Defining Dynamic Translations; Creating Access List Rules - Juniper JUNOSE 11.0.X IP SERVICES Configuration Manual

JUNOSe 11.0.x IP Services Configuration Guide

Defining Dynamic Translations

Dynamic translations use access list rules, to determine whether or not to apply NAT
to incoming traffic, and NAT address pools, from which a NAT translation can allocate
IP addresses. You use dynamic translation when you want the NAT router to initiate
and manage address translation and session flows between address realms on
demand.
To configure dynamic translations:

Creating Access List Rules

Before you create a dynamic translation, create the access list rules that you plan to
apply to the translation. For information about configuring access lists, see
"Configuring Routing Policy" on page 3.
The router evaluates multiple commands for the same access list in the order they
were created. An undefined access list implicitly contains a rule to permit any. A
defined access list implicitly ends with a rule to deny any.
NOTE: The access lists do not filter any packets; they determine whether the packet
requires translation.
You use the access-list command to create an access list.
access-list
74

Defining Dynamic Translations

Define any access list rules that the NAT router uses to decide which packets
need translation.
Define an address pool from which the NAT router obtains addresses.
Define inside and outside source translation rules for the NAT router to create
NAT translations.
Mark interfaces as inside or outside.
(Optional) Modify any translation timeout values.
Use to define an IP access list to permit or deny translation based on the
addresses in the packets.
Each access list is a set of permit or deny conditions for routes that are candidates
for translation (that is, moving from the inside network to the outside network).
A zero in the wildcard mask means that the route must exactly match the
corresponding bit in the address. A one in the wildcard mask means that the
route does not have to match the corresponding bit in the address.
Use the log keyword to log an Info event in the ipAccessList log whenever
matching an access list rule.
Example