Policy based destination NAT not working when destination NAT address is on same subnet as the interface.

Policy based destination NAT not working when destination NAT address is on same subnet as the interface.

Example:

• Outside interface IP is 12.11.10.1/24.
• Users need to access SMTP server from Internet to internal 10.11.12.5/24 server address.
• SMTP public side IP needs to be 12.11.10.5.

[edit security nat]
user@router# show
destination-nat test-incoming address 10.11.12.5 port 25;

[edit security policies from-zone untrust to-zone untrust]
user@router# show
policy dest-nat-smtp {
    match {
        source-address any;
        destination-address address_12-11-10-5_32;
        application junos-smtp;
    }
    then {
        permit {
            destination-nat {
                test-incoming;
            }
        }
    }
}

This fails due to failure of ARP resolution for the destination NAT address. When configuring destination NAT for an address on the same subnet as the ingress interface, you must also configure proxy-arp to allow the J-Series router to properly respond to the ARP requests for the destination NAT address. Proxy-arp can be enabled on the [edit interfaces <interface-name> unit <unit #> ] hierarchy. However in some instances such as for reth interfaces in HA, you would configure proxy-arp within the [security nat] hierarchy. Within the security hierachy is preferred over the interfaces hierarchy configuration since the IP which we would respond to ARP can be specified.

Example:

[edit security nat]
user@router# show
destination-nat test-incoming address 10.11.12.5 port 25;
interface ge-0/0/0.0 {
    proxy-arp {
        address {
            12.11.10.5;
        }
    }
}