Static NAT in SRX

Today’s post is about static NAT configuration in SRX firewall. I have the following topology and aim is to translate IP network to and vice versa.

JGW1 SRX has in its uplink zone facing interface and in trust zone facing interface
and the static nat configuration for this setup is as follows;

What this configuration really mean is:

  • Match the traffic arriving at uplink zone
  • If destination address is within subnet
  • Then replace destination IP address with one of the address within subnet

but with which address to replace? static NAT requires an exact match if you destination address has 28 bit, your static-nat prefix should also be 28 bit and replacement is done as follows; -> ->

I think no need to write the rest. It is one by one. The good thing about static nat is reverse static nat is also done automatically for you which means; -> ->

If any packet leaving SRX with IP address is replaced by

In addition to this we shouldn’t forget security policy configuration of course;

*ubuntu-net is an address-book entry in the associated zone

If you have configured so far, you will see that ubuntu3 host still cannot reach outside network why? the thing is SRX doesn’t reply to arp requests for range. We must tell it to do so specifically by configuring proxy-arp as follows;

*ge-0/0/0.0 is the uplink zone facing interface

Once you configure proxy arp, your ubuntu should be able to reach out.

You will see that IP is replaced by What does this mean? This means if you set up the reverse security policies any traffic destined to will be forwarded to automatically.

One thing that you should keep in mind is that there is no port translation in this type of NAT because of which you have relatively limited space.

Below is also my show command output;

If there is any point not clear for you, please send your comment!

6 thoughts on “Static NAT in SRX

  1. tk

    The network in the trust zone is from to

    ubuntu3, what gateway is using ?

  2. Andy

    Traffic from zone uplink has source-address, not destination-address Why in config you wrote desitnation-address? I am missing something? Thanks.


You have a feedback?