Description

Trying to configure Destination NAT only using the interface IP of the firewall.
When the traffic hits the firewall, it needs to translate the destination IP to two internal servers.

For example, IP addresses 192.168.0.1 needs to be NATed to the internal IP address 10.10.10.2 and 10.20.10.2

To summarize the requirement:
When accessing 192.168.0.1
Change the destination IP to 10.10.10.2 and 10.20.10.2 

Symptoms

root# show security nat
pool to-loopback {
    address 10.10.10.2 /32;
}
rule-set D-NAT-lo {
    from zone WAN;
    rule D-NAT-lo {
        match {
            destination-address 192.168.0.1/32;
        }
        then {
            destination-nat {
                pool {
                    to-loopback;
                }
            }
        }
    }
}

root# set security nat destination pool to-loopback address 10.20.10.2/32

[edit security nat destination pool to-loopback]
-      address 10.10.10.2/32;
+      address 10.20.10.2/32;

Destination NAT pool with one IP address is working fine without any issues.

Unable to add a noncontiguous IP address to the existing nat pool.

Solution

This is expected, in destination NAT pool, we can either have an IP address or an address range.

The entries in NAT pool cannot be a noncontiguous IP address as it will override one another.

The solution loadbalance between the two servers is to change their IP addresses so that they are contiguous.

Modification History

2024-01-04 : Article Created