CSO support static nat use case when traffic is originated from LAN towards WAN . When traffic is originated from WAN to LAN, CSO supports destination nat . This article provides sample configuration when customer wanted to configure static NAT in the site and traffic is originated from Internet . 

• Site onboarded through SaaS CSO Portal and LAN segments deployed in the site

• Traffic originated from internet towards the spoke LAN.

• Tenant admin (example : Demotenant) opted for static NAT scenario.

Sample Topology:

Internet [ 10.25.85.237/26 ] ----------> [ 10.25.85.197/26] ge-0/0/2 NFX 250 ------> LAN [ 192.168.227.254/24 ] 

Customer can use below mentioned sample static NAT configuration to allow the traffic from Internet towards the spoke LAN.

Sample Static NAT configuration :

=========================

set security nat static rule-set rs1 from zone untrust-WAN_0

set security nat static rule-set rs1 rule r1 match destination-address 10.25.85.195/32

set security nat static rule-set rs1 rule r1 then static-nat prefix 192.168.227.1/32

set security nat proxy-arp interface ge-0/0/2.0 address 10.25.85.195/32

set security policies from-zone Default to-zone untrust-WAN_0 policy permit-all match source-address any

set security policies from-zone Default to-zone untrust-WAN_0 policy permit-all match destination-address any

set security policies from-zone Default to-zone untrust-WAN_0 policy permit-all match application any

set security policies from-zone Default to-zone untrust-WAN_0 policy permit-all then permit

set security policies from-zone untrust-WAN_0 to-zone trust policy server-access match source-address any

set security policies from-zone untrust-WAN_0 to-zone trust policy server-access match destination-address any

set security policies from-zone untrust-WAN_0 to-zone trust policy server-access match application any

set security policies from-zone untrust-WAN_0 to-zone trust policy server-access then permit

set routing-instances WAN_0 routing-options static route 192.168.227.0/24 next-table LAN-DEMOTENANT_DefaultVPN.inet.0

% Following snippet of configuration is part of CSO site onboarding % 

set routing-instances WAN_0 instance-type virtual-router 

set routing-instances WAN_0 interface ge-0/0/2.0

set routing-instances WAN_0  routing-options  static route  0.0.0.0/0 next-hop 10.25.85.254

set routing-instances WAN_0  routing-options instance-import inet0-to-WAN_0

set interfaces ge-0/0/2 description "WAN-0 interface"

set interfaces ge-0/0/2 unit 0 family inet  address 10.25.85.197/26

set security zones security-zone untrust-WAN_0 host-inbound-traffic system-services dhcp 

set security zones security-zone untrust-WAN_0 host-inbound-traffic system-services dhcpv6

set security zones security-zone untrust-WAN_0 host-inbound-traffic system-services ike

set security zones security-zone untrust-WAN_0 host-inbound-traffic system-services ssh

set security zones security-zone untrust-WAN_0 host-inbound-traffic system-services ping

set security zones security-zone untrust-WAN_0 host-inbound-traffic protocols bgp 

set security zones security-zone untrust-WAN_0 interfaces ge-0/0/2.0

• Sample Flow session output shown as mentioned below

Session ID: 77309792433, Policy name: default-policy-logical-system-00/2, Timeout: 56, Session State: Valid

 In: 10.25.85.237/32673 --> 10.25.85.195/12302;icmp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 1, Bytes: 60,

 Out: 192.168.227.1/12302 --> 10.25.85.237/32673;icmp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 1, Bytes: 60,