04-Network Connectivity

HomeSupportResource CenterH3C FAT AP Command References(R5436)-6W10104-Network Connectivity
15-NAT commands
Title Size Download
15-NAT commands 252.83 KB

NAT commands

address

Use address to add an address range to a NAT address group.

Use undo address to remove an address range from a NAT address group.

Syntax

address start-address end-address

undo address start-address end-address

Default

No address ranges exist.

Views

NAT address group view

Predefined user roles

network-admin

Parameters

start-address end-address: Specifies the start and end IP addresses of the address range. The end address must not be lower than the start address. If they are the same, the address range has only one IP address. You can specify a maximum of 65535 addresses in an IP address range.

Usage guidelines

A NAT address group is a set of address ranges. The source address in a packet destined for an external network is translated into an address in one of the address ranges.

You can specify a maximum of 65535 addresses in one command execution. Make sure the address ranges in a single NAT address group or in multiple NAT address groups do not overlap.

Examples

# Add address ranges to an address group.

<Sysname> system-view

[Sysname] nat address-group 2

[Sysname-address-group-2] address 10.1.1.1 10.1.1.15

[Sysname-address-group-2] address 10.1.1.20 10.1.1.30

Related commands

nat address-group

display nat address-group

Use display nat address-group to display NAT address group information.

Syntax

display nat address-group [ group-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

group-id: Specifies the ID of a NAT address group. The value range for this argument is 0 to 65535. If you do not specify the group-id argument, this command displays information about all NAT address groups.

Examples

# Display information about all NAT address groups.

<Sysname> display nat address-group

NAT address group information:

  Totally 5 NAT address groups.

  Address group ID: 1    Address group name: a

    Port range: 1-65535

    Address information:

      Start address         End address

      202.110.10.10         202.110.10.15

 

  Address group ID: 2

    Port range: 1-65535

    Address information:

      Start address         End address

      202.110.10.20         202.110.10.25

      202.110.10.30         202.110.10.35

 

  Address group ID: 3

    Port range: 1024-65535

    Address information:

      Start address         End address

      202.110.10.40         202.110.10.50

 

  Address group ID: 4

    Port range: 10001-65535

    Address information:

      Start address         End address

      202.110.10.60         202.110.10.65

 

  Address group ID: 6

    Port range: 1-65535

    Address information:

      Start address         End address

      ---                   ---

# Display information about NAT address group 1.

<Sysname> display nat address-group 1

  Address group ID: 1    Address group name: a

    Port range: 1-65535

    Address information:

      Start address         End address

      202.110.10.10         202.110.10.15

Table 1 Command output

Field

Description

NAT address group information

Information about the NAT address group

Address group ID

ID of the NAT address group.

Totally n NAT address groups

Total number of NAT address groups.

Address group name

Name of the NAT address group. If no address group name is configured, this field is not displayed.

Port range

Port range for public IP addresses.

Address information

Information about the IP addresses in the address group.

For addresses added by using the address command:

·     Start address—Start IP address of an address range. If you do not specify a start address for the range, this field displays hyphens (---).

·     End address—End IP address of an address range. If you do not specify an end address for the range, this field displays hyphens (---).

Related commands

nat address-group

display nat alg

Use display nat alg to display the NAT ALG status for all supported protocols.

Syntax

display nat alg

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the NAT ALG status for all supported protocols.

<Sysname> display nat alg

NAT ALG:

  DNS        : Enabled

  FTP        : Disabled

  H323       : Disabled

  ICMP-ERROR : Disabled

  ILS        : Disabled

  MGCP       : Disabled

  NBT        : Disabled

  PPTP       : Disabled

  RTSP       : Disabled

  RSH        : Disabled

  SCCP       : Disabled

  SIP        : Disabled

  SQLNET     : Disabled

  TFTP       : Disabled

  XDMCP      : Disabled

Related commands

display nat all

display nat all

Use display nat all to display all NAT configuration information.

Syntax

display nat all

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display all NAT configuration information.

<Sysname> display nat all

NAT address group information:

  Totally 5 NAT address groups.

  Address group ID: 1:

    Port range: 1-65535

    Address information:

      Start address         End address

      202.110.10.10         202.110.10.15

 

  Address group ID: 2:

    Port range: 1-65535

    Address information:

      Start address         End address

      202.110.10.20         202.110.10.25

      202.110.10.30         202.110.10.35

 

  Address group ID: 3:

    Port range: 1024-65535

    Address information:

      Start address         End address

      202.110.10.40         202.110.10.50

 

  Address group ID: 4:

    Port range: 10001-65535

    Address information:

      Start address         End address

      202.110.10.60         202.110.10.65

 

  Address group ID: 6:

    Port range: 1-65535

    Address information:

      Start address         End address

      ---                   ---

 

NAT inbound information:

  Totally 1 NAT inbound rules.

  Interface: Vlan-interface20

    ACL: 2038

    Address group ID: 2

    Add route: Y         NO-PAT:Y  Reversible: N

    Rule name: abc

    Priority: 1000

    NAT counting: 0

    Config status: Active

 

NAT outbound information:

  Totally 2 NAT outbound rules.

