I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Advanced Network Address Translation (NAT)

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Advanced Network Address Translation (NAT)

Advanced NAT questions test two things: the exact sequence in which translation and policy happen, and the extra plumbing (proxy ARP, persistent NAT, hairpin) that makes a design survive real traffic.

Core rules

  • Ingress order of operations: destination NAT first, then security policy, then source NAT. Consequence: policy matches the pre-NAT source address and the post-NAT destination address - a favourite exam trap.
  • Source NAT: set security nat source rule-set rs1 from zone trust / to zone untrust, rule r1 match source-address 10.1.1.0/24, then source-nat interface or a pool. Pools translate ports with overloading so many hosts can share an address.
  • Destination NAT: a rule-set from zone untrust matching the public address and original port, with then destination-nat pool dp1 (port mapping) or static-nat prefix 10.1.1.5/32.
  • Twice NAT: one destination rule-set plus one source rule-set applied to the same flow.
  • Proxy ARP is required for any address the SRX does not own but must answer for: set security nat proxy-arp interface ge-0/0/0.0 address 203.0.113.5 to 203.0.113.10.
  • Persistent NAT keeps a mapping after the session ends so an external host can open sessions back in; it needs persistent-nat permit any-remote-host (or target-host) inside the source rule.
  • Hairpin: internal clients reaching a server via its public address need a source rule-set with the same zone in both from and to.

Worked example

Publish 10.1.1.5:80 as 203.0.113.5:8080. The destination rule matches destination-address 203.0.113.5/32 destination-port 8080 and maps to 10.1.1.5 port 80. The untrust-to-trust policy then matches destination 10.1.1.5 (post-NAT) and application junos-http, because the port was already translated to 80. Proxy ARP is configured for 203.0.113.5 so the upstream router resolves the SRX MAC.

Traps

  • Writing the policy against 203.0.113.5 instead of the translated address.
  • Omitting proxy ARP and blaming the ISP.
  • Using a pool without port translation when addresses are fewer than hosts.
  • Hairpin flows silently dropped because no same-zone source NAT rule exists.
  • Reading only the translated address in show security flow session and missing the original.