NAT
Learn about NAT rules on SRX1600, SRX4120, and SRX4300 Firewalls, including NAT capacity, IP support limits with object locking (OL) capability, persistent NAT bindings, and softwire initiator and concentrator capacity.
NAT Rule and Objects
The Network Address Translation (NAT) rule capacity requirement depends on the firewall and the Junos OS release.
The limit on NAT rules per rule set represents the maximum number of rules that the device can support. This constraint is designed to help you plan and configure your NAT rules efficiently, ensuring optimal performance and proper resource utilization on the device.
| NAT Rule Type | SRX1600 | SRX4120 | SRX4300 |
|---|---|---|---|
| Source NAT rules | 8,192 | 20,480 | 20,480 |
| Destination NAT rules | 8,192 | 20,480 | 20,480 |
| Static NAT rules | 8,192 | 20,480 | 20,480 |
The SRX1600, SRX4120, and SRX4300 Firewalls support multiple IP addresses with its object locking capability. Object locking enables efficient management and control of network resources, enhancing security and operational efficiency.
| Objects and IPs Supported with OL | SRX1600 | SRX4120 | SRX4300 |
|---|---|---|---|
| Total NAT rule sets per system | 10000 | 10000 | 30720 |
| Total NAT rules per rule set | 10000 | 10000 | 30720 |
| Number of IPs supported with OL | 2 | 16 | 16 |
Source NAT pools and rule set configuration:
Source NAT pools set security nat source pool src-nat-pool-1 address 192.0.2.1 to 192.0.2.24 set security nat source pool src-nat-pool-2 address 192.0.2.100 to 192.0.2.249 set security nat source pool src-nat-pool-2 port no-translation Source NAT rule-set rs1 set security nat source rule-set rs1 from zone trust set security nat source rule-set rs1 to zone untrust r1: 10.1.1.0/24 and 10.1.2.0/24 NAT to pool-1 set security nat source rule-set rs1 rule r1 match source-address 10.1.1.0/24 set security nat source rule-set rs1 rule r1 match source-address 10.1.2.0/24 set security nat source rule-set rs1 rule r1 match destination-address 0.0.0.0/0 set security nat source rule-set rs1 rule r1 then source-nat pool src-nat-pool-1 r2: 192.168.1.250/32 no-NAT set security nat source rule-set rs1 rule r2 match source-address 192.168.1.250/32 set security nat source rule-set rs1 rule r2 match destination-address 0.0.0.0/0 set security nat source rule-set rs1 rule r2 then source-nat off r3: 192.168.1.0/24 NAT to pool-2 set security nat source rule-set rs1 rule r3 match source-address 192.168.1.0/24 set security nat source rule-set rs1 rule r3 match destination-address 0.0.0.0/0 set security nat source rule-set rs1 rule r3 then source-nat pool src-nat-pool-2 Proxy ARP (on the external interface unit referenced) set security nat proxy-arp interface ge-0/1/0 address 192.0.2.1 to 192.0.2.24 set security nat proxy-arp interface ge-0/1/0 address 192.0.2.100 to 192.0.2.249 Security policy trust -> untrust (permit any) set security policies from-zone trust to-zone untrust policy internet-access match source-address any set security policies from-zone trust to-zone untrust policy internet-access match destination-address any set security policies from-zone trust to-zone untrust policy internet-access match application any set security policies from-zone trust to-zone untrust policy internet-access then permit
Persistent NAT Binding
The SRX1600, SRX4120, and SRX4300 Firewalls support persistent NAT (NAT binding persistence). When you enable persistent NAT and tune the device for higher NAT mapping scale, the device can maintain a larger number of persistent NAT bindings.
NAT64 configuration:
set security nat source pool PERSIST-PUB address 192.168.17.19 to 192.168.17.20 set security nat source pool PERSIST-PUB address-persistent subscriber ipv6-prefix-length 10 set security nat source rule-set RS-PERSIST from zone trust set security nat source rule-set RS-PERSIST to zone untrust set security nat source rule-set RS-PERSIST rule R1 match source-address 10.1.1.0/24 set security nat source rule-set RS-PERSIST rule R1 match destination-address 0.0.0.0/0 set security nat source rule-set RS-PERSIST rule R1 then source-nat pool PERSIST-PUB
Ensure security policies permit the traffic and proxy-ARP if needed on untrust interfaces.
Verify your configurations using the show configuration security nat source |
display set command.
DS-Lite Softwire Initiator and Concentrator Capacity
The SRX1600, SRX4120, and SRX4300 Firewalls support softwire initiators and concentrators with platform-dependent maximum capacities, as shown below:
| Platform | Maximum Softwire Initiators | Maximum Softwire Concentrators |
|---|---|---|
| SRX1600 | 300 | 32 |
| SRX4120 | 300 | 32 |
| SRX4300 | 200000 | 32 |
Configure a DS-Lite softwire concentrator to convert IPv4 packets into IPv6 packets.
set security softwires softwire-name my_sc1 softwire-concentrator 2001:db8::1 softwire-type IPv4-in-IPv6
NAT Pool and Port Address Translation (PAT) Maximum Address Capacity
Source NAT pool configuration:
[edit security nat source] set pool src-nat-pat-addr address 192.168.0.0 to 192.168.3.255 set pool src-nat-pat-addr address 192.168.4.0 to 192.168.7.255
| Pool/PAT Maximum Address Capacity | SRX1600 | SRX4120 | SRX4300 |
|---|---|---|---|
| Source NAT pools | 8,192 | 20,480 | 20,480 |
| IP addresses supporting port translation | 262,144 | 524,288 | 524,288 |
| PAT port number | ~640 million | ~1.2 billion | ~1.2 billion |