  Interface: Vlan-interface10

    ACL: 2036

    Address group ID: 1

    Port-preserved: Y        NO-PAT: N  Reversible: N

    Rule name: lee

    Priority: 122

    NAT counting: 0

    Config status: Inactive

    Reasons for inactive status:

      The following items don't exist or aren't effective: ACL.

 

  Interface: Vlan-interface10

    ACL: 2037

    Address group ID: 1

    Port-preserved: N        NO-PAT: Y  Reversible: Y

    Rule name: rabbit

    Priority: 100

    NAT counting: 0

      The following items don't exist or aren't effective: ACL.

 

Static NAT mappings:

  Totally 2 inbound static NAT mappings.

  Net-to-net:

    Global IP    : 2.2.2.1 – 2.2.2.255

    Local IP     : 1.1.1.0

    Netmask      : 255.255.255.0

    ACL          : 3000

    Reversible   : Y

    Rule name    : green

    Priority     : 4

    NAT counting : 0

    Config status: Active

 

  IP-to-IP:

    Global IP    : 5.5.5.5

    Local IP     : 4.4.4.4

    ACL          : 2001

    Reversible   : Y

    Rule name    : blue

    Priority     : 4

    NAT counting : 0

    Config status: Inactive

    Reasons for inactive status:

      The following items don't exist or aren't effective: ACL.

 

  Totally 2 outbound static NAT mappings.

  Net-to-net:

    Local IP     : 1.1.1.1 - 1.1.1.255

    Global IP    : 2.2.2.0

    Netmask      : 255.255.255.0

    ACL          : 3000

    Reversible   : Y

    Rule name    : yellow

    Priority     : 5

    NAT counting : 0

    Config status: Active

 

  IP-to-IP:

    Local IP     : 4.4.4.4

    Global IP    : 5.5.5.5

    ACL:         : 2001

    Reversible   : Y

    Rule name    : pink

    Priority     : 6

    NAT counting : 0

    Config status: Inactive

    Reasons for inactive status:

      The following items don't exist or aren't effective: ACL.

 

Interfaces enabled with static NAT:

  Totally 2 interfaces enabled with static NAT.

  Interface: Vlan-interface20

    Config status: Active

 

NAT logging:

  Log enable          : Enabled(ACL 2000)

  Flow-begin          : Disabled

  Flow-end            : Disabled

  Flow-active         : Enabled(10 minutes)

  Port-block-assign   : Disabled

  Port-block-withdraw : Disabled

  Alarm               : Disabled

  NO-PAT IP usage     : Disabled

 

NAT mapping behavior:

  Mapping mode : Endpoint-Independent

  ACL          : 2050

  Config status: Active

 

NAT ALG:

  DNS        : Enabled

  FTP        : Disabled

  H323       : Enabled

  ICMP-ERROR : Enabled

  ILS        : Enabled

  MGCP       : Enabled

  NBT        : Enabled

  PPTP       : Enabled

  RSH        : Enabled

  RTSP       : Enabled

  SCCP       : Enabled

  SIP        : Disabled

  SQLNET     : Enabled

  TFTP       : Enabled

  XDMCP      : Enabled

The output shows all NAT configuration information. Table 2 describes only the fields for the output of the nat alg command.

Table 2 Command output

Field

Description

NAT address group information

Information about the NAT address group. See Table 1 for output description.

NAT inbound information:

Inbound dynamic NAT configuration. See Table 4 for output description.

NAT outbound information

Outbound dynamic NAT configuration. See Table 7 for output description.

Static NAT mappings

Static NAT mappings. See Table 9 for output description.

NAT logging

NAT logging configuration. See Table 5 for output description.

NAT counting

Number of times the NAT rule is matched.

NAT mapping behavior

Mapping behavior mode of PAT: Endpoint-Independent or Address and Port-Dependent.

ACL

ACL number or name. If no ACL is specified for NAT, this field displays hyphens (---).

Config status

Status of the NAT mapping behavior configuration: Active or Inactive.

Reasons for inactive status

Reasons why the NAT mapping behavior configuration does not take effect. This field is available when the Config status is Inactive.

NAT ALG

NAT ALG configuration for different protocols.

display nat eim

Use display nat eim to display information about NAT Endpoint-Independent Mapping (EIM) entries.

Syntax

display nat eim

Views

Any view

Predefined user roles

network-admin

network-operator

Usage guidelines

EIM entries are created when PAT operates in EIM mode. An EIM entry is a 3-tuple entry, and it records the mapping between a private address/port and a public address/port.

The EIM entry provides the following functions:

·     The same EIM entry applies to subsequent connections initiated from the same source IP and port.

·     The EIM entries allow reverse translation for connections initiated from external hosts to internal hosts.

Examples

# Display information about NAT EIM entries.

<Sysname> display nat eim

Slot 0:

Local  IP/port: 192.168.100.100/1024

Global IP/port: 200.100.1.100/2048

Protocol: TCP(6)

 

Local  IP/port: 192.168.100.200/2048

Global IP/port: 200.100.1.200/4096

Protocol: UDP(17)

 

Total entries found: 2

Table 3 Command output

Field

Description

Protocol

Protocol name and number.

