Example: Configuring Destination NAT for IP Address and Port Translation

This example describes how to configure destination NAT mappings of a public address to private addresses, depending on the port number.

• Requirements
• Overview
• Configuration
• Verification

Requirements

Before you begin:

1. Configure network interfaces on the device. See the Junos OS Interfaces Configuration Guide for Security Devices.
2. Create security zones and assign interfaces to them. See Understanding Security Zones.

Overview

This example uses the trust security zone for the private address space and the untrust security zone for the public address space. In Figure 112, devices in the untrust zone access servers in the trust zone by way of public address 1.1.1.200 on port 80 or 8000. Packets entering the Juniper Networks security device from the untrust zone are mapped to the private addresses of the servers as follows:

• The destination IP address 1.1.1.200 and port 80 is translated to the private address 192.168.1.200 and port 80.
• The destination IP address 1.1.1.200 and port 8000 is translated to the private address 192.168.1.220 and port 8000.

This example describes the following configurations:

• Destination NAT pool dst-nat-pool-1 that contains the IP address 192.168.1.200 port 80.
• Destination NAT pool dst-nat-pool-2 that contains the IP address 192.168.1.220 and port 8000.
• Destination NAT rule set rs1 with rule r1 to match packets received from the untrust zone with the destination IP address 1.1.1.200 and destination port 80. For matching packets, the destination address is translated to the address in the dst-nat-pool-1 pool.
• Destination NAT rule set rs1 with rule r2 to match packets received from the untrust zone with the destination IP address 1.1.1.200 and destination port 8000. For matching packets, the destination IP address and port are translated to the address and port in the dst-nat-pool-2 pool.
• Proxy ARP for the address 1.1.1.200/32. This allows the Juniper Networks security device to respond to ARP requests received on the interface for that address.
• Security policies to permit traffic from the untrust zone to the translated destination IP addresses in the trust zone.

Configuration

CLI Quick Configuration

To quickly configure a destination NAT mapping from a public address to a private address, copy the following commands and paste them into the CLI.

Step-by-Step Procedure

The following example requires you to navigate throughout various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

To configure a destination NAT mapping from a public address to a private address:

1. Create destination NAT pools.
   [edit security nat destination]user@host# set pool dst-nat-pool-1 address 192.168.1.200 port 80user@host# set pool dst-nat-pool-2 address 192.168.1.220 port 8000
2. Create a destination NAT rule set.
   [edit security nat destination]user@host# set rule-set rs1 from zone untrust
3. Configure a rule that matches packets and translates the destination address to the address in the pool.
   [edit security nat destination]user@host# set rule-set rs1 rule r1 match destination-address 1.1.1.200user@host# set rule-set rs1 rule r1 match destination-port 80user@host# set rule-set rs1 rule r1 then destination-nat pool dst-nat-pool-1
4. Configure a rule that matches packets and translates the destination address to the address in the pool.
   [edit security nat destination]user@host# set rule-set rs1 rule r2 match destination-address 1.1.1.200user@host# set rule-set rs1 rule r2 match destination-port 8000user@host# set rule-set rs1 rule r2 then destination-nat pool dst-nat-pool-2
5. Configure proxy ARP.
   [edit security nat]user@host# set proxy-arp interface ge-0/0/0.0 address 1.1.1.200/32
6. Configure address book entries in the trust zone for the server addresses.
   [edit security]user@host# set zones security-zone trust address-book address server-1 192.168.1.200/32user@host# set zones security-zone trust address-book address server-2 192.168.1.220/32
7. Configure a security policy that allows traffic from the untrust zone to the servers in the trust zone.
   [edit security policies from-zone untrust to-zone trust]user@host# set policy server-access match source-address any destination-address [server-1 server-2] application anyuser@host# set policy server-access then permit

Results

From configuration mode, confirm your configuration by entering the show security nat and show security policies commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying Destination NAT Pool Usage
• Verifying Destination NAT Rule Usage
• Verifying NAT Application to Traffic

Verifying Destination NAT Pool Usage

Purpose

Verify that there is traffic using IP addresses from the destination NAT pool.

Action

From operational mode, enter the show security nat destination pool all command. View the Translation hits field to check for traffic using IP addresses from the pool.

Verifying Destination NAT Rule Usage

Purpose

Verify that there is traffic matching the destination NAT rule.

Action

From operational mode, enter the show security nat destination rule all command. View the Translation hits field to check for traffic that matches the rule.

Verifying NAT Application to Traffic

Purpose

Verify that NAT is being applied to the specified traffic.

Action

From operational mode, enter the show security flow session command.

Related Topics

• Junos OS Feature Support Reference for SRX Series and J Series Devices
• Understanding Destination NAT
• Destination NAT Configuration Overview
• Example: Configuring Destination NAT for Single Address Translation
• Example: Configuring Destination NAT for Subnet Translation