Trying to configure Destination NAT only using the interface IP of the firewall.When the traffic hits the firewall, it needs to translate the destination IP to two internal servers.For example, IP addresses 192.168.0.1 needs to be NATed to the internal IP address 10.10.10.2 and 10.20.10.2To summarize the requirement:When accessing 192.168.0.1Change the destination IP to 10.10.10.2 and 10.20.10.2
root# show security natpool to-loopback { address 10.10.10.2 /32;}rule-set D-NAT-lo { from zone WAN; rule D-NAT-lo { match { destination-address 192.168.0.1/32; } then { destination-nat { pool { to-loopback; } } } }}root# set security nat destination pool to-loopback address 10.20.10.2/32[edit security nat destination pool to-loopback]- address 10.10.10.2/32;+ address 10.20.10.2/32;Destination NAT pool with one IP address is working fine without any issues.Unable to add a noncontiguous IP address to the existing nat pool.
This is expected, in destination NAT pool, we can either have an IP address or an address range.The entries in NAT pool cannot be a noncontiguous IP address as it will override one another.The solution loadbalance between the two servers is to change their IP addresses so that they are contiguous.