Total entries found

Total number of EIM entries.

Related commands

nat mapping-behavior

nat outbound

display nat inbound

Use display nat inbound to display inbound dynamic NAT configuration.

Syntax

display nat inbound

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display inbound dynamic NAT configuration.

<Sysname> display nat inbound

NAT inbound information:

  Totally 2 NAT inbound rules.

  Interface: Vlan-interface20

    ACL: 2038

    Address group ID: 2

    Add route: Y          NO-PAT: Y  Reversible: N

    Rule name: abcd

    Priority: 1000

    NAT counting: 0

    Config status: Active

Table 4 Command output

Field

Description

NAT inbound information

Information about inbound dynamic NAT configuration.

Totally n NAT inbound rules

Total number of inbound dynamic NAT rules.

Interface

Interface where the inbound dynamic NAT rule is configured.

ACL

ACL number or name.

Address group ID

ID of the NAT address group used by the inbound dynamic NAT rule.

Address group name

Name of the NAT address group. If no address group name is configured, this field is not displayed.

Add route

Whether to add a route when a packet matches the inbound dynamic NAT rule:

·     YAdds a route.

·     NDoes not add a route.

NO-PAT

Whether NO-PAT or PAT is used:

·     YNO-PAT is used.

·     NPAT is used.

Reversible

Whether reverse address translation is allowed:

·     YReverse address translation is allowed.

·     NReverse address translation is not allowed.

Rule name

Name of the NAT rule.

Priority

Priority of the NAT rule.

NAT counting

Number of times the NAT rule is matched.

Config status

Status of the inbound dynamic NAT rule: Active or Inactive.

Reasons for inactive status

Reasons why the inbound dynamic NAT rule does not take effect:

This field is available when the Config status is Inactive.

Related commands

nat inbound

display nat log

Use display nat log to display NAT logging configuration.

Syntax

display nat log

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display NAT logging configuration.

<Sysname> display nat log

NAT logging:

  Log enable          : Enabled(ACL 2000)

  Flow-begin          : Disabled

  Flow-end            : Disabled

  Flow-active         : Enabled(10 minutes)

  Port-block-assign   : Disabled

  Port-block-withdraw : Disabled

  Alarm               : Disabled

Table 5 Command output

Field

Description

NAT logging

NAT logging configuration.

Log enable

Enabling status of NAT logging.

If an ACL is specified for NAT logging, this field also displays the ACL number or name.

Flow-begin

Enabling status of logging for NAT session establishment events.

Flow-end

Enabling status of logging for NAT session removal events.

Flow-active

Enabling status of logging for active NAT flows. If it is enabled, this field also displays the interval in minutes at which active flow logs are generated.

Port-block-assign

This field is not supported in the current software version.

Enabling status of NAT444 user logging for port block assignment.

Port-block-withdraw

This field is not supported in the current software version.

Enabling status of NAT444 user logging for port block withdrawal.

Alarm

This field is not supported in the current software version.

Enabling status of logging for NAT alarms.

Related commands

nat log enable

nat log flow-active

nat log flow-begin

display nat no-pat

Use display nat no-pat command to display information about NAT NO-PAT entries.

Syntax

display nat no-pat

Views

Any view

Default user roles

network-admin

network-operator

Usage guidelines

A NO-PAT entry records the mapping between a private address and a public address.

The NO-PAT entry provides the following functions:

·     The same entry applies to subsequent connections initiated from the same source IP address.

·     The NO-PAT entries allow reverse translation for connections initiated from external hosts to internal hosts.

Outbound and inbound NO-PAT address translations create their own NO-PAT tables. These two types of tables are displayed separately.

Examples

# Display information about NO-PAT entries for all cards.

<Sysname> display nat no-pat

Slot 0:

Global  IP: 200.100.1.100

Local   IP: 192.168.100.100

Reversible: N

Type      : Inbound

Local   IP: 192.168.100.200

Global  IP: 200.100.1.200

Reversible: Y

Type      : Outbound

Total entries found: 2

Table 6 Command output

Field

Description

Global IP

Public IP address.

Local IP

Private IP address.

Reversible

Whether reverse address translation is allowed:

·     Y—Reverse address translation is allowed.

·     N—Reverse address translation is not allowed.

Type

Type of the NO-PAT entry:

·     Inbound—A NO-PAT entry created during inbound dynamic NAT.

·     Outbound—A NO-PAT entry created during outbound dynamic NAT.

Total entries found

Total number of NO-PAT entries.

Related commands

nat inbound

nat outbound

display nat outbound

Use display nat outbound to display outbound dynamic NAT configuration.

Syntax

display nat outbound

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display outbound dynamic NAT configuration.

<Sysname> display nat outbound

NAT outbound information:

  Totally 2 NAT outbound rules.

