Network Address Translation and Advanced Services
Network Address Translation and Advanced Services tests NAT design choices and the service chain that runs after policy: ALGs, AppSecure, IDP, UTM, and screens.
NAT types
Source NAT translates the client and can use an interface address or a pool. Persistent NAT keeps a mapping so an external host can initiate back to the translated host; it is configured on the source NAT pool. Destination NAT translates the server address and port; policy is evaluated after destination NAT, so the policy destination is the translated private address. Static NAT is one-to-one in both directions. NPTv6 translates IPv6 prefixes statelessly; NAT64 translates between IPv6 and IPv4.
Advanced services
ALGs handle embedded addresses in protocols such as SIP, FTP, and MSRPC. AppSecure adds AppID, AppTrack, AppFW, and AppQoS; policies can match dynamic applications. UTM features-antivirus, web filtering, antispam, content filtering-are configured in a UTM policy and attached to a security policy action. Screens protect against floods and malformed packets before policy.
Worked example
Publish 203.0.113.10:80 to 10.1.1.10:8080. Create a destination NAT pool with address 10.1.1.10 port 8080, a rule-set from the untrust zone matching destination 203.0.113.10/32 port 80, and enable proxy-ARP on the untrust interface. Add a policy from untrust to trust permitting junos-http to 10.1.1.10. Reasoning: the policy sees the translated address 10.1.1.10, not 203.0.113.10. Proxy-ARP is needed if the public address is not on the interface subnet.
Traps
- Writing the destination NAT policy to match the public address instead of the private one.
- Forgetting proxy-ARP, so ARP for the public address goes unanswered.
- Assuming persistent NAT is automatic; it must be enabled on the pool.
- Attaching a UTM policy to the wrong policy or zone pair, so traffic is never scanned.