What is SNAT?

Source NAT (SNAT) rewrites the source IP address of an outbound session to an address drawn from a configured pool or interface. On Versa Operating System (VOS) devices, SNAT pools back DNS proxy, HTTP/HTTPS proxy, URL filtering, and cloud URL lookup, and keep return traffic routed back through the same device.

Key takeaways

• SNAT rewrites a session’s source IP to an address from a configured pool.
• VOS SNAT pools use static IPv4 addresses, ranges, or egress networks.
• Cloud URL lookup, DNS proxy, and URL filtering all depend on SNAT pools.
• NAPT-44 dynamically maps many sessions through a shared pool address.
• SNAT keeps return traffic symmetric in HA and cloud gateway deployments.

On this page: Why it matters · How it works · Types · SNAT & Versa · FAQ

Why is SNAT important?

Devices behind a NAT boundary rarely have their real addresses reachable from the outside, and administrators often don’t want them to be. SNAT solves this by rewriting the source address on the way out, so many internal hosts can share a small set of routable, policy-controlled addresses when reaching the internet or a cloud service.

SNAT also matters for routing symmetry. When a device sends an outbound request – a DNS lookup, a proxied web request, a cloud reputation check – the response must return through the same path and device. Rewriting the source address to one owned by that device keeps return traffic routing correctly instead of getting dropped, which is critical in redundant-WAN and high-availability designs.

What is SNAT?

SNAT works by replacing the source IP address field in a packet’s header with a different address before the packet leaves the device, and reversing the substitution on matching return traffic. On VOS devices, the replacement address comes from an SNAT pool – a named object, tied to a routing instance, that supplies either static IPv4 addresses, an IPv4 address range, or an egress network – never a mix.

Services that need to originate their own traffic reference an SNAT pool rather than picking an address themselves. Cloud URL lookup, for example, points its cloud profile at an SNAT pool so lookup requests carry a known, routable, policy-consistent source address instead of an internal one.

Types of SNAT

VOS supports a few distinct SNAT behaviors. Static, one-to-one SNAT maps one internal address to one external address, preserving a fixed identity for a host. Dynamic, pool-based SNAT – configured as NAPT-44 in a CGNAT rule – translates many concurrent sessions through a shared pool address by also rewriting the source port, so a small pool can service a large number of internal hosts.

A third case, Twice NAT, combines source and destination NAT in one rule: inbound traffic to a publicly hosted application gets its destination rewritten to the real application address while its source is simultaneously rewritten to the device’s own interface address, so the reply traffic still routes back through the originating device. VOS configures this as Twice-Dynamic-NAT-44.

SNAT & Versa

On VOS devices, SNAT pools are configured in Director under Objects & Connectors, and referenced wherever outbound traffic needs a controlled source address: DNS proxy, HTTP/HTTPS proxy, URL filtering, file filtering, and cloud URL lookup. A cloud profile’s Source NAT Pool field points at the SNAT pool supplying addresses for lookups to Versa URM, and for redundant-WAN deployments, configuring SNAT pools alongside CGNAT and DNS-forwarder settings keeps requests routing correctly regardless of which link is active.

SNAT is also central to traffic symmetry in cloud high-availability designs. In VOS deployments behind an AWS Gateway Load Balancer, a CGNAT policy source-NATs traffic to the VOS LAN interface address so return traffic always routes back through the VOS instance that handled the forward flow – the load balancer cannot handle asymmetric flows otherwise.

Frequently asked questions

What is the difference between SNAT and DNAT?

SNAT rewrites a packet’s source address, typically for outbound traffic so replies route back correctly. DNAT rewrites the destination address, typically to redirect inbound traffic to an internal server. Twice NAT applies both in a single rule, most often for publicly hosted applications.

What is an SNAT pool?

An SNAT pool is a VOS configuration object, tied to a routing instance, that supplies the addresses SNAT uses when rewriting source IPs. It holds either static IPv4 addresses, an IPv4 address range, or an egress network – never a mix of addresses and egress networks.

Why does cloud URL lookup need SNAT?

Cloud URL lookup sends reputation requests from the VOS device to a cloud server. Without a configured SNAT pool, the device has no controlled, routable source address to use for those requests, and troubleshooting counters like sslcld-snat-resolved-cnt exist specifically to catch SNAT pool misconfiguration.

What is NAPT-44?

NAPT-44 is a dynamic NAT mode that translates IPv4 source addresses and port numbers together, letting many internal sessions share a small pool of external addresses. It is the NAT mode CGNAT rules use for pool-based, many-to-one source NAT, and the typical choice for SNAT pools serving cloud lookup and direct internet access traffic.

Can an SNAT pool use both static addresses and an egress network?

No. A VOS SNAT pool configures either individual IPv4 addresses (static or a range) or an egress network, but never both for the same pool. Administrators choose one addressing method per pool based on the deployment, since Director’s Add SNAT Pool window does not support mixing the two.

More on SNAT

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SNAT, these are worth looking at next.