  Interface: Vlan-interface10

    Address group ID: 1

    Port-preserved: Y        NO-PAT: N  Reversible: N

    Rule name: acdefg

    Priority: 1000

    NAT counting: 0

    Config status: Active

 

  Interface: Vlan-interface10

    ACL: 2037

    Address group ID: ---

    Port-preserved: N         NO-PAT: Y  Reversible: Y

    Rule name: abefg

    Priority: 1000

    NAT counting: 0

    Config status: Inactive

    Reasons for inactive status:

      The following items don't exist or aren't effective: ACL

 

  Interface: Vlan-interface10

    ACL: 2100

    Address group ID: 2

    Port-preserved: N          NO-PAT: N  Reversible: N

    Priority: 0

    NAT counting: 0

    Config status: Active

Table 7 Command output

Field

Description

NAT outbound information

Information about outbound dynamic NAT configuration.

Totally n NAT outbound rules

Total number of outbound dynamic NAT rules.

Interface

Interface where the outbound dynamic NAT rule is configured.

ACL

IPv4 ACL number or name. If no IPv4 ACL is specified for outbound dynamic NAT rule, this field displays hyphens (---).

Address group ID

ID of the address group used by the outbound dynamic NAT rule. If no address group is specified, the field displays hyphens (---).

Address group name

Name of the NAT address group. If no address group name is configured, this field is not displayed.

Port-preserved

Whether to try to preserve the port numbers for PAT.

·     YTries to preserve the port numbers.

·     NAllows translating port numbers.

NO-PAT

Whether NO-PAT is used:

·     YNO-PAT is used.

·     NPAT is used.

Reversible

Whether reverse address translation is allowed:

·     Y—Reverse address translation is allowed.

·     N—Reverse address translation is not allowed.

Rule name

Name of the NAT rule.

Priority

Priority of the NAT rule.

NAT counting

Number of times the NAT rule is matched.

Config status

Status of the outbound dynamic NAT rule: Active or Inactive.

Reasons for inactive status

Reasons why the outbound dynamic NAT rule does not take effect.

This field is available when the Config status is Inactive.

Related commands

nat outbound

display nat session

Use display nat session to display NAT sessions.

Syntax

display nat session [ [ responder ] { source-ip source-ip | destination-ip destination-ip } * ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

responder: Displays NAT sessions by responder. If you do not specify this keyword, this command displays NAT sessions by initiator.

source-ip source-ip: Displays NAT sessions for the source IP address specified by the source-ip argument. The IP address must be the source IP address of the packet that triggers the session establishment.

destination-ip destination-ip: Displays NAT sessions for the destination IP address specified by the destination-ip argument. The IP address must be the destination IP address of the packet that triggers the session establishment.

verbose: Displays detailed information about NAT sessions. If you do not specify this keyword, this command displays brief information about NAT sessions.

Usage guidelines

If you do not specify any parameters, this command displays all NAT sessions.

Examples

# Display detailed information about NAT sessions.

<Sysname> display nat session verbose

Slot 0:

Initiator:

  Source      IP/port: 192.168.1.18/1877

  Destination IP/port: 192.168.1.55/22

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: TCP(6)

  Inbound interface: Vlan-interface10

  Source security zone: SrcZone

Responder:

  Source      IP/port: 192.168.1.55/22

  Destination IP/port: 192.168.1.10/1877

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/VLL ID: -/-/-

  Protocol: TCP(6)

  Inbound interface: Vlan-interface20

  Source security zone: DestZone

State: TCP_SYN_SENT

Application: SSH

Rule ID: -/-/-

Rule name:

Start time: 2011-07-29 19:12:36  TTL: 28s

Initiator->Responder:         1 packets         48 bytes

Responder->Initiator:         0 packets          0 bytes

 

Total sessions found: 1

Table 8 Command output

Field

Description

Initiator

Session information about the initiator.

Responder

Session information about the responder.

Source IP/port

Source IP address and port number.

Destination IP/port

Destination IP address and port number.

DS-Lite tunnel peer

Destination address of the DS-Lite tunnel interface. If the session does not belong to any DS-Lite tunnel, this field displays a hyphen (-).

VPN instance/VLAN ID/Inline ID

The fields identify the following information:

·     VPN instance—MPLS L3VPN instance to which the session belongs. The VPN instance field is not supported in the current software version.

·     VLAN ID—VLAN ID to which the session belongs for Layer 2 forwarding.

·     Inline ID—INLINE to which the session belongs for Layer 2 forwarding.

If no VPN instance, VLAN ID, or inline ID is specified, a hyphen (-) is displayed for the related field.

Protocol

Transport layer protocol type: DCCP, ICMP, Raw IP, SCTP, TCP, UDP, or UDP-Lite.

Inbound interface

Input interface.

State

NAT session status.

Application

Application layer protocol type, such as FTP and DNS.

This field displays OTHER for the protocol types identified by non-well-known ports.

Rule ID

ID of the security policy rule.

Rule name

Name of the security policy rule.

Start time

Time when the session starts.

TTL

Remaining NAT session lifetime in seconds.

Initiator->Responder

Number of packets and packet bytes from the initiator to the responder.

Responder->Initiator

Number of packets and packet bytes from the responder to the initiator.

Total sessions found

Total number of sessions.

Related commands

reset nat session

display nat static

Use display nat static to display static NAT mappings.

Syntax

display nat static

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display static NAT mappings.

