unsupported address types for NAT(Network Address Translation)

Certain address types are not supported in NAT configurations. The system would report configuration check failures when trying to commit the changes with the unsupported address-books/address-sets are included in NAT

The following address types are NOT supported in NAT configurations:

• Range-address
  • [edit security nat source rule-set src-nat]
    root@jtac-srx5400-r2005# commit check 
    [edit security nat source rule-set src-nat rule test-range match]
      'source-address-name test-range'
        Address/address-set(test-range) isn't supported in NAT rule
    error: configuration check-out failed
• DNS names
  • [edit security nat source rule-set src-nat]
    root@jtac-srx5400-r2005# commit check 
    [edit security nat source rule-set src-nat rule test-dns match]
      'source-address-name test-dns'
        Address/address-set(test-dns) isn't supported in NAT rule
    error: configuration check-out failed
• A combination of IPv4 and IPv6 addresses
  • [edit security nat source rule-set src-nat]
    root@jtac-srx5400-r2005# commit check 
    [edit security nat source rule-set src-nat rule test-combine match]
      'source-address-name test-combine46'
        Mixed IPv4 and IPv6 address/address-set(test-combine46) is not supported in NAT
    error: configuration check-out failed
• Wildcard addresses 
  • [edit security nat source rule-set src-nat]
    root@jtac-srx5400-r2005# commit check 
    [edit security nat source rule-set src-nat rule test-wildcard match]
      'source-address-name test-wild'
        Address/address-set(test-wild) isn't supported in NAT rule
    error: configuration check-out failed

When a set of addresses is needed for NAT, ip-prefix based address-books/address-sets should be used instead. 

[edit security nat source rule-set src-nat]
root@jtac-srx5400-r2005# show 
from interface fxp0.0;
to interface fxp0.0;
rule test-ip-prefix {
    match {
        source-address-name test-ip-prefix;
    }
    then {
        source-nat {
            interface;
        }
    }
}

[edit security nat source rule-set src-nat]
root@jtac-srx5400-r2005# commit check 
configuration check succeeds
 

Please refer to the guide below for more details: 

> Using Addresses and Address Sets in NAT Configuration
https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/topic-map/security-address-books-sets.html#concept_qgl_dkw_byb
Address Books and Address Sets | Junos OS | Juniper Networks

Please refer to below tech docs for newly introduced support for DNS names in NAT configuration:

• Network Address Translation (NAT)
• [SRX] DNS name is not a supported address or address-set type in NAT rules