Junos NAT Configuration (Source, Destination, Static). This matters because every network connecting to the internet uses NAT to map private internal addresses to public ones, and passing the JNCIA-JUNOS exam requires you to know exactly when to use each type. Without NAT, a company with hundreds of devices would need hundreds of public IP addresses, which is expensive and wasteful.
Jump to a section
A simple way to picture Junos NAT Configuration (Source, Destination, Static)
Have you ever lived in an apartment building that had a strict visitor parking policy?
You live in Apartment 3B, and your cousin is coming over for dinner in his bright blue van. He arrives at the main gate, but the security guard stops him because only residents with a special sticker (their private IP address) can enter the main parking lot (the internet). Your cousin’s van has a regular license plate (a public IP address), but that plate isn't recognised by the parking system. The guard calls you on the intercom. You say, 'Let him in, he's here to see me.' The guard writes down your apartment number (3B) and your cousin’s plate number on a clipboard. He gives your cousin a temporary paper pass that says 'Visitor – Apartment 3B' and lets him park in a special spot (the internal network). This is exactly Source NAT (also called NAT for outgoing traffic). You are translating your cousin's 'public' license plate into a 'private' pass that works inside your apartment's system, and recording everything so that when he leaves, the guard knows to let him out (so the return traffic goes back through the gate).
Now imagine you order a pizza for delivery. The pizza guy has your address (your public IP), but the apartment complex has a new rule: all deliveries must go to the main office first (the router), then be handed to the correct apartment. The pizza guy arrives at the main gate. The guard (the router) checks your name on a list. He sees: 'Pizza for 3B, put in Box 42.' He takes the pizza and puts it in a numbered locker (the private IP address of your laptop) and buzzes you. This is Destination NAT (or port forwarding, for incoming traffic). The pizza (data) was addressed to the building's main address (public IP), but the guard (NAT rule) redirected it specifically to your apartment's small locker (private IP).
Finally, imagine you move out, but you want the pizza guy to always deliver to your new flat 5C. You tell the guard: 'From now on, any pizza addressed to 3B should go directly to 5C.' The guard updates his list with a permanent translation rule. This is Static NAT—a one-to-one permanent mapping between a public address (3B) and a private address (5C). No visitor passes, no temporary logbooks—just a fixed, unchanging forwarding rule.
NAT stands for Network Address Translation. It is a method used by routers to rewrite the source or destination IP address of a packet as it passes through the router. Think of it as the router acting like a multilingual secretary who rewrites the 'from' and 'to' lines on envelopes before sending them through different postal systems.
We need to understand three key terms: Private IP address, Public IP address, and the NAT rule itself. A Private IP address is like an employee's internal extension number inside a company—it only works inside the building. A Public IP address is like the company's main phone number that the outside world can call. The NAT rule is the instruction that tells the router when and how to swap those numbers.
Source NAT (also called 'source NAT' or 'outbound NAT') happens when traffic leaves a private network and goes to the internet. For example, a laptop with private IP 192.168.1.10 wants to visit a website. The router's interface that connects to the internet has a public IP, say 203.0.113.5. The router rewrites the 'from' address from 192.168.1.10 to 203.0.113.5. When the website replies, it sends the response to 203.0.113.5. The router then looks up its internal state table (a memory of who asked for what) and rewrites the destination back to 192.168.1.10. Source NAT is essential because private IPs are not routable on the public internet—they would be discarded by any internet router.
Destination NAT (also called 'inbound NAT' or 'port forwarding') does the opposite. It translates the destination address of incoming packets. Imagine you run a web server on a device inside your private network with IP 192.168.1.50. The internet knows your public IP 203.0.113.5. When someone types that public IP into their browser, the router receives the packet with destination 203.0.113.5. A Destination NAT rule instructs the router: 'If a packet arrives destined for 203.0.113.5 on port 80, rewrite the destination IP to 192.168.1.50'. The packet is then forwarded to your web server. Without Destination NAT, external users could never reach a server inside a private network.
Static NAT is a permanent, one-to-one mapping between a private IP and a public IP. Unlike Source NAT (which uses a pool of public IPs and is temporary) or Destination NAT (which can map one public IP to multiple private IPs on different ports), Static NAT always translates the same private address to the same public address. This is used when a server inside the network must always be reachable from the outside using the same public IP. For example, a mail server with private IP 10.0.0.5 is mapped statically to public IP 203.0.113.10. Every packet to 203.0.113.10 goes to 10.0.0.5, and every packet from 10.0.0.5 to the internet appears as 203.0.113.10.
