Description

This article explains how the same NAT rule name/number cannot be used in different NAT rule sets and commit fails with error.

 

[edit]

 

labroot@device# set security nat static rule-set static-rule rule 2133 match destination-address 192.168.74.227/32

 

 

[edit]

 

labroot@device# set security nat static rule-set static-rule rule 2133 then static-nat prefix 10.61.139.21/32

 

 

[edit]

 

labroot@device# commit check

 

configuration check succeeds

 

 

[edit]

 

labroot@device# set security nat static rule-set static-test_PRD rule 2133 match destination-address 10.16.208.173/32

 

 

[edit]

 

labroot@device# set security nat static rule-set static-test_PRD rule 2133 then static-nat prefix 10.249.242.17/32

 

 

 

[edit]

 

labroot@device# commit check

 

error: rule (2133) name check fail.

 

error: configuration check-out failed

 

Symptoms

The following error is seen:

 

labroot@device# commit check

error: rule (2133) name check fail.

error: configuration check-out failed

 

Solution

We encountered the error due to the overlapping rule numbers/name between two rule sets "static-test_PRD" and "static-rule.”

 

In the configuration, the rule-set "static-test_PRD" has the same rule number (2133) for two NAT statements, causing the error.

(rule 2133)

 

Rule Name Conflict: Ensure that there are no conflicting rule numbers or overlapping rule configurations in the rule-set. Each rule should have a unique rule number.

 

Modification History

2024-02-12 : Article Created