NAT is configured independently and with stateful firewall filters. Some show commands used for verification are common for the stateful firewall filters and NAT. For verifying NAT configured with stateful firewall filters, see Verifying Stateful Firewall Filter Configuration.
To verify a NAT configuration, perform these tasks:
Verify NAT configuration.
From the J-Web interface, select Configuration> View and Edit> View Configuration Text.
Alternatively, from configuration mode in the CLI perform the following tasks:
The sample output in this section displays the NAT configurations provided in Configuring Basic Source Static NAT.
- [edit]
- user@r1# show services
- nat {
-
- pool nat-pool {
- address {
- 121.0.1.0/24;
- }
- }
-
- rule nat-rule {
- match-direction output;
-
- term nat-term {
-
- from {
-
- source-address {
- 10.0.1.0/24;
- }
- }
-
- then {
-
- translated {
- source-pool nat-pool;
- translation-type source static;
- }
- }
- }
- }
- }
- service-set nat-service-set {
- nat-rules nat-rule;
-
- interface-service {
- service-interface sp-0/0/0;
- }
- }
-
- [edit]
- user@r1# show interfaces
- t3–1/0/0 {
- description “t3–1/0/0 on r1”;
-
- unit 0 {
-
- family inet {
-
- service {
-
- input {
- service-set nat-service-set;
- }
-
- output {
- service-set nat-service-set;
- }
- }
- }
- }
Verify that the output shows the intended NAT and interface configurations.
Verify the NAT configured in Configuring Basic Source Static NAT.
Take the following actions:
 |
Note: You are configuring loopback addresses in this example for verification purposes only. If you have the network set up and the source address 10.0.1.2 is configured on a host, ping an external router from the host. In this case, you do not need to configure the loopback address. |
user@r1> ping 24.40.80.2 source 10.0.1.2
PING 24.40.80.2 (24.40.80.2): 56 data bytes 64 bytes from 24.40.80.2: icmp_seq=0 ttl=64 time=6.669 ms 64 bytes from 24.40.80.2: icmp_seq=1 ttl=64 time=40.441 ms ...
user@r1> show services stateful-firewall
conversations extensive
Interface: sp-0/0/0, Service set: nat-service-set
Conversation: ALG protocol: icmp
Number of initiators: 1, Number of responders: 1
Flow State Dir Frm count
ICMP 10.0.1.2:52499 -> 24.40.80.2 Watch O 2
NAT source 10.0.1.2:52499 -> 121.0.1.2:52499
Byte count: 84
Flow role: Master, Timeout: 30, Protocol detail: echo request
ICMP 24.40.80.2:52499 -> 121.0.1.2 Watch I 2
NAT dest 121.0.1.2:52499 -> 10.0.1.2:0
Byte count: 84
Flow role: Responder, Timeout: 30, Protocol detail: echo reply
Verify the following information:
Alternatively, you can use the show services stateful-firewall flows command to display the NAT flows. The show services stateful-firewall conversations command is easier to use for verification because it displays corresponding NAT flows together instead of a random listing of all flows.