NAT and Flow-Based Forwarding
NAT and flow-based forwarding tests whether you can translate addresses without breaking policy, routing, or return traffic. JNCIS-SEC expects source NAT, destination NAT, static NAT, PAT, proxy ARP, and the session behavior that ties them together.
NAT types
- Source NAT translates the source address of outbound flows. Interface source NAT uses the egress interface address; pool source NAT uses a configured address pool and commonly translates ports (PAT).
- Destination NAT translates the destination address of inbound flows, mapping a public address to an internal server. Static NAT provides a fixed one-to-one mapping.
- Proxy ARP is needed when the SRX must answer ARP for a NAT address that is not on the egress interface's subnet.
Flow-based forwarding
- The SRX uses route lookup, zone lookup, policy, and NAT together. A route alone does not permit traffic; a policy alone does not translate it.
- The session stores the original and translated tuples. Return traffic matches the session and is translated back without a new policy lookup.
Worked example: Trust is 10.0.0.0/24; untrust is ge-0/0/0 with 203.0.113.1/24. A source NAT pool is 203.0.113.10/32. Host 10.0.0.5:51515 opens HTTPS to 198.51.100.20:443. The route sends the flow out ge-0/0/0; a trust-to-untrust policy permits junos-https; source NAT translates the source to 203.0.113.10:40000. The session records 10.0.0.5:51515 to 198.51.100.20:443 and 203.0.113.10:40000 to 198.51.100.20:443. The reply to 203.0.113.10:40000 matches the session and is translated back to 10.0.0.5:51515. Reasoning: policy permits the flow, NAT changes the addresses, and the session makes the return path work.
Traps: expecting NAT to bypass policy; forgetting proxy ARP for destination NAT; overlapping NAT pools; confusing destination NAT with static NAT; and assuming a new policy lookup is needed for return traffic.