On a Juniper Junos device, NAT is configured using 'security policies' and 'NAT rules' within the 'security' hierarchy. The configuration typically involves defining a 'source NAT rule set', a 'destination NAT rule set', or a 'static NAT rule set'. Each rule set contains rules that specify the 'from' and 'to' zones, the 'source/destination addresses', and the 'translation' (what IP to translate to). You also need a security policy that allows the traffic to flow.
For instance, to configure Source NAT for traffic from the 'trust' zone (internal network) to the 'untrust' zone (internet), you create a source NAT rule set. It will include a rule like: match source address 192.168.1.0/24, destination address 0.0.0.0/0 (any), and then 'then source-nat interface' (meaning use the IP of the outgoing interface as the translated address). For Static NAT, you configure something like: match destination address 203.0.113.10, then static-nat inet to 10.0.0.5.
Why does a network need NAT at all? The main reason is IPv4 address exhaustion. There are only about 4.3 billion IPv4 addresses, far fewer than the number of devices online. NAT allows thousands of devices to share a single public IP address. It also provides a basic layer of security because private IPs are hidden from the internet, making it harder for attackers to connect directly to internal devices.
Identify the Traffic Direction and Type
Determine whether the traffic is outbound (internal to internet), inbound (internet to internal), or requires a permanent one-to-one mapping. This decides if you need Source NAT, Destination NAT, or Static NAT.
Define the NAT Rule Set
Create a rule set under 'security nat source', 'security nat destination', or 'security nat static'. The rule set groups related rules and specifies the from/to zones where the translation applies.
Match the Traffic with Conditions
Inside the rule, specify match conditions such as source address, destination address, or destination port. For Source NAT, you typically match the internal subnet. For Destination NAT, match the public IP and port.
Configure the Translation Action
Set the 'then' action: 'source-nat interface' (use outgoing interface IP) or 'source-nat pool' (use a defined pool of IPs) for Source NAT. For Destination NAT, use 'destination-nat inet to <private IP> port <port>'. For Static NAT, use 'static-nat inet to <private IP>'.
Create a Corresponding Security Policy
Define a security policy in 'security policies from-zone <source> to-zone <destination>' that permits the traffic matched by the NAT rule. Without this, the translated packet will be dropped by the firewall.
Commit and Verify the Configuration
Run 'commit' on the Junos device. Then use show commands like 'show security nat source', 'show security nat static', and 'show security flow session' to confirm that translations are being created and traffic flows as expected.
Imagine you are a junior network administrator at a small marketing agency with 50 employees. The company has a public IP from the ISP: 198.51.100.1. Internally, all employee laptops are on a private subnet 10.0.1.0/24. Your boss wants everyone to be able to browse the web and send emails. You need to implement Source NAT.
Here is the step-by-step process you would follow in a real office:
First, you log in to the Juniper SRX firewall (the company's router) via SSH or the console. You check the current interfaces: ge-0/0/0 is connected to the internal switch (trust zone, IP 10.0.1.1), and ge-0/0/1 is connected to the ISP modem (untrust zone, IP 198.51.100.1).
Second, you configure a source NAT rule set. You create a rule named 'outbound-internet'. You set the 'from' zone as trust and the 'to' zone as untrust. The match condition is source address 10.0.1.0/24. The action is 'then source-nat interface' – this tells the SRX to use the IP 198.51.100.1 as the translated source for all outbound packets.
Third, you must also create a security policy that permits traffic from trust to untrust for web and email services (typically TCP ports 80, 443, 25, 587). Without the security policy, the NAT rule will translate the IP, but the packet will be dropped by the firewall anyway.
Fourth, you commit the configuration. You test by having an employee ping google.com from their laptop. On the SRX, you run 'show security nat source rule' and 'show security flow session' to verify that the source IP is being translated correctly.
Now, the agency also hosts a public-facing web server for client portfolios. The server is internal with IP 10.0.1.100. External visitors must reach it by typing the company's public IP. So you configure Destination NAT. - Fifth, you create a destination NAT rule set. The rule is named 'web-server-inbound'. From zone: untrust. To zone: trust. Match destination address 198.51.100.1, destination port 80. Then 'then destination-nat inet to 10.0.1.100 port 80'. - Sixth, you add a security policy that allows inbound HTTP traffic from untrust to trust. You also configure a 'proxy arp' so the SRX responds to ARP requests for the public IP on its internal interface—this is critical because the internal server might think the destination is the router itself. - Seventh, you test by opening a browser from a mobile phone using 4G and typing http://198.51.100.1. You should see the agency's portfolio page.
