View Only
last person joined: 19 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  Advertise NAT pools to BGP

    Posted 09-01-2010 06:08

    NAT Pools:


    SRX has interface in only one of these networks ( with a BGP peer at


    Since is active in our routing table, no problem getting that into our BGP advertisement.


    What is the most appropriate way to inject the and NAT pools into BGP?


    Static route with discard action? Static route with receive action? Other?


  • 2.  RE: Advertise NAT pools to BGP
    Best Answer

    Posted 09-01-2010 08:07

    My standard method is to create a discard static route and use that for the BGP export.


    There are other methods. Choose one you like best. I like discard, it's worked well for me.


    Like this:


    routing-options {
        static {
            route discard;




    policy-options {
        policy-statement public-to-bgp {
            from {
                protocol static;
                route-filter exact;
            then accept;


    protocols {
        bgp {
            export public-to-bgp;



  • 3.  RE: Advertise NAT pools to BGP

    Posted 06-29-2015 23:50


    Is there a more specific route installed?

    If I look at the flow-chart for sessions:


    - then source-NAT comes after route-lookup

  • 4.  RE: Advertise NAT pools to BGP

    Posted 05-04-2017 05:33

    Just saw your response (I know it's been a few years), but I've been working through the same solution for a customer that has two upstream routers:


    I think the reason that this works is that traffic TO the source-nat prefix would always be part of an existing session (eg: outbound traffic has already been source-NATted, return traffic is coming back to the advertised prefixes), so in the SRX Order of Operations, it would skip straight to the Existing Sessions section and avoid route look-up.

  • 5.  RE: Advertise NAT pools to BGP

    Posted 09-01-2010 11:46
    That works. I guess the NAT process grabs it before it actually discards it. It seemed to work that way but it felt counter-intuitive to tell it to discard traffic destined for a network for which I wanted to receive traffic. Thanks for the reply.