This article describes the procedure of checking the order of NAT rules and also modifying it, using CLI commands.

The Resolution Guides for SRX NAT refer to this article.

It is observed that the Source NAT is not occurring for any traffic, and the Local LAN users are not able to surf the Internet.

In this example, there are two source NAT rules configured, which you suspect are in the incorrect order.   

Perform the following steps:

1. Display the rules:
   

   # show security nat source rule-set rs1 
   from zone trust;
   to interface st0.0;
   rule 1 {
       match {
           source-address 0.0.0.0/0;
       }
       then {
           source-nat {
               off;
           }
       }
   }
   rule 2 {
       match {
           source-address 192.168.0.0/16;
       }
       then {
           source-nat {
               interface;
           }
       }                                   
   }
   

• Reorder the rules using a CLI command.           
  
  In this example, we want Rule 2 to be moved above Rule 1, in order to make sure the Rule 2 gets hit.  Rule 2 performs a Source NAT for the 192.168.0.0/16 subnet.
  
  # insert security nat source rule-set rs1 rule 2 before rule 1 or
  # insert security nat source rule-set rs1 rule 1 after rule 2

  
  Check the order again:
  

  # show security nat source rule-set rs1 

  from zone trust;
  to interface st0.0;
  rule 2 {
      match {
          source-address 192.168.0.0/16;
      }
      then {
          source-nat {
              interface;
          }
      }                                   
  }
  rule 1 {
      match {
          source-address 0.0.0.0/0;
      }
      then {
          source-nat {
              off;
          }
      }
  }