This article helps you to verify that the static NAT rule is being hit by using the show security nat static rule all/rulename operational command.

Note: The Resolution Guides for SRX NAT refer to this article.

Note: Order is not important in static NAT because all the rules are unique. (This is forced by the configuration checker.)

Let us assume a sample static NAT configuration as given below:

Rule 'http':  Matches destination 1.1.1.2 and NATs it to the destination IP 192.168.5.1

Below is the corresponding configuration commands:

show security nat static   
rule-set from-internet {
    from zone untrust;
    rule http {
        match {
            destination-address 1.1.1.2/32;
        }
        then {
            static-nat prefix 192.168.5.1/32;
        }
    }
}

The output of the command is given below with an explanation of the output. You can tell if the rule is being hit by viewing the "Translation hits" field.

show security nat static rule http 

Static NAT rule: http    Rule-set: from-internet ## This is the Rule-set name.
  Rule-Id                : 2
  Rule position          : 1 ## Rule position will not matter, because the static NAT rules are unique.
  From zone              : untrust ## Traffic from/to this zone will be evaluated.
  Destination addresses  : 1.1.1.2 ## Destination IP before translation
  Host addresses         : 192.168.5.1 ## Destination IP after translation
  Netmask                : 32
  Host routing-instance  : N/A
  Translation hits       : 10 ## This will tell us how many times the rule is hit.

2020-06-24: Article reviewed for accuracy; no changes required.

• Resolution Guide – SRX - Troubleshoot Static NAT