We have enabled the NAT on the Juniper MS interface, we can see the NAT translations on the Juniper, but when we capture the application traffic on the connected device we do not see any traffic on the translated IP.
Current configuration:
set services nat pool HANON_HPLM_nat-pool address 10.81.252.2/32
set services nat pool HANON_HPLM_nat-pool port automatic random-allocation
set services nat rule HANON_HPLM_nat-rule match-direction input
set services nat rule HANON_HPLM_nat-rule term term1 from source-prefix-list HANON_HPLM_Cache_Servers
set services nat rule HANON_HPLM_nat-rule term term1 from destination-prefix-list HANON_HPLM_KOREA_Subnets
set services nat rule HANON_HPLM_nat-rule term term1 then translated source-pool HANON_HPLM_nat-pool
set services nat rule HANON_HPLM_nat-rule term term1 then translated translation-type napt-44
set services nat rule HANON_HPLM_nat-rule term term1 then translated address-pooling paired
set services stateful-firewall rule HANON_HPLM_sf-rule match-direction input-output
set services stateful-firewall rule HANON_HPLM_sf-rule term term1 from source-prefix-list HANON_HPLM_Cache_Servers
set services stateful-firewall rule HANON_HPLM_sf-rule term term1 then accept
set services service-set HANON_HPLM_NAT_set stateful-firewall-rules HANON_HPLM_sf-rule
set services service-set HANON_HPLM_NAT_set nat-rules HANON_HPLM_nat-rule
set services service-set HANON_HPLM_NAT_set interface-service service-interface ms-0/2/0.7208
set services service-set HANON_HPLM_NAT_set apply-groups-except IPSEC
As you can see below we are not getting any output traffic for the session.
CGNAT has a limitation that does not allow for the nat pool and physical ethernet to have the same address configured.The link below provides details about this limitation.https://www.juniper.net/documentation/us/en/software/junos/interfaces-adaptive-services/topics/topic-map/nat-config-overview.htmlConfiguring the NAT pool with a different IP address within the same subnet will resolve the issue. Or you can use a different subnet for the IP nat pool.set services nat pool HANON_HPLM_nat-pool address 10.81.252.5/32
If it is a different subnet, it must be routable within your network.