Configuring Nat Objects; Configuring Legacy Nat Objects - Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE REV1 Administration Manual

Configuring NAT Objects

Configuring Legacy NAT Objects

Copyright © 2010, Juniper Networks, Inc.
Select a color to represent the routing instance object.
4.
Enter a comment or description about the routing instance object.
5.
In the New Routing Instance dialog box, click the Add icon. The New Routing Instance
6.
Entry dialog box appears.
Enter the name of the domain where you want to create the routing instance object.
7.
Enter the name of the device in which you want to create the routing instance.
8.
Select a routing instance from the routing instance drop-down list box and click OK.
9.
If no routing instance is available, you need to create a routing instance using the
Add icon in the New Routing Instance Entry dialog box. For details on adding routing
instances, see the Junos Routing Protocols Configuration Guide.
The types of Network Address Translation (NAT) objects that are supported in NSM are
legacy NAT objects for Screen OS devices and Junos NAT objects for Junos OS devices.
For more information, see the following sections:
Configuring Legacy NAT Objects on page 409
Configuring Junos OS NAT Objects on page 411
A global NAT object contains references to device-specific NAT configurations, enabling
multiple devices to share a single object. Use the Device Manager to configure NAT for
each device, then create a global NAT object that includes the device-specific NAT
configuration. The single global NAT object represents multiple device-specific NAT
objects; for example, a global dynamic IP (DIP) represents multiple device-specific DIPs.
However, a global NAT object can contain only one device-specific NAT object from the
same device.
Use global NAT objects in VPNs; when you install the VPN on a device, that device
automatically replaces the global NAT object with its device-specific NAT configuration.
Before you configure a shared NAT object, ensure that you have configured the mapped
IP (MIP), virtual IP (VIP), or DIP on the device itself.
You cannot configure NAT objects for SRX Series Services Gateways and use them in
security policies. For SRX Series gateways, NAT settings must be configured in the device.
For more information on DIP, MIP, and VIP objects, see the following sections:
Configuring DIP Objects on page 410
Configuring MIP Objects on page 410
Configuring VIP Objects on page 410
Chapter 8: Configuring Objects
409