This article links a commit error to the technical documentation.
Configuring dns-name in the global address book and then calling in the NAT rule does not commit on the SRX:
dns-name
root@abc# commit check
[edit security nat source rule-set Trust_to_Untrust rule rule1 match]'source-address-name 123'Address/address-set(123) isn't supported in NAT ruleerror: configuration check-out failed
Before 22.2R1, the following configuration is not supported on the SRX:
[edit] root@abc# show security address-book global { address 123 { dns-name 123.com; <<<<<<<<<< } address anyv4 0.0.0.0/0; address 12345 1.2.3.4/32; } root@abc# show security nat source pool first { address { 10.10.10.10/32; } } rule-set Trust_to_Untrust { from zone trust; to zone untrust; rule rule1 { match { source-address-name 123; <<<<<<<<<< destination-address-name anyv4; } then { source-nat { pool { first; } } } } } root@abc# commit check [edit security nat source rule-set Trust_to_Untrust rule rule1 match] 'source-address-name 123' Address/address-set(123) isn't supported in NAT rule error: configuration check-out failed
Per https://www.juniper.net/documentation/us/en/software/junos/release-notes/22.2/junos-release-notes-22.2r1/topics/new-features/feature-descriptions/nat-7.html, 22.2R1+ has introduced support for this feature where DNS names can be used as part of the nat rules:
e.g.
root@SRX# show security address-book global { address 123 { dns-name 123.com { ipv4-only; # need "ipv4-only" option to enable using dns-name in nat rules } } root@SRX# show security nat source { pool first { address { 10.10.10.10/32; } } rule-set Trust_to_Untrust { from zone trust; to zone untrust; rule rule1 { match { source-address-name 123; } then { source-nat { pool { first; } } } } } } root@SRX# commit check configuration check succeeds
2013-06-11: Article created2024-06-03: Article amended to include now support for using DNS names within your nat rules2024-10-17: Updated "ipv4-only" option