This article explains the purpose, use case, and potential impact of the address-persistent knob in source NAT configuration on SRX. It also describes scenarios where enabling or disabling this feature may help with application performance.

The address-persistent option in SRX source NAT configuration ensures that the same translated source IP address and port are consistently used for all sessions initiated by a specific source IP.

While this behavior benefits certain protocols requiring stable NAT mappings, it may cause unintended issues with applications such as speedtest.net services that rely on varying NAT flows.

When address-persistent is enabled,

• Unable to perform speed tests on websites like speedtest.net
• Some users intermittently unable to load specific website elements (logos)
• VPN tunnels may fail to establish when using NAT with persistent address mapping

Option 1: Disable address-persistent

If your environment does not require consistent source NAT mappings, it is recommended to remove the address-persistent configuration to allow dynamic port assignment.

user@host> delete security nat source rule-set <rule-set-name> rule <rule-name> then source-nat pool <pool-name> address-persistent

Option2: Reduce TCP MSS to Avoid Fragmentation

In cases where traffic passes through a tunnel or WAN interface with smaller MTU, set TCP MSS to reduce fragmentation:

user@host> set security flow tcp-mss all-tcp mss 1350