<Sysname> display nat static

Static NAT mappings:

  Totally 2 inbound static NAT mappings.

  Net-to-net:

    Global IP    : 1.1.1.1 - 1.1.1.255

    Local IP     : 2.2.2.0

    Netmask      : 255.255.255.0

    ACL          : 2000

    Reversible   : Y

    NAT counting : 0

    Rule name    : abcdefg

    Priority     : 1000

    Config status: Active

 

  IP-to-IP:

    Global IP    : 5.5.5.5

    Local IP     : 4.4.4.4

    ACL          : 2000

    Reversible   : Y

    Rule name    : abefg

    Priority     : 1000

    NAT counting : 0

   Config status: Inactive

    Reasons for inactive status:

      The following items don't exist or aren't effective: local VPN, global VPN, and ACL.

 

Totally 2 outbound static NAT mappings.

  Net-to-net:

    Local IP     : 1.1.1.1 - 1.1.1.255

    Global IP    : 2.2.2.0

    Netmask      : 255.255.255.0

    ACL          : 2000

    Reversible   : Y

    Rule name    : abefg

    Priority     : 1000

    NAT counting : 0

    Config status: Active

 

  IP-to-IP:

    Local IP     : 4.4.4.4

    Global IP    : 5.5.5.5

    ACL:         : 2001

    Reversible   : Y

    Rule name    : abcd

    Priority     : 1000

    NAT counting : 0

    Config status: Inactive

    Reasons for inactive status:

      The following items don't exist or aren't effective: ACL.

 

Interfaces enabled with static NAT:

  Totally 2 interfaces enabled with static NAT.

  Interface: Vlan-interface20

    Config status: Active

Table 9 Command output

Field

Description

Static NAT mappings

Information about static NAT mapping configuration.

Totally n inbound static NAT mappings

Total number of inbound static NAT mappings.

Totally n outbound static NAT mappings

Total number of outbound static NAT mappings.

Net-to-net

Net-to-net static NAT mapping.

IP-to-IP

One-to-one static NAT mapping.

Local IP

Private IP address or address range.

Global IP

Public IP address or address range.

Netmask

Network mask.

ACL

ACL number or name. If no ACL is specified, this field is not displayed.

Reversible

Whether reverse address translation is allowed. If reverse address translation is allowed, this field displays Y. If reverse address translation is not allowed, this field is not displayed.

Interfaces enabled with static NAT

Interfaces on which static NAT is enabled.

Totally n interfaces enabled with static NAT

Total number of interfaces where static NAT is enabled.

Interface

Interface on which static NAT is enabled.

Rule name

Name of the NAT rule.

Priority

Priority of the NAT rule.

NAT counting

Number of times the NAT rule is matched.

Config status

Status of the static NAT mapping: Active or Inactive.

Reasons for inactive status

Reasons why the static NAT mapping does not take effect. This field is available when the Config status is Inactive.

Related commands

nat static enable

nat static inbound

nat static inbound net-to-net

nat static outbound

nat static outbound net-to-net

display nat statistics

Use display nat statistics to display NAT statistics.

Syntax

display nat statistics [ summary ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

summary: Displays NAT statistics summary. If you do not specify this keyword, this command displays detailed NAT statistics.

Examples

# Display detailed information about NAT statistics.

<Sysname> display nat statistics

Slot 0:

  Session creation rate: 0

  Total session entries: 100

  Total EIM entries: 1

  Total inbound NO-PAT entries: 0

  Total outbound NO-PAT entries: 0

  Total static port block entries: 10

  Total dynamic port block entries: 15

  Active static port block entries: 0

  Active dynamic port block entries: 0

Table 10 Command output

Field

Description

Total session entries

Number of NAT session entries.

Session creation rate

Number of NAT sessions created per second.

Total EIM entries

Total number of EIM entries.

Total inbound NO-PAT entries

Total number of inbound NO-PAT entries.

Total outbound NO-PAT entries

Total number of outbound NO-PAT entries.

Total static port block entries

This field is not supported in the current software version.

Total number of static NAT444 mappings.

Total dynamic port block entries

This field is not supported in the current software version.

Total number of dynamic port block mappings that can be created. It equals the number of port blocks for dynamic assignment, including the assigned and unassigned port blocks.

Active static port block entries

This field is not supported in the current software version.

Number of static port block mappings that are in use.

Active dynamic port block entries

This field is not supported in the current software version.

Number of dynamic port block mappings that have been created. It equals the number of dynamically assigned port blocks.

# Display NAT statistics summary.

<Sysname> display nat statistics summary

EIM: Total EIM entries.

SPB: Total static port block entries.

DPB: Total dynamic port block entries.

ASPB: Active static port block entries.

ADPB: Active dynamic port block entries.

Slot Sessions  EIM       SPB       DPB       ASPB      ADPB

0    100       1         10        15        0         0

Table 11 Command output

Field

Description

Sessions

Number of NAT session entries.

EIM

Number of EIM entries.

SPB

This field is not supported in the current software version.

Number of static NAT444 mappings.

DPB

This field is not supported in the current software version.

Number of dynamic port block mappings that can be created. It equals the number of port blocks for dynamic assignment, including the assigned and unassigned port blocks.

