Will expanding the source NAT pool affect existing sessions?

Description

Will expanding the IP pool of the source NAT affect the existing sessions?

Solution

LAB test results confirm that adding new addresses to the source NAT pool does not affect existing sessions that have undergone source NAT:

root@SRX# run show configuration | display set

Sep 17 09:52:39

set version 23.2R2-S5.4

set system services ssh root-login allow

set system services ssh sftp-server

set security nat source pool snat-pool address 192.168.2.253/32

set security nat source rule-set snat-rule-set from zone trust

set security nat source rule-set snat-rule-set to zone untrust

set security nat source rule-set snat-rule-set rule 1 match source-address 192.168.1.1/32

set security nat source rule-set snat-rule-set rule 1 then source-nat pool snat-pool

set security nat proxy-arp interface xe-0/0/1.0 address 192.168.2.253/32

set security policies default-policy permit-all

set security zones security-zone trust address-book address 192.168.1.1/32 192.168.1.1/32

set security zones security-zone trust host-inbound-traffic system-services all

set security zones security-zone trust host-inbound-traffic protocols all

set security zones security-zone trust interfaces xe-0/0/0.0

set security zones security-zone untrust host-inbound-traffic system-services all

set security zones security-zone untrust host-inbound-traffic protocols all

set security zones security-zone untrust interfaces xe-0/0/1.0

set interfaces xe-0/0/0 unit 0 family inet address 192.168.1.254/24

set interfaces xe-0/0/1 unit 0 family inet address 192.168.2.254/24

[edit]

root@SRX# set security nat source pool snat-pool address 192.168.2.252/32

Sep 17 09:52:54

[edit]

root@SRX# set security nat proxy-arp interface xe-0/0/1.0 address 192.168.2.252/32

Sep 17 09:53:12

[edit]

root@SRX# show | compare

Sep 17 09:53:15

[edit security nat source pool snat-pool address]

192.168.2.253/32 { ... }

+ 192.168.2.252/32;

[edit security nat proxy-arp interface xe-0/0/1.0 address]

192.168.2.253/32 { ... }

+ 192.168.2.252/32;

[edit]

root@SRX# commit

Sep 17 09:53:17

commit complete

root@SRX# run show security nat source pool all

Sep 17 09:53:48

Total pools: 1

Pool name : snat-pool

Pool id : 4

Routing instance : default

Host address base : 0.0.0.0

Port : [1024, 63487]

Twin port : [63488, 65535]

Port overloading : 1

Address assignment : no-paired

Total addresses : 2

Translation hits : 0

Address range Single Ports Twin Ports

192.168.2.253 - 192.168.2.253 0 0

192.168.2.252 - 192.168.2.252 0 0

Total used ports : 0 0

root@SRX# run show configuration | display set

Sep 17 09:56:11

set version 23.2R2-S5.4

set system services ssh root-login allow

set system services ssh sftp-server

set security nat source pool snat-pool address 192.168.2.253/32

set security nat source pool snat-pool address 192.168.2.252/32

set security nat source rule-set snat-rule-set from zone trust

set security nat source rule-set snat-rule-set to zone untrust

set security nat source rule-set snat-rule-set rule 1 match source-address 192.168.1.1/32

set security nat source rule-set snat-rule-set rule 1 then source-nat pool snat-pool

set security nat proxy-arp interface xe-0/0/1.0 address 192.168.2.253/32

set security nat proxy-arp interface xe-0/0/1.0 address 192.168.2.252/32