This article describes the different behaviors of static NAT on SCRP packets when SCTP profile is applied to the target policy or not.

This article describes the different behaviors of static NAT on SCRP packets when SCTP profile is applied to the target policy or not.

• When SCTP inspection profile is NOT called in a security policy: 
  • SCTP packets are forwarded directly without any inspection by the SCTP module, no matter if it’s a control or data packet. 
  • Only the IP addresses in header would be translated by the configured statis NAT. The IPs in SCTP packet payload would not be translated.
• When SCTP inspection profile is called in a security policy: 
  • Both the SCTP control and data packets would be inspected in normal situation 
  • Both the IP addresses in header and payload would be translated according to the configured NAT policy
  • When nat-only option is configure, only the NAT happens. The packets would not be inspected 

Please be aware of the following limitations for SCTP with NAT: 

• For static NAT to work, the interfaces packets (from one side: client or server side) coming in must belong to the same zone.
• Only static NAT is supported for SCTP.

2025/10/15 Article created

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/security-edit-profile-sctp.html

https://www.juniper.net/documentation/us/en/software/junos/gtp-sctp/topics/topic-map/security-gprs-sctp.html#id-understanding-stream-control-transmission-protocol