source rule for NAPT:
- Configure the NAT rule name.
[edit services nat source] user@host# edit rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the NAT rule set
applies.
[edit services nat source rule-set rule-set-name] user@host# set match-direction (in | out | in-out)
- Specify the source addresses that are translated by the
source NAT rule.
To specify one address or prefix value:
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address address
To specify a range of addresses, configure an address book global address with the desired address range, and assign the global address to the NAT rule:
[edit services address-book global] user@host# set address address-name range-address lower-limit to upper-limit [edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address-name address-name
To specify any unicast address:
[edit services nat source rule-set rule-set-name rule rule-name rule rule-name] user@host# set match source-address any-unicast
- Specify one or more application protocols to which the
NAT rule applies. The number of applications listed in the rule must
not exceed 3072.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match application [application-name]
- Specify the NAT pool that contains the addresses for translated
traffic.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set then source-nat pool nat-pool-name
- Configure the address-pooling
paired feature if you want to ensure assignment of the same external
IP address for all sessions originating from the same internal host.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat mapping-type] user@host# set address-pooling
- If you want to ensure that the same external address and
port are assigned to all connections from a given host, configure
endpoint-independent mapping:
- Configure the mapping type as endpoint independent.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set mapping-type endpoint-independent
- Specify prefix lists that contain the hosts that are allowed
to establish inbound connections using the endpoint-independent mapping.
(Prefix lists are configured at the
[edit policy-options]hierarchy level.)[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set filtering-type endpoint-independent prefix-list [allowed-host] except [denied-host]
- Specify the maximum number of inbound flows allowed simultaneously
on an endpoint-independent mapping.
[edit services nat source rule-set rule-set-name rule rule-name filtering-type then source-nat] user@host# set secure-nat-mapping eif-flow-limit number-of-flows
- Specify the direction in which active endpoint-independent
mapping is refreshed. By default, mapping is refreshed for both inbound
and outbound active flows.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set secure-nat-mapping mapping-refresh (inbound | inbound-outbound | outbound)
- Configure the mapping type as endpoint independent.
- Configure the generation of a syslog when traffic matches
the NAT rule conditions.
[edit services nat source rule-set rule-set-name rule rule-name then] user@host# set syslog
Configuring the Service Set for NAPT
To configure the service set for NAPT:
- Define the service set.
[edit services] user@host# edit service-set service-set-name
- Configure either an interface service, which requires
a single service interface, or a next-hop service, which requires
an inside and outside service interface.
[edit services service-set service-set-name] user@host# set interface-service service-interface interface-name
or
[edit services service-set service-set-name] user@host# set next-hop-service inside-service-interface interface-name outside-service-interface interface-name
- Specify the NAT rule sets to be used with the service
set.
[edit services service-set service-set-name] user@host# set nat-rule-sets rule-set-name