This KB will explain why STATIC NAT could stop working after a reboot or an upgrade.

The goal is to identify the problem and provide a quick workaround to resolve the issue.

  In cases where static NAT is configured from the routing-instance VR context, if the name of the routing-instance matches any zone, then the STATIC NAT ruleset doesn't get pushed to the pfe (packet forwarding engine) after the reboot and requires manual intervention.

Configuration:
==============

static {
            rule-set lps-to-backbone {
                from routing-instance LPS;
                rule test {
                    match {
                        destination-address x.x.x.x/x;
                    }
                    then {
                        static-nat prefix y.y.y.y/y routing-instance Backbone;   <<<< Notice the name is "Backbone"
                    }
                }
            }
        }
		
		
		
zones {
        security-zone Backbone {            <<<<<<< Notice the name is same as in the routing-instance static-nat stanza.
                host-inbound-traffic {
                system-services {
                    ping;
                }
            }
            interfaces {
                rethx.x;
            }
        }		

Symptoms:
=========

root# run show security nat static rule all 
Total static-nat rules: 1
Total referenced IPv4/IPv6 ip-prefixes: 2/0
 
Static NAT rule: test      Rule-set: lps-to-backbone   <<<< Rule-set is working to begin with.
  Rule-Id                    : 1  
  Rule position              : 1
  From routing instance      : LPS
  Destination addresses      : 204.86.81.217
  Host addresses             : 10.101.81.127
  Netmask                    : 32
  Host routing-instance      : Backbone
  Translation hits           : 0


*******************************************
rebooted system
*******************************************


[edit]
root# run show security nat static rule all 
Total static-nat rules: 0                           <<<<<<<< After the reboot, the rule-set didn't get pushed to the pfe.
Total referenced IPv4/IPv6 ip-prefixes: 0/0

**********************************************
		
		
Workaround/Solution:
====================		
		
- This issue is a known issue and has been fixed in 11.2R7. 
- After the reboot when the problem happens, please deactivate and activate the ruleset manually. This will correct it.

# deactivate security nat static 
# commit 
# activate security nat static      
#commit                          

Verification:
=============

root# run show security nat static rule all    
Total static-nat rules: 1
Total referenced IPv4/IPv6 ip-prefixes: 2/0
 
Static NAT rule: test      Rule-set: lps-to-backbone 
  Rule-Id                    : 1  
  Rule position              : 1
  From routing instance      : LPS
  Destination addresses      : 204.86.81.217
  Host addresses             : 10.101.81.127
  Netmask                    : 32
  Host routing-instance      : Backbone
  Translation hits           : 0