SRX

How can i do static source nat using the [edit security nat static ]  sub-config mode ?

I see that the only matching condition for static nat would be 'destination-address'  , and i understand that this rule is used for destination nat with connection initiated from outside (untrust ) zone.

further more , with a static destination nat , would i still be able to initiate traffic from inside although no traffic has yet been started from outside to create the reverse static source nat entry in the nat table ???

Thanks in advance , 

Hi

Static NAT is bidirectionaly means source and destination NAT. If you configure like, from untrust zone if traffic comes to a public IP then it should be translated to a private IP (Destination NAT). Then If traffic is initiated from the private IP address to go outside then it will automatically takes that public IP (Source NAT), just you have to make the properly firewall policy for that private IP address from Trust to Untrust.

HTH

Thanks for your reply.

what about source nat with address shifting ? i see it's also a one to one mapping of private/public ips ? would that be another solution ?

I belive there has been a confusion here ......

PLEASE check the attached snapshot i caught from Juniper JNCIS-SEC fast track program.

traffic initiated from the private ip address would not be automatically translated with a destination static nat rule , it's only for the return flow of a session ??

Hi

I believe if you configure the static nat, it is bidirectional.

Static is bidirectional as stated above.

It is a bit confusing but the context and using a destination address is different from the concept of destination-nat. There's more to it but think of destination-nat as a unidirectional static mapping, with a lot of extra policy based options for things like port-mapping etc. It's usually used for public services, or more generically what we'd think of as untrust->trust but that's not actually a limitation (or requirement), just where it's strengths tend to shine.

Hi

Just to make sure, the traffic from private IP takes which public IP address. From the private IP machine, initiate some traffic for internet like ping -t 4.2.2.2. Now on the firewall, run the below command to see which Public IP, this private IP is taking.

show security flow session source-prefix <Private IP>

HTH

Thank you guys 🙂