SRX

I have an srx240b2. 11.47xxxx, I want to know if I can use source nat match destination 0.0.0.0/0 with the internet. I know I can use source nat match source 0.0.0.0/0. Match source is default. The first time I tried match destination 0.0.0.0/0 it dropped my internet and TV cable connection. No DS/US.

I guess the real question is.... Is, set security nat source rule-set xxx rule xxx match destination-address 0.0.0.0/0 really a pointer to the remote host/s ? If so is this for local or global addresses?

Same as in my response to your other question:

 https://forums.juniper.net/t5/SRX-Services-Gateway/Source-Nat-options/m-p/329354#M49964

 

rule to-any-destination {

        match {

            source-address 10.0.0.0/8;

        }

        then {

            source-nat {

                interface;

            }

        }

    }

 

Also

In NATconfigurations you can use ONLY IP addresses.

You can use IP address that you configured in global address book.

config will be:

set security address-book global address Example-destination 8.8.8.8/8

 

rule to-any-destination {

        match {

            source-address 10.0.0.0/8;

            destination-address-name Example-destination;

        }

        then {

            source-nat {

                interface;

            }

        }

    }

 

NAT rule will not accept DNS name from global address book.

 

 

Regards

 

Leon Smirnov

 

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too

 

I am inquiring about the actual address of 0.0.0.0/0 . Are there any comments on this? I am not intent on using 0.0.0.0/0 . Using my gateway pool might be better. Any comments? 192.168.1.0/32 or 24?

I'm not sure I follow the questions so forgive if this is also off target.

 

---

I am inquiring about the actual address of 0.0.0.0/0 . Are there any comments on this? I am not intent on using 0.0.0.0/0 . Using my gateway pool might be better. Any comments? 192.168.1.0/32 or 24?

---

the address 0.0.0.0/0 means any ip address for the statement where it is included.

So in your example above source nat match destination 0.0.0.0/0

Would be any destination ip address.

 

More typically the 0.0.0.0/0 would be in the match source-address 0.0.0.0/0 statement for any outbound source address.  But you can use the ip address match for either source or destination.  These are match criteria on which packets will be source address translated and NOT the address they are translated to.

 

The address that is used as the translation is either the pool address you create or the interface ip of the egress interface as specified in the rule.

 

set security nat source rule-set xxx rule xxx match destination-address 0.0.0.0/0 worked correctly for me. The default settings for srx240 only include match source-address 0.0.0.0/0 .

yes, the default setting for source nat does not include a destination line because it is not needed.  This assumes all destinations and you only need to include that line when you want to restrict the source nat by the destination address. 

 

Adding the destination match with 0.0.0.0/0 is not necessary.