There is an existing source NAT policy with a NAT pool however the pool is getting over-utilized and exhausted soon.

The plan is to add an additional IP address from a different subnet than the one already present in the NAT pool.

For example, when an internal host reaches out to the internet, the source IP address needs to be translated to both the subnets present in the NAT pool

To summarize the requirement:

When a host 10.10.10.10 tries to access the internet it should be translated using the existing NAT pool 1.1.1.10 as well as the new NAT pool 2.1.1.2

Existing configuration

set security nat source pool pool_1 address 1.1.1.10/32

set security nat source rule-set SR_SET_1 from zone trust

set security nat source rule-set SR_SET_1 to zone untrust

set security nat source rule-set SR_SET_1 rule rule1 match source-address 10.10.10.0/24

set security nat source rule-set SR_SET_1 rule rule1 match destination-address 0.0.0.0/0

set security nat source rule-set SR_SET_1 rule rule1 then source-nat pool pool_1

set security nat proxy-arp interface ge-0/0/0.0 address 1.1.1.10/32

set security policies from-zone trust to-zone untrust policy internet-access match source-address any

set security policies from-zone trust to-zone untrust policy internet-access match destination-address any

set security policies from-zone trust to-zone untrust policy internet-access match application any

set security policies from-zone trust to-zone untrust policy internet-access then permit

Add the new subnet to the existing NAT pool

set security nat source pool pool_1 address 2.1.1.2/32

root@SRX1# run show security nat source pool all

Total pools: 1

Pool name         : pool_1

Pool id           : 4

Routing instance  : default

Host address base : 0.0.0.0

Port              : [1024, 63487]

Twin port         : [63488, 65535]

Port overloading  : 1

Address assignment : no-paired

Total addresses   : 2

Translation hits  : 0

Address range                       Single Ports  Twin Ports

           1.1.1.10 - 1.1.1.10            0             0      

           2.1.1.2 - 2.1.1.2            0             0      

When traffic starts to hit this NAT pool, it will be translated to both the address range in a round-robin order.

root@SRX1> show security flow session destination-prefix 10.10.10.10

Total sessions: 0

root@SRX1> show security flow session source-prefix 10.10.10.10

Session ID: 280, Policy name: default-permit/5, Timeout: 28, Session State: Valid

 In: 10.10.10.10/17 --> 10.10.20.20/0;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 100,

 Out: 10.10.20.20/0 --> 1.1.1.10/8291;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 0, Bytes: 0,

Session ID: 281, Policy name: default-permit/5, Timeout: 30, Session State: Valid

 In: 10.10.10.10/17 --> 10.10.20.20/1;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 100,

 Out: 10.10.20.20/1 --> 2.1.1.2/23335;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 0, Bytes: 0,

Session ID: 282, Policy name: default-permit/5, Timeout: 32, Session State: Valid

 In: 10.10.10.10/17 --> 10.10.20.20/2;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 100,

 Out: 10.10.20.20/2 --> 1.1.1.10/17601;icmp, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 0, Bytes: 0,