ASPB

This field is not supported in the current software version.

Number of static port block mappings in use.

ADPB

This field is not supported in the current software version.

Number of dynamic port block mappings that have been created. It equals the number of dynamically assigned port blocks.

nat address-group

Use nat address-group to create a NAT address group and enter its view, or enter the view of an existing NAT address group.

Use undo nat address-group to delete a NAT address group.

Syntax

nat address-group group-id [ name group-name ]

undo nat address-group group-id

Default

No NAT address groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Specifies the ID of a NAT address group. The value range for this argument is 0 to 65535.

name group-name: Assigns a name to the NAT address group. The group-name argument is a case-sensitive string of 1 to 63 characters.

Usage guidelines

A NAT address group is a set of address ranges. Use the address command to add an address range to a NAT address group. Dynamic NAT translates the source IP address of a packet into an IP address in the address group.

Examples

# Create a NAT address group numbered 1 and named abc.

<Sysname> system-view

[Sysname] nat address-group 1 name abc

Related commands

address

display nat address-group

display nat all

nat inbound

nat outbound

nat alg

Use nat alg to enable NAT ALG for the specified or all supported protocols.

Use undo nat alg to disable NAT ALG for the specified or all supported protocols.

Syntax

nat alg { all | dns | ftp | icmp-error | ils | mgcp | nbt | pptp | rsh | rtsp | sccp | sqlnet | tftp | xdmcp }

undo nat alg { all | dns | ftp | icmp-error | ils | mgcp | nbt | pptp | rsh | rtsp | sccp | sqlnet | tftp | xdmcp }

Default

NAT ALG is enabled for DNS, FTP, ICMP error messages, RTSP, and PPTP, and is disabled for the other supported protocols.

Views

System view

Predefined user roles

network-admin

Parameters

all: Enables NAT ALG for all supported protocols.

dns: Enables NAT ALG for DNS.

ftp: Enables NAT ALG for FTP.

icmp-error: Enables NAT ALG for ICMP error packets.

ils: Enables NAT ALG for ILS.

mgcp: Enables NAT ALG for MGCP.

nbt: Enables NAT ALG for NBT.

pptp: Enables NAT ALG for PPTP.

rsh: Enables NAT ALG for RSH.

rtsp: Enables NAT ALG for RTSP.

sccp: Enables NAT ALG for SCCP.

sqlnet: Enables NAT ALG for SQLNET.

tftp: Enables NAT ALG for TFTP.

xdmcp: Enables NAT ALG for XDMCP.

Usage guidelines

NAT ALG translates address or port information in the application layer payload to ensure connection establishment.

For example, an FTP application includes a data connection and a control connection. The IP address and port number for the data connection depend on the payload information of the control connection. This requires NAT ALG to translate the address and port information to establish the data connection.

Examples

# Enable NAT ALG for FTP.

<Sysname> system-view

[Sysname] nat alg ftp

Related commands

display nat all

nat icmp-error reply

Use nat icmp-error reply to enable sending ICMP error messages upon NAT failures.

Use undo nat icmp-error reply to restore the default.

Syntax

nat icmp-error reply

undo nat icmp-error reply

Default

No ICMP error messages are sent upon NAT failures.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Disabling sending ICMP error messages upon NAT failures reduces useless packets, saves bandwidth, and avoids exposing the device IP address to the public network.

This command is required for traceroute.

Examples

# Enable sending ICMP error messages upon NAT failures.

<Sysname> system-view

[Sysname] nat icmp-error reply

nat inbound

Use nat inbound to configure an inbound dynamic NAT rule.

Use undo nat inbound to delete an inbound dynamic NAT rule.

Syntax

nat inbound { ipv4-acl-number | name ipv4-acl-name } address-group { group-id | name group-name } [ no-pat [ reversible ] [ add-route ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ description text ] [ counting ]

undo nat inbound { ipv4-acl-number | name ipv4-acl-name }

Default

No inbound dynamic NAT rules exist.

Views

Interface view

Predefined user roles

network-admin

Parameters

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

address-group group-id: Specifies an address group for address translation.

group-id: Specifies the address group ID. The value range for this argument is 0 to 65535.

name group-name: Specifies the address group name, a case-insensitive string of 1 to 63 characters.

no-pat: Uses the NO-PAT mode. If you do not specify this keyword, PAT is used. PAT supports only TCP, UDP, and ICMP query packets. For an ICMP packet, the ICMP ID is used as its source port number.

reversible: Enables reverse address translation. Reverse address translation uses existing NO-PAT entries to translate the destination address for connections actively initiated from the internal network to the external network.

add-route: Automatically adds a route to the source address after translation. The output interface is the NAT interface and the next hop is the source address before translation.

rule rule-name: Specifies a name for the rule, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the rule does not have a name.

priority priority: Specifies a priority for the rule, in the range of 0 to 2147483647. A smaller value represents a higher priority. If you do not specify this option, the rule has the lowest priority among the same type of NAT rules.

disable: Disables the inbound dynamic NAT rule. If you do not specify this keyword, the rule is enabled.

description text: Specifies a description for the inbound dynamic NAT rule. The text argument is a case-insensitive string of 1 to 63 characters.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

Inbound dynamic NAT translates the source IP addresses of incoming packets permitted by the ACL into IP addresses in the address group.

