Source and classification
- Source: ZNS Network Service 1.2.0 NAT rule priority behavior record.
- Classification: Consistent with current product design.
- Confirmation basis: This rule matching result is consistent with the current product design.
Issue metadata
- Issue ID: ZCF-4727.
- Component/product: Network Service and NAT.
- Status: Closed.
- Priority/severity: Not applicable.
- Affected version: 1.2.0.
- Resolution: This behavior is consistent with the current product design. It is recommended to plan rule scopes to avoid conflicts.
Problem description
When the same source IP matches both Reflexive NAT and SNAT with a priority, the higher-priority SNAT may determine the final egress source address, causing the actual egress source address to differ from the original plan. This behavior is consistent with the current product design. It is recommended to plan rule scopes to avoid conflicts.
Symptoms
- The service uses the SNAT address for egress traffic.
- The expected Reflexive address is not used as the final egress source address.
Impact
The actual egress source address may differ from the address plan or service expectations.
Workaround
- Avoid overlapping scopes between Reflexive NAT and SNAT rules.
- Narrow the destination network, protocol, and port matching scope of SNAT.
- After configuration, check the actual egress source IP instead of relying only on the rule deployment status.
Affected products
- Product: ZCF.
- Component: Network Service.
- Version: 1.2.0.
Fix status
- Current status: Consistent with current product design.
- Related patch/fix package: None.