Description

This article helps you verify the Destination NAT Rule order using two important operational commands:

show security nat destination rule all/rulename
show security nat destination pool all/poolname

The Resolution Guides for SRX NAT refer to this article.


Symptoms

A common Destination NAT configuration error is the configuration order of the Destination NAT Rules. The configuration order is important.

  • How do you know if you have a problem with the configuration order?
  • How do you verify a rule is getting hit?

Let us assume a sample Destination NAT configuration as follows:

  • Rule "http":        Rule "http" Matches destination 1.1.1.1 port 80, and uses pool web-pool for NAT
  • Rule "all-others": Matches any destination IP, and performs no NAT
  • Rule "mail" :      Rule "mail" Matches destination 1.1.1.1 port 25, and uses pool mail-pool for NAT, but it will never be hit because rule "all-others" will always be hit

Below is the corresponding configuration commands:

[edit]
root# show security nat destination 
pool web-pool { ##Pool for the rule "http"
    address 192.168.6.1/32;
}
pool mail-pool { ##Pool for the rule "mail"
    address 192.168.2.1/32;
}
rule-set from-internet {
    from zone untrust;
    rule http { ##This rule has no problem
        match {
            source-address 2.2.2.2/32; ##This is the source address of a random user from the internet
            destination-address 1.1.1.1/32; ##This is the address that the user wants to access
            destination-port 80; ##This is the port/service that the users wants to access
        }
        then {
            destination-nat pool web-pool;
        }
    }
    rule all-others { ##This rule has been deliberately misplaced for this example
        match {
            destination-address 0.0.0.0/0;
        }
        then {
            destination-nat off; ##No destination NAT done
        }
    }
    rule mail { ##This rule will never be hit because the rule above is more general
        match {
            source-address 2.2.2.2/32;
            destination-address 1.1.1.1/32;
            destination-port 25;
        }
        then {
            destination-nat pool mail-pool;
        }
    }
}


Solution


In order to determine if the Destination NAT Rules are in the correct order, the following two operational commands are used:

     user@srx> show security nat destination rule all/rulename
     user@srx> show security nat destination pool all/poolname

The output of these commands and how to interpret the running state of the Security NAT Rules are explained below:

  • NAT Destination Rule output
    (Explanation of the command: show security nat destination rule all )
  • Destination NAT Pool output
    (Explanation of the command: show security nat destination pool all )
  • Results after swapping order of the NAT Destination Rules


NAT Destination Rule output

The section below shows the running state of Destination NAT rules for the configuration in the 'Problem' section.

Rule 'http' is working correctly and Rule 'mail' is not working correctly in the output below. That is because the Rules 'all-others' and 'mail' are not in correct order.

The output can be verified with the command:

user@srx> show security nat destination rule all
Total destination-nat rules: 3
Total referenced IPv4/IPv6 ip-prefixes: 5/0
 
Destination NAT rule: http                 Rule-set: from-internet ##This is the ruleset name the rule belongs to
  Rule-Id                    : 1
  Rule position              : 1 ##Rule's relative position - it is important
  From zone                  : untrust ##This is the context or direction of the rule
  Match
    Source addresses         : 2.2.2.2         - 2.2.2.2 ##This is the matched source address
    Destination addresses    : 1.1.1.1         - 1.1.1.1 ##This is the matched destination address
  Action                     : web-pool ##This is the pool that the rule is going to choose
 
  Destination port           : 80 ##This is the matched port/service
  Translation hits           : 10 ##This is the number of hits the rule has taken
 
Destination NAT rule: all-others           Rule-set: from-internet 
  Rule-Id                    : 3  
  Rule position              : 3
  From zone                  : untrust
    Destination addresses    : Any             - 255.255.255.255
  Action                     : off 
 
  Destination port           : 0 
  Translation hits           : 20 ##The translation hits increase here, but they are 0 in the next rule
 
Destination NAT rule: mail                 Rule-set: from-internet 
  Rule-Id                    : 2  
  Rule position              : 2
  From zone                  : untrust
  Match
    Source addresses         : 2.2.2.2         - 2.2.2.2
    Destination addresses    : 1.1.1.1         - 1.1.1.1
  Action                     : mail-pool 
                                        
  Destination port           : 25 
  Translation hits           : 0 ##Translation hits are 0, which means that the rule is not getting hit at all

NAT Destination Pools output:

This section shows the running state of the Destination NAT pools for the configuration specified in the 'Problem' section.

user@srx> show security nat destination pool all                            
Total destination-nat pools: 2
 
Pool name       : web-pool
Pool id         : 2
Routing instance: default
Total address   : 1
Translation hits: 10 ##Translation hits will be equal to the number in the output above
Address range                        Port 
    192.168.6.1 - 192.168.6.1           0
 
Pool name       : mail-pool
Pool id         : 3
Routing instance: default
Total address   : 1
Translation hits: 0 ##There are 0 translation hits because of misplaced rules
Address range                        Port 
    192.168.2.1 - 192.168.2.1           0



Results after swapping order of NAT Destination Rules

In the outputs given above, it is determined that the Rule 'all-others' and the Rule 'mail' are in the incorrect order by the virtue of which the Rule 'mail' is not getting hit at all.

So to correct this, Rules "mail" and "all-others" need to be swapped. For an example on how to do this, refer to KB21783 - [SRX] Example - Checking and reordering NAT rules [juniper.net] .

After swapping the rules, the following commands are run again.  Note: Translation Hits for Rule 'mail' is not 0 '.

user@srx# run show security nat destination rule all 
Total destination-nat rules: 3
Total referenced IPv4/IPv6 ip-prefixes: 5/0
 
Destination NAT rule: http                 Rule-set: from-internet 
  Rule-Id                    : 1  
  Rule position              : 1
  From zone                  : untrust
  Match
    Source addresses         : 2.2.2.2         - 2.2.2.2
    Destination addresses    : 1.1.1.1         - 1.1.1.1
  Action                     : web-pool 
 
  Destination port           : 80 
  Translation hits           : 20
 
Destination NAT rule: mail                 Rule-set: from-internet
  Rule-Id                    : 2  
  Rule position              : 2
  From zone                  : untrust
  Match
    Source addresses         : 2.2.2.2         - 2.2.2.2
    Destination addresses    : 1.1.1.1         - 1.1.1.1
  Action                     : mail-pool 
                                        
  Destination port           : 25 
  Translation hits           : 10 ##Non zero tranlation hits are seen now
 
Destination NAT rule: all-others           Rule-set: from-internet 
  Rule-Id                    : 3  
  Rule position              : 3
  From zone                  : untrust
    Destination addresses    : Any             - 255.255.255.255
  Action                     : off 
 
  Destination port           : 0 
  Translation hits           : 30

Checking the pools statistics:

[edit]
user@srx# run show security nat destination pool all                            
Total destination-nat pools: 2
 
Pool name       : web-pool
Pool id         : 2
Routing instance: default
Total address   : 1
Translation hits: 20
Address range                        Port 
    192.168.6.1 - 192.168.6.1           0
 
Pool name       : mail-pool
Pool id         : 3
Routing instance: default
Total address   : 1
Translation hits: 10 ##Translation hits = 10 are seen here also
Address range                        Port 
    192.168.2.1 - 192.168.2.1           0