Description

This article links a commit error to the technical documentation.
 

Symptoms

Configuring dns-name in the global address book and then calling in the NAT rule does not commit on the SRX:

root@abc# commit check
[edit security nat source rule-set Trust_to_Untrust rule rule1 match]
'source-address-name 123'
Address/address-set(123) isn't supported in NAT rule
error: configuration check-out failed

Solution

 Before 22.2R1, the following configuration is not supported on the SRX:
 

[edit]
root@abc# show security address-book
global {
     address 123 {
         dns-name 123.com; <<<<<<<<<<
     }
     address anyv4 0.0.0.0/0;
     address 12345 1.2.3.4/32;
}


root@abc# show security nat source
pool first {
     address {
         10.10.10.10/32;
     }
}

rule-set Trust_to_Untrust {
     from zone trust;
     to zone untrust;
     rule rule1 {
          match {
             source-address-name 123; <<<<<<<<<<
             destination-address-name anyv4;
          }
         then {
             source-nat {
                 pool {
                     first;
                 }
             }
         }
    }
}
                                                                                    
root@abc# commit check
[edit security nat source rule-set Trust_to_Untrust rule rule1 match]
'source-address-name 123'
Address/address-set(123) isn't supported in NAT rule
error: configuration check-out failed



Per https://www.juniper.net/documentation/us/en/software/junos/release-notes/22.2/junos-release-notes-22.2r1/topics/new-features/feature-descriptions/nat-7.html, 22.2R1+ has introduced support for this feature where DNS names can be used as part of the nat rules:

e.g.

root@SRX# show security address-book 
global {
    address 123 {
        dns-name 123.com {
          ipv4-only; # need "ipv4-only" option to enable using dns-name in nat rules         }     } root@SRX# show security nat  source {     pool first {         address {             10.10.10.10/32;         }     }     rule-set Trust_to_Untrust {         from zone trust;         to zone untrust;         rule rule1 {             match {                 source-address-name 123;             }             then {                 source-nat {                     pool {                         first;                     }                 }             }         }     } } root@SRX# commit check  configuration check succeeds

 

Modification History

2013-06-11: Article created
2024-06-03: Article amended to include now support for using DNS names within your nat rules
2024-10-17: Updated "ipv4-only" option