Finally, the boss wants a permanent, fixed mapping for the company's email server (private IP 10.0.1.50) so that it always has the same external identity for sending and receiving mail. You configure Static NAT: 'set security nat static rule-set email-server from zone untrust rule email-server-match match destination-address 198.51.100.5/32' and then 'then static-nat inet to 10.0.1.50'. You also configure a security policy to allow SMTP traffic (port 25) to the static NAT rule. After commit, you verify with 'show security nat static rule'. The email server now functions as if it had a static public IP.
In everyday practice, you will frequently use 'show security nat source/pool detail' and 'show security flow session' to troubleshoot. Common errors include forgetting to set the 'from' and 'to' zones correctly, or not configuring the security policy, which is a separate step. A real IT professional also documents each NAT rule with a purpose (e.g. 'HR application server') so that when troubleshooting later, they know why it exists.
The JNCIA-JUNOS exam (exam code JN0-104) tests NAT configuration under section 5.2. Expect multiple-choice questions that give you a scenario and ask which type of NAT to use, or how to verify a NAT configuration. There are no hands-on labs, but you must understand the conceptual differences and the Junos CLI syntax.
Key areas the exam loves to test:
Distinguishing between Source, Destination, and Static NAT: They will give a scenario like 'A company wants to allow internal users to access the internet using a single public IP.' The correct answer is Source NAT. Another scenario: 'An external user needs to reach a web server inside the private network.' Correct answer: Destination NAT. A third: 'A mail server needs a permanent one-to-one public IP mapping.' Correct answer: Static NAT.
Understanding the difference between 'source NAT pool' and 'interface NAT': In Junos, you can do 'source-nat interface' (uses the IP of the outgoing interface) or 'source-nat pool' (uses a specific range of public IPs). The exam may ask which is used when you need to preserve the original source port for logging.
The role of the 'from zone' and 'to zone' in NAT rules: A common question shows a configuration snippet with zones incorrectly set and asks you to identify the error. Remember: Source NAT usually has from trust (internal) to untrust (internet). Destination NAT has from untrust to trust.
The concept of 'proxy ARP': When you configure Static NAT, Junos automatically sends proxy ARP for the public IP on the internal interface. The exam may ask what proxy ARP does—it makes the router respond to ARP queries on behalf of the translated public IP so that the traffic can reach the internal host.
The difference between 'static NAT' and 'destination NAT with port forwarding': Static NAT translates all ports, while Destination NAT is often used for specific ports. The exam may present ambiguous scenarios and you must choose the more specific answer.
Verification commands: Know 'show security nat source', 'show security nat static', 'show security nat destination', 'show security flow session'. One typical trap question: 'Which command shows active NAT translations?' The correct answer is 'show security flow session' or 'show security nat ... detail' depending on the context.
Common traps:
'Static NAT is only for servers.' Actually, it can be used for any device requiring a fixed mapping.
'You do not need a security policy if you have a NAT rule.' Wrong. NAT translates addresses, but the firewall filter (security policy) still controls whether the packet is allowed through.
'Destination NAT is the same as port forwarding.' In Junos, Destination NAT is a broader concept that includes port-based translations, but the exam may treat them as the same. Learn the distinction.
'Source NAT changes the destination address.' No, Source NAT changes the source address.
Questions often include CLI output. For example, they show 'show security nat source rule outbound' output and ask what the translated IP will be. You must recognise that if 'then source-nat interface' is configured, the translated IP is the IP of the outgoing interface. Also, they love to test that Static NAT rules appear under 'security nat static' not 'security nat source'.
Finally, memorise this pattern: Source NAT = hide private IPs when going out. Destination NAT = expose a service to the outside. Static NAT = permanent one-to-one mapping for a specific device.
Source NAT rewrites the source IP of outbound packets so private IPs can reach the internet using a public IP.
Destination NAT rewrites the destination IP of inbound packets to allow external users to access internal servers.
Static NAT creates a permanent one-to-one mapping between a private IP and a public IP for all protocols and ports.
A NAT rule alone does not permit traffic; you must also configure an accompanying security policy that allows the traffic flow.
Use 'show security nat source' or 'show security nat static' in operational mode to verify NAT translations are active.
The 'from zone' and 'to zone' in a NAT rule must align with the direction of the traffic intended to be translated.
Proxy ARP is automatically enabled for Static NAT so the router can respond to ARP requests for the translated public IP.
These come up on the exam all the time. Here's how to tell them apart.
Source NAT
Translates the source IP of outbound packets.
Used for internal devices accessing the internet.
The router rewrites the 'from' address to its own public IP.
