This article explains how modifying NAT rule configurations can cause related traffic sessions to be cleared and provides a solution to prevent session clearing when making NAT rule configuration changes.

Please refer to below Session Behavior on NAT Rule Modifications:

Initial Existing Sessions

[edit]
root@SRX# run show security flow session destination-prefix 172.45.67.89 destination-port 8080  
Session ID: 49238562107, Policy name: test_policy/2, HA State: Stand-alone, Timeout: 1520, Valid
 In: 10.1.5.21/64532 --> 172.45.67.89/8080;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 47, Bytes: 4021,
 Out: 172.45.67.89/8080 --> 10.1.5.21/64532;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 44, Bytes: 5129,
Total sessions: 1

Change Made to Source NAT Rule (Deleting an Address Name)

set security nat source rule-set RS1 rule R1 match source-address-name PC1
set security nat source rule-set RS1 rule R1 match source-address-name PC3
set security nat source rule-set RS1 rule R1 match destination-address-name REMOTE_SERVER
set security nat source rule-set RS1 rule R1 then source-nat off

root@SRX# delete security nat source rule-set RS1 rule R1 match source-address-name PC3

Configuration Comparison After Change

[edit]
root@SRX# show | compare
[edit security nat source rule-set RS1 rule R1 match]
-  source-address-name [ PC1 PC3 ];
+  source-address-name PC1;

Session Cleared (10.1.5.21 Removed)

root@SRX# run show security flow session destination-prefix 172.45.67.89 destination-port 8080         
Total sessions: 0

Additional Test: Modifying the Address Book

NAT Rule Before Change

set security nat source rule-set RS1 rule R1 match source-address-name HOSTS_GROUP
set security nat source rule-set RS1 rule R1 match destination-address-name REMOTE_SERVER
set security nat source rule-set RS1 rule R1 then source-nat off

Existing Sessions

[edit]
root@SRX# run show security flow session destination-prefix 172.45.67.89 destination-port 8080  
Session ID: 49238562490, Policy name: test_policy/2, HA State: Stand-alone, Timeout: 1412, Valid
 In: 10.1.5.22/50211 --> 172.45.67.89/8080;tcp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 40, Bytes: 3687,
 Out: 172.45.67.89/8080 --> 10.1.5.22/50211;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 37, Bytes: 4511,
Total sessions: 1

Address Book Modification (Adding a Subnet)

root@SRX# show | compare
[edit security address-book global address-set HOSTS_GROUP]
  address PC1 { ... }
+  address PC3;

Session Cleared (10.1.5.22 Removed)

root@SRX# run show security flow session destination-prefix 172.45.67.89 destination-port 8080  
Total sessions: 0

Changing the NAT configuration in Junos triggers session clearance, which is expected behavior from Day 1. This design applies to all Junos versions and SRX devices. For more details, refer to PR-1441239.

From Junos version 18.3R1 onward, enhancements have been introduced to improve NAT session persistence. Two CLI knobs have been added:

set security nat source session-persistence-scan
set security nat source session-drop-hold-down <time>

Enabling these options triggers a session scan following a NAT configuration change, allowing sessions to be retained under specific conditions:

Source NAT Pool Session Persistence Scan:

- The system retrieves the translated IP from the session and verifies whether it falls within the address range of the new configuration.

- If the translated IP remains within the new range, the session is retained; otherwise, it is cleared.

Source NAT Rule Session Persistence Scan:

- The system retrieves details of the old rule (such as rule ID, source IP/port, protocol, and destination IP/port) from the session.

- It then searches for the new NAT rule configuration using the rule ID.

- The system compares the old and new rule parameters to check for a match.

- If the session matches the new rule, it is retained; otherwise, it is cleared.

Session Hold-Down Time

If a persistence scan determines that a session should be cleared, the session hold-down timer is activated. This temporarily holds the session for a configured duration before ultimately clearing it once the hold-down period expires.

Limitations

- NAT session persistence scanning is not supported for Static NAT and Destination NAT.

- NAT session persistence scanning is not supported if the PAT pool is configured with any of the following options: address persistent, address pooling paired, source address-persistent, port block allocation, port deterministic, persistent nat or port overloading factor.

For further details, refer to the documentation: Understanding NAT Session Persistence