Description

We have enabled the NAT on the Juniper MS interface, we can see the NAT translations on the Juniper, but when we capture the application traffic on the connected device we do not see any traffic on the translated IP.

Symptoms

Current configuration:

 

 

set services nat pool HANON_HPLM_nat-pool address 10.81.252.2/32

set services nat pool HANON_HPLM_nat-pool port automatic random-allocation

 

set services nat rule HANON_HPLM_nat-rule match-direction input

set services nat rule HANON_HPLM_nat-rule term term1 from source-prefix-list HANON_HPLM_Cache_Servers

set services nat rule HANON_HPLM_nat-rule term term1 from destination-prefix-list HANON_HPLM_KOREA_Subnets

set services nat rule HANON_HPLM_nat-rule term term1 then translated source-pool HANON_HPLM_nat-pool

set services nat rule HANON_HPLM_nat-rule term term1 then translated translation-type napt-44

set services nat rule HANON_HPLM_nat-rule term term1 then translated address-pooling paired

 

set services stateful-firewall rule HANON_HPLM_sf-rule match-direction input-output

set services stateful-firewall rule HANON_HPLM_sf-rule term term1 from source-prefix-list HANON_HPLM_Cache_Servers

set services stateful-firewall rule HANON_HPLM_sf-rule term term1 then accept

 

set services service-set HANON_HPLM_NAT_set stateful-firewall-rules HANON_HPLM_sf-rule

set services service-set HANON_HPLM_NAT_set nat-rules HANON_HPLM_nat-rule

set services service-set HANON_HPLM_NAT_set interface-service service-interface ms-0/2/0.7208

set services service-set HANON_HPLM_NAT_set apply-groups-except IPSEC

As you can see below we are not getting any output traffic for the session.

 

 

Solution

CGNAT has a limitation that does not allow for the nat pool and physical ethernet to have the same address configured.

The link below provides details about this limitation.
https://www.juniper.net/documentation/us/en/software/junos/interfaces-adaptive-services/topics/topic-map/nat-config-overview.html

Configuring the NAT pool with a different IP address within the same subnet will resolve the issue. Or you can use a different subnet for the IP nat pool.

set services nat pool HANON_HPLM_nat-pool address 10.81.252.5/32

 

 

If it is a different subnet, it must be routable within your network.
 

Modification History

2024-07-24 : Article Created