You need to ensure that the security policy is configured correctly for a flow with both source NAT and destination NAT involved. In this scenario, which two match conditions are valid for source and destination addresses? (Choose two.)
When both source NAT and destination NAT are involved, the security policy must match addresses according to Junos NAT processing order. Juniper documents that static NAT and destination NAT are processed before route lookup and security policy lookup, while source NAT is processed after route and security policy lookup. This means that by the time policy evaluation occurs, the destination address has already been translated by destination NAT. However, the source address has not yet been translated by source NAT. Therefore, the correct policy match conditions are the post-NAT destination address and the pre-NAT source address. Matching on the pre-NAT destination or post-NAT source would not align with Junos SRX processing order.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit