This article helps you verify the Destination NAT Rule order using two important operational commands:
show security nat destination rule all/rulename show security nat destination pool all/poolname
The Resolution Guides for SRX NAT refer to this article.
A common Destination NAT configuration error is the configuration order of the Destination NAT Rules. The configuration order is important.
Let us assume a sample Destination NAT configuration as follows:
Rule "http": Rule "http" Matches destination 1.1.1.1 port 80, and uses pool web-pool for NAT
Rule "all-others": Matches any destination IP, and performs no NAT
Rule "mail" : Rule "mail" Matches destination 1.1.1.1 port 25, and uses pool mail-pool for NAT, but it will never be hit because rule "all-others" will always be hit
Below is the corresponding configuration commands:
[edit] root# show security nat destination pool web-pool { ##Pool for the rule "http" address 192.168.6.1/32; } pool mail-pool { ##Pool for the rule "mail" address 192.168.2.1/32; } rule-set from-internet { from zone untrust; rule http { ##This rule has no problem match { source-address 2.2.2.2/32; ##This is the source address of a random user from the internet destination-address 1.1.1.1/32; ##This is the address that the user wants to access destination-port 80; ##This is the port/service that the users wants to access } then { destination-nat pool web-pool; } } rule all-others { ##This rule has been deliberately misplaced for this example match { destination-address 0.0.0.0/0; } then { destination-nat off; ##No destination NAT done } } rule mail { ##This rule will never be hit because the rule above is more general match { source-address 2.2.2.2/32; destination-address 1.1.1.1/32; destination-port 25; } then { destination-nat pool mail-pool; } } }
In order to determine if the Destination NAT Rules are in the correct order, the following two operational commands are used:
user@srx> show security nat destination rule all/rulename user@srx> show security nat destination pool all/poolname
The output of these commands and how to interpret the running state of the Security NAT Rules are explained below:
show security nat destination rule all
show security nat destination pool all
The section below shows the running state of Destination NAT rules for the configuration in the 'Problem' section.
Rule 'http' is working correctly and Rule 'mail' is not working correctly in the output below. That is because the Rules 'all-others' and 'mail' are not in correct order.
The output can be verified with the command:
user@srx> show security nat destination rule all Total destination-nat rules: 3 Total referenced IPv4/IPv6 ip-prefixes: 5/0 Destination NAT rule: http Rule-set: from-internet ##This is the ruleset name the rule belongs to Rule-Id : 1 Rule position : 1 ##Rule's relative position - it is important From zone : untrust ##This is the context or direction of the rule Match Source addresses : 2.2.2.2 - 2.2.2.2 ##This is the matched source address Destination addresses : 1.1.1.1 - 1.1.1.1 ##This is the matched destination address Action : web-pool ##This is the pool that the rule is going to choose Destination port : 80 ##This is the matched port/service Translation hits : 10 ##This is the number of hits the rule has taken Destination NAT rule: all-others Rule-set: from-internet Rule-Id : 3 Rule position : 3 From zone : untrust Destination addresses : Any - 255.255.255.255 Action : off Destination port : 0 Translation hits : 20 ##The translation hits increase here, but they are 0 in the next rule Destination NAT rule: mail Rule-set: from-internet Rule-Id : 2 Rule position : 2 From zone : untrust Match Source addresses : 2.2.2.2 - 2.2.2.2 Destination addresses : 1.1.1.1 - 1.1.1.1 Action : mail-pool Destination port : 25 Translation hits : 0 ##Translation hits are 0, which means that the rule is not getting hit at all
This section shows the running state of the Destination NAT pools for the configuration specified in the 'Problem' section.
user@srx> show security nat destination pool all Total destination-nat pools: 2 Pool name : web-pool Pool id : 2 Routing instance: default Total address : 1 Translation hits: 10 ##Translation hits will be equal to the number in the output above Address range Port 192.168.6.1 - 192.168.6.1 0 Pool name : mail-pool Pool id : 3 Routing instance: default Total address : 1 Translation hits: 0 ##There are 0 translation hits because of misplaced rules Address range Port 192.168.2.1 - 192.168.2.1 0
In the outputs given above, it is determined that the Rule 'all-others' and the Rule 'mail' are in the incorrect order by the virtue of which the Rule 'mail' is not getting hit at all.
After swapping the rules, the following commands are run again. Note: Translation Hits for Rule 'mail' is not 0 '.
user@srx# run show security nat destination rule all Total destination-nat rules: 3 Total referenced IPv4/IPv6 ip-prefixes: 5/0 Destination NAT rule: http Rule-set: from-internet Rule-Id : 1 Rule position : 1 From zone : untrust Match Source addresses : 2.2.2.2 - 2.2.2.2 Destination addresses : 1.1.1.1 - 1.1.1.1 Action : web-pool Destination port : 80 Translation hits : 20 Destination NAT rule: mail Rule-set: from-internet Rule-Id : 2 Rule position : 2 From zone : untrust Match Source addresses : 2.2.2.2 - 2.2.2.2 Destination addresses : 1.1.1.1 - 1.1.1.1 Action : mail-pool Destination port : 25 Translation hits : 10 ##Non zero tranlation hits are seen now Destination NAT rule: all-others Rule-set: from-internet Rule-Id : 3 Rule position : 3 From zone : untrust Destination addresses : Any - 255.255.255.255 Action : off Destination port : 0 Translation hits : 30
Checking the pools statistics:
[edit] user@srx# run show security nat destination pool all Total destination-nat pools: 2 Pool name : web-pool Pool id : 2 Routing instance: default Total address : 1 Translation hits: 20 Address range Port 192.168.6.1 - 192.168.6.1 0 Pool name : mail-pool Pool id : 3 Routing instance: default Total address : 1 Translation hits: 10 ##Translation hits = 10 are seen here also Address range Port 192.168.2.1 - 192.168.2.1 0