Description

This article provides information about the destination NAT with a contiguous block of addresses.

Symptoms

In case of a contiguous block of addresses, pool based destination NAT performs one-to-one mapping between the IP addresses in the match conditions to the IP addresses that are defined in the address pool.

Solution


The following scenarios are possible, in case of Destination NAT with more than one IP address in the match condition and the pool:

Scenario 1 - The address range is equal in the match condition and address pool :

[edit]
root@210-5# show security nat destination
pool p1 {
    address 192.168.1.0/24;
}
rule-set rs1 {
    from zone trust;
    rule r1 {
        match {
            destination-address 20.1.1.0/24;
        }
then {
    destination-nat pool p1;
}
    }
}
Result :

One-to-one mapping is created as follows :
20.1.1.1 -> 192.168.1.1
20.1.1.2 -> 192.168.1.2
20.1.1.3 -> 192.168.1.4
…..
Scenario 2 - The address range is unequal in the match condition and address pool :

The address range in the pool is greater than the address range in the match condition :
[edit]
root@210-5# show security nat destination
pool p1 {
     address 192.168.1.0/24;
}
rule-set rs1 {
    from zone trust;
    rule r1 {
        match {
            destination-address 20.1.1.16/28;
        }
then {
    destination-nat pool p1;
}
    }
}

Result :

One-to-one mapping is created as follows :
20.1.1.17 -> 192.168.1.1
20.1.1.18 -> 192.168.1.2
…..
20.1.1.30 -> 192.168.1.14
The rest of the IP addresses in the pool will not be used

The address range in the pool is smaller than the address range in the match condition :
[edit]
root@210-5# show security nat destination
pool p1 {
    address 192.168.1.16/28;
}
rule-set rs1 {
    from zone trust;
    rule r1 {
        match {
            destination-address 20.1.1.0/24;
        }
then {
    destination-nat pool p1;
}
    }
}
Result :

One-to-one mapping is created as follows :
20.1.1.1 -> 192.168.1.17
20.1.1.2 -> 192.168.1.18
…..
20.1.1.14 -> 192.168.1.30
20.1.1.15 -> Untranslated
…..
The IP addresses from 20.1.1.15 to 20.1.1.254 will not be translated by this rule.

Scenario 3 - The address range is equal or unequal in the match condition and address pool, but the base address is different than the subnet id :
[edit]
root@210-5# show security nat destination
pool p1 {
     address 192.168.1.10/24;
}
rule-set rs1 {
    from zone trust;
    rule r1 {
        match {
            destination-address 20.1.1.0/24;
        }
then {
    destination-nat pool p1;
}
    }
}
Result :

One-to-one mapping is created as follows :
20.1.1.1 -> 192.168.1.10
20.1.1.2 -> 192.168.1.11
20.1.1.3 -> 192.168.1.12
…..
20.1.1.244 -> 192.168.1.254
20.1.1.245 -> Untranslated
20.1.1.246 -> Untranslated
…..
Or
[edit]
root@210-5# show security nat destination
pool p1 {
     address 192.168.1.0/24;
}
rule-set rs1 {
    from zone trust;
    rule r1 {
        match {
            destination-address 20.1.1.10/24;
        }
then {
    destination-nat pool p1;
}
    }
}
Result :

One-to-one mapping is created as follows :
20.1.1.1 -> Untranslated
20.1.1.2 -> Untranslated
…..
20.1.1.10 -> 192.168.1.1
20.1.1.11 -> 192.168.1.2
…..
20.1.1.254 -> 192.168.1.245
The 192.168.1.246 to 192.168.1.255 IP addresses in the 192.168.1.0/24 pool will be unused.

Note : In case of Static NAT, the subnets in the match condition and the static NAT prefix have to be the same.