NAT Rule

NAT rules define network address translation policies for traffic flowing between zones. The scm CLI provides commands to create, update, delete, and load NAT rules.

Overview

The nat-rule commands allow you to:

• Create NAT rules with source and destination translation
• Update existing NAT rule configurations
• Delete NAT rules that are no longer needed
• Bulk import NAT rules from YAML files
• Export NAT rules for backup or migration

Set NAT Rule

Create or update a NAT rule.

Syntax

scm set network nat-rule NAME [OPTIONS]

Arguments

Argument	Description	Required
NAME	Name of the NAT rule	Yes

Options

Option	Description	Required
--folder TEXT	Folder location	Yes*
--snippet TEXT	Snippet location	Yes*
--device TEXT	Device location	Yes*
--description TEXT	Rule description	No
--tags TEXT	Tag to apply (repeat for multiple)	No
--disabled	Disable the rule	No
--nat-type TEXT	NAT type (ipv4, nat64, nptv6)	No
--from-zone TEXT	Source zones	No
--to-zone TEXT	Destination zones	No
--to-interface TEXT	Destination interface	No
--source TEXT	Source addresses	No
--destination TEXT	Destination addresses	No
--service TEXT	Service	No
--source-translation TEXT	Source translation config as JSON	No
--destination-translation TEXT	Destination translation config as JSON	No

* Exactly one of --folder, --snippet, or --device is required.

Examples

Create an Outbound NAT Rule

$ scm set network nat-rule outbound-nat \
    --folder Texas \
    --from-zone trust \
    --to-zone untrust \
    --source any \
    --destination any \
    --source-translation '{"dynamic_ip_and_port": {"type": "dynamic_ip_and_port", "translated_address": ["10.0.0.1"]}}'
---> 100%
Created NAT rule: outbound-nat in folder Texas

Create a Destination NAT Rule

$ scm set network nat-rule inbound-web \
    --folder Texas \
    --from-zone untrust \
    --to-zone dmz \
    --destination 203.0.113.10 \
    --destination-translation '{"translated_address": "192.168.1.10", "translated_port": 443}'
---> 100%
Created NAT rule: inbound-web in folder Texas

Delete NAT Rule

Delete a NAT rule from SCM.

Syntax

scm delete network nat-rule NAME [OPTIONS]

Arguments

Argument	Description	Required
NAME	Name of the NAT rule to delete	Yes

Options

Option	Description	Required
--folder TEXT	Folder location	Yes*
--snippet TEXT	Snippet location	Yes*
--device TEXT	Device location	Yes*
--force	Skip confirmation prompt	No

* Exactly one of --folder, --snippet, or --device is required.

Example

$ scm delete network nat-rule outbound-nat --folder Texas --force
---> 100%
Deleted NAT rule: outbound-nat from folder Texas

Load NAT Rule

Load multiple NAT rules from a YAML file.

Syntax

scm load network nat-rule [OPTIONS]

Options

Option	Description	Required
--file TEXT	Path to YAML file	Yes
--folder TEXT	Override folder location for all objects	No
--snippet TEXT	Override snippet location for all objects	No
--device TEXT	Override device location for all objects	No
--dry-run	Preview changes without applying	No

YAML File Format

---
nat_rules:
  - name: outbound-nat
    folder: Texas
    from_zone:
      - trust
    to_zone:
      - untrust
    source:
      - any
    destination:
      - any
    source_translation:
      dynamic_ip_and_port:
        type: dynamic_ip_and_port
        translated_address:
          - "10.0.0.1"

  - name: inbound-web
    folder: Texas
    from_zone:
      - untrust
    to_zone:
      - dmz
    destination:
      - "203.0.113.10"
    destination_translation:
      translated_address: "192.168.1.10"
      translated_port: 443

Examples

Load with Original Locations

$ scm load network nat-rule --file nat-rules.yml
---> 100%
✓ Loaded NAT rule: outbound-nat
✓ Loaded NAT rule: inbound-web

Successfully loaded 2 out of 2 NAT rules from 'nat-rules.yml'

Load with Folder Override

$ scm load network nat-rule --file nat-rules.yml --folder Austin
---> 100%
✓ Loaded NAT rule: outbound-nat
✓ Loaded NAT rule: inbound-web

Successfully loaded 2 out of 2 NAT rules from 'nat-rules.yml'

note

When using container override options (--folder, --snippet, --device), all NAT rules will be loaded into the specified container, ignoring the container specified in the YAML file.

Show NAT Rule

Display NAT rule objects.

Syntax

scm show network nat-rule [NAME] [OPTIONS]

Arguments

Argument	Description	Required
NAME	Name of the NAT rule to show; omit to list all	No

Options

Option	Description	Required
--folder TEXT	Folder location	Yes*
--snippet TEXT	Snippet location	Yes*
--device TEXT	Device location	Yes*
--max-results INTEGER	Maximum number of results to display	No
--output [table|json|yaml]	Output format (default: table)	No

* Exactly one of --folder, --snippet, or --device is required.

note

When no NAME argument is provided, all items are listed by default.

Examples

Show Specific NAT Rule

$ scm show network nat-rule outbound-nat --folder Texas
---> 100%
NAT Rule: outbound-nat
  Location: Folder 'Texas'
  From Zone: trust
  To Zone: untrust
  Source: any
  Destination: any
  Source Translation: dynamic_ip_and_port (10.0.0.1)

List All NAT Rules (Default Behavior)

$ scm show network nat-rule --folder Texas
---> 100%
NAT rules in folder 'Texas':
------------------------------------------------------------
Name: outbound-nat
  From: trust -> To: untrust
  Type: Source Translation
------------------------------------------------------------
Name: inbound-web
  From: untrust -> To: dmz
  Type: Destination Translation
------------------------------------------------------------

Backup NAT Rules

Backup all NAT rule objects from a specified location to a YAML file.

Syntax

scm backup network nat-rule [OPTIONS]

Options

Option	Description	Required
--folder TEXT	Folder location	No*
--snippet TEXT	Snippet location	No*
--device TEXT	Device location	No*
--file TEXT	Custom output filename	No

* One of --folder, --snippet, or --device is required.

Examples

Backup from Folder

$ scm backup network nat-rule --folder Texas
---> 100%
Successfully backed up 12 NAT rules to nat_rule_folder_texas_20240115_120530.yaml

Backup with Custom Filename

$ scm backup network nat-rule --folder Texas --file texas-nat-rules.yaml
---> 100%
Successfully backed up 12 NAT rules to texas-nat-rules.yaml

Best Practices

1. Order Rules Carefully: NAT rules are evaluated in order; place more specific rules before general ones.
2. Use Descriptive Names: Name NAT rules to clearly indicate the translation direction and purpose.
3. Specify Zones Explicitly: Always define source and destination zones to limit NAT rule scope.
4. Test with Dry Run: Use --dry-run when loading configurations to preview changes before applying.
5. Backup Before Changes: Always backup existing NAT rules before making bulk modifications.
6. Avoid Overlapping Rules: Ensure NAT rules do not conflict with each other to prevent unexpected translations.