---
name: vsrx-nat
title: Working with sNAT
description: This topic provides a sample configuration for sNAT on a vSRX appliance. With this configuration, a private node that is routed behind the Gateway can communicate with the outside world.
last-updated: 2019-11-14
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vsrx?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Working with sNAT
{: #working-with-snat}
{: help}
{: support}

This topic provides a sample configuration for sNAT on a vSRX appliance. With this configuration, a private node that is routed behind the Gateway can communicate with the outside world.
{: shortdesc}

![Sample topology](images/Sample-Topology-SNAT.png "Sample topology"){: caption="Sample topology" caption-side="bottom"}


```sh
from-zone CUSTOMER-PRIVATE to-zone SL-PUBLIC {
   policy SNAT {
       match {
           source-address any;
           destination-address any;
           application any;
       }
       then {
           permit;
       }
   }
}

nat {
   source {
       rule-set rs1 {
           from zone CUSTOMER-PRIVATE;
           to zone SL-PUBLIC;
           rule r1 {
               match {
                   source-address 0.0.0.0/0;
                   destination-address 0.0.0.0/0;
               }
               then {
                   source-nat {
                       interface;
                   }
               }
           }
       }
   }
}
```

To configure NAT for the IBM Cloud® Juniper vSRX, refer to this [configuration guide](https://www.juniper.net/documentation/us/en/software/junos/nat/nat.pdf){: external} on the Juniper website.