Inbound dynamic NAT supports the following modes:

·     PAT—Performs both IP address translation and port translation.

·     NO-PAT—Performs only IP address translation.

The NO-PAT mode supports reverse address translation. Reverse address translation uses ACL reverse matching to identify packets to be translated. ACL reverse matching works as follows:

·     Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

·     Translates the destination IP address of the packet according to the matching NO-PAT entry, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Inbound dynamic NAT typically cooperates with one of the following to implement bidirectional NAT:

·     Outbound dynamic NAT (the nat outbound command).

·     Outbound static NAT (the nat static command).

An address group cannot be used by both the nat inbound and nat outbound commands. It cannot be used by the nat inbound command in both PAT and NO-PAT modes.

Do not specify the add-route keyword if the subnets where the internal and external networks reside overlap. For other network scenarios:

·     If you specify the add-route keyword, the device automatically adds a route to the source address after translation for a packet. The destination address is the NATed address in the NAT address group, the output interface is the interface where the command is executed, and the next hop is the source address before translation.

·     If you do not specify the add-route keyword, you must manually add the route. As a best practice, add routes manually because automatic route adding is slow.

An ACL can be used by only one inbound dynamic NAT rule on an interface.

You can configure multiple inbound dynamic NAT rules on an interface.

Inbound dynamic NAT rules configured with the same priority value are matched by using their ACLs.

·     NAT rules with named ACLs have higher priorities than NAT rules with unnamed ACLs.

·     NAT rules with named ACLs are matched in alphabetical order of their ACL names.

·     NAT rules with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure ACL 2001 to permit packets only from subnet 10.110.10.0/24 to pass through.

<Sysname> system-view

[Sysname] acl basic 2001

[Sysname-acl-ipv4-basic-2001] rule permit source 10.110.10.0 0.0.0.255

[Sysname-acl-ipv4-basic-2001] rule deny

[Sysname-acl-ipv4-basic-2001] quit

# Create address group 1 and add the address range of 202.110.10.10 to 202.110.10.12 to the group.

[Sysname] nat address-group 1

[Sysname-address-group-1] address 202.110.10.10 202.110.10.12

[Sysname-address-group-1] quit

# Configure an inbound NO-PAT rule on interface VLAN-interface 10. NAT translates the source addresses of incoming packets into the addresses in address group 1, and automatically adds routes for translated packets. Set the rule name to abc, and the priority to 0.

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] nat inbound 2001 address-group 1 no-pat add-route rule abc priority 0

Related commands

display nat all

display nat inbound

display nat no-pat

nat inbound rule move

Use nat inbound rule move to change the priority of an inbound dynamic NAT rule.

Syntax

nat inbound rule move nat-rule-name1 { after | before } nat-rule-name2

Views

Interface view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the rule be moved.

after: Moves the rule nat-rule-name1 to the line after the rule nat-rule-name2 (called the reference rule). The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule plus one.

before: Moves the rule nat-rule-name1 to the line before the rule nat-rule-name2. The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule minus one.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named inbound dynamic NAT rules.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the inbound dynamic NAT rule abc to the line before the rule def.

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] nat inbound rule move abc before def

Related commands

nat inbound

nat log alarm

Use nat log alarm to enable NAT alarm logging.

Use undo nat log alarm to disable NAT alarm logging.

Syntax

nat log alarm

undo nat log alarm

Default

NAT alarm logging is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Packets that need to be translated are dropped if the NAT resources are not enough. In NO-PAT, the NAT resources refer to the public IP addresses. In EIM PAT, the NAT resources refer to public IP addresses and ports. NAT alarm logging monitors the usage of NAT resources and outputs logs if the NAT resources are not enough.

Before configuring alarm logging for NAT, you must configure the custom NAT log generation and outputting features. For more information about information center, see System Management Configuration Guide.

This command take effect only after you use the nat log enable command to enable NAT logging.

Examples

# Enable NAT alarm logging.

<Sysname> system-view

[Sysname] nat log alarm

Related commands

display nat all

display nat log

nat log enable

nat log enable

Use nat log enable to enable NAT logging.

Use undo nat log enable to disable NAT logging.

Syntax

nat log enable [ acl { ipv4-acl-number | name ipv4-acl-name } ]

undo nat log enable

Default

NAT logging is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

acl: Specifies an ACL.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

Usage guidelines

You must enable NAT logging before you enable NAT session logging or NAT alarm logging.

The acl keyword takes effect only for NAT session logging. If an ACL is specified, flows matching the permit rule might trigger NAT session logs. If you do not specify an ACL, all flows processed by NAT might trigger NAT session logs.

Examples

# Enable NAT logging.

<Sysname> system-view

[Sysname] nat log enable

Related commands

display nat all

display nat log

nat log alarm

nat log flow-active

nat log flow-begin

nat log flow-end

nat log flow-active

Use nat log flow-active to enable logging for active NAT flows and set the logging interval.