Destination NAT
Translates the destination IP of inbound packets.
Used for external users accessing internal servers.
The router rewrites the 'to' address from public to private IP.
Static NAT
Creates a permanent one-to-one mapping for all ports.
Bidirectional: traffic can originate from either side.
Automatically handles proxy ARP for the public IP.
Destination NAT (Port Forwarding)
Typically translates for a specific port or service only.
Usually unidirectional (only for incoming connections).
Proxy ARP may need manual configuration in some cases.
Source NAT with Interface
Uses the IP of the outgoing interface as the translated address.
Simplest configuration; only one IP is used.
Relies on Port Address Translation (PAT) to handle many sessions.
Source NAT with Pool
Uses a defined range of public IP addresses from a pool.
Useful when you need to preserve a whole range of IPs for logging.
Each internal session may get a different public IP from the pool.
NAT Rule
Handles address translation only.
Configured under 'security nat' hierarchy.
Does not allow or block traffic by itself.
Security Policy
Controls which traffic is permitted or denied through the firewall.
Configured under 'security policies' hierarchy.
Requires the correct from/to zones and action (permit/deny).
Mistake
I need a separate public IP for every device on my network, and NAT is optional.
Correct
NAT is mandatory for IPv4 because private IPs are not routable on the internet. One public IP can serve thousands of devices using Source NAT with port number translation (PAT).
People often think of IPs like phone numbers—one per device. In reality, private ranges (like 10.x.x.x) are reserved and cannot be used on the internet, so NAT is the only way to let them out.
Mistake
Destination NAT and Static NAT are exactly the same thing.
Correct
Destination NAT translates only the destination IP (and often for a specific port), and the translation is usually temporary or session-based. Static NAT is a permanent one-to-one translation of both source and destination for all traffic to and from that IP.
Both involve incoming traffic and change the destination, so beginners conflate them. The key difference is Static NAT is bidirectional and permanent, while Destination NAT is typically unidirectional and port-specific.
Mistake
If I configure a NAT rule, the traffic automatically passes through the firewall.
Correct
A NAT rule only translates addresses. The security policy (firewall filter) is a separate configuration that must also permit the traffic. Without the correct security policy, the packet is dropped after NAT translation.
In many consumer routers, NAT and firewall are bundled together. Junos separates the functions, so beginners forget the security policy step.
Mistake
Source NAT is only used for hiding IPs for security, not for address conservation.
Correct
The primary original reason for Source NAT was to conserve public IPv4 addresses. Security (hiding internal IPs) is a side benefit, not the primary design goal.
Home routers often promote NAT as a 'security feature', but the real driver was IPv4 exhaustion. Misunderstanding the historical purpose leads to confusion about why NAT is so universally used.
Mistake
When I use 'source-nat interface', the translated source IP is always the same for all connections.
Correct
Yes, it is the same IP (the interface IP), but the source port is randomised. The Junos device creates a unique session entry using the IP+port combination. The source IP itself is constant.
People hear 'same IP' and think IP only. They overlook the port mapping, which is critical for distinguishing multiple simultaneous sessions from different internal hosts.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Source NAT without PAT (Port Address Translation) uses a pool of public IPs without changing the source port. Source NAT with PAT (the default on Junos when using 'source-nat interface') also changes the source port to a unique number, allowing many internal hosts to share a single public IP simultaneously.
Not manually for Static NAT (Junos does it automatically). For Destination NAT (inbound port forwarding), you may need to configure proxy ARP manually if the destination IP is not directly configured on the Junos interface, or the internal server might not respond correctly. Check the exam specifics—generally, Static NAT handles ARP automatically.
Yes, you can. A single public IP can be used for Source NAT (outbound traffic) and also for Destination NAT (inbound service) on different ports. For example, port 80 can be forwarded to an internal web server, while all other ports are used for outbound Source NAT sessions.
The rule will not match any traffic, because Junos requires a from/to zone to determine which interface the traffic arrives on. Always set the from zone (source) and to zone (destination) correctly for each NAT rule.
Use the operational command 'show security nat source rule <rule-name>' to see if the rule is configured, and 'show security flow session' to view active translated sessions. You can also ping from inside to an external address and run 'monitor traffic interface ge-0/0/1' to see if the source IP is rewritten.
No. NAT translates IP addresses. A firewall (security policy) controls whether traffic is allowed to pass. On Junos, you need both a NAT rule and a security policy for traffic to successfully flow through the device.
You've finished Junos NAT Configuration (Source, Destination, Static). Continue through the JNCIA-JUNOS study guide to build a complete picture of the exam.
Done with this chapter?