Use undo nat log flow-active to disable logging for active NAT flows.

Syntax

nat log flow-active time-value

undo nat log flow-active

Default

Logging for active NAT flows is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

time-value: Specifies the interval for logging active NAT flows, in the range of 10 to 120 minutes.

Usage guidelines

Active NAT flows are NAT sessions that last for a long time. The logging feature helps track active NAT flows by periodically logging the active NAT flows.

Logging for active NAT flows takes effect only after you enable NAT logging.

Examples

# Enable logging for active NAT flows and set the logging interval to 10 minutes.

<Sysname> system-view

[Sysname] nat log flow-active 10

Related commands

display nat all

display nat log

nat log enable

nat log flow-begin

Use nat log flow-begin to enable logging for NAT session establishment events.

Use undo nat log flow-begin to disable logging for NAT session establishment events.

Syntax

nat log flow-begin

undo nat log flow-begin

Default

Logging for NAT session establishment events is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Logging for NAT session establishment events takes effect only after you enable NAT logging.

Examples

# Enable logging for NAT session establishment events.

<Sysname> system-view

[Sysname] nat log flow-begin

Related commands

display nat all

display nat log

nat log enable

nat log flow-end

Use nat log flow-end to enable logging for NAT session removal events.

Use undo nat log flow-end to disable logging for NAT session removal events.

Syntax

nat log flow-end

undo nat log flow-end

Default

Logging for NAT session removal events is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Logging for NAT session removal events takes effect only after you enable NAT logging.

Examples

# Enable logging for NAT session removal events.

<Sysname> system-view

[Sysname] nat log flow-end

Related commands

display nat all

display nat log

nat log enable

nat mapping-behavior endpoint-independent

Use nat mapping-behavior endpoint-independent to specify the Endpoint-Independent Mapping (EIM) mode for PAT.

Use undo nat mapping-behavior to restore the default.

Syntax

nat mapping-behavior endpoint-independent [ acl { ipv4-acl-number | name ipv4-acl-name } ]

undo nat mapping-behavior endpoint-independent

Default

Address and Port-Dependent Mapping applies.

Views

System view

Predefined user roles

network-admin

Parameters

acl: Specifies an ACL to define the applicable scope of Endpoint-Independent Mapping.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

Usage guidelines

PAT supports the following NAT mapping modes:

·     Endpoint-Independent Mapping—Uses the same IP and port mapping (EIM entry) for packets from the same source and port to any destination. EIM allows external hosts to access the internal hosts by using the translated IP address and port. It allows internal hosts behind different NAT gateways to access each other.

·     Address and Port-Dependent Mapping—Uses different IP and port mappings for packets with the same source IP and port to different destination IP addresses and ports. APDM allows an external host to access an internal host only under the condition that the internal host has previously accessed the external host. It is secure, but it does not allow internal hosts behind different NAT gateways to access each other.

This command takes effect only on outbound PAT. Address and Port-Dependent Mapping always applies to inbound PAT.

If you specify an ACL, Endpoint-Independent Mapping applies to packets that are permitted by the ACL. If you do not specify an ACL, Endpoint-Independent Mapping applies to all packets.

Examples

# Apply the Endpoint-Independent Mapping mode to all packets for address translation.

<Sysname> system-view

[Sysname] nat mapping-behavior endpoint-independent

# Apply the Endpoint-Independent Mapping mode to FTP and HTTP packets, and the Address and Port-Dependent Mapping mode to other packets for address translation.

<Sysname> system-view

[Sysname] acl advanced 3000

[Sysname-acl-ipv4-adv-3000] rule permit tcp destination-port eq 80

[Sysname-acl-ipv4-adv-3000] rule permit tcp destination-port eq 21

[Sysname-acl-ipv4-adv-3000] quit

[Sysname] nat mapping-behavior endpoint-independent acl 3000

Related commands

nat outbound

display nat eim

nat outbound

Use nat outbound to configure an outbound dynamic NAT rule.

Use undo nat outbound to delete an outbound dynamic NAT rule.

Syntax

NO-PAT:

nat outbound [ ipv4-acl-number | name ipv4-acl-name ] address-group { group-id | name group-name } no-pat [ reversible ] [ rule rule-name ] [ priority priority ] [ disable ] [ description text ] [ counting ]

undo nat outbound [ ipv4-acl-number | name ipv4-acl-name ]

PAT:

nat outbound [ ipv4-acl-number | name ipv4-acl-name ] [ address-group { group-id | name group-name } ] [ port-preserved ] [ rule rule-name ] [ priority priority ] [ disable ] [ description text ] [ counting ]

undo nat outbound [ ipv4-acl-number | name ipv4-acl-name ]

Default

No outbound dynamic NAT rules exist.

Views

Interface view

Predefined user roles

network-admin

Parameters

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

address-group: Specifies an address group for NAT. If you do not specify an address group, the IP address of the interface is used as the NAT address. Easy IP is used.

group-id: Specifies the address group ID. The value range for this argument is 0 to 65535.

name group-name: Specifies the address group name, a case-insensitive string of 1 to 63 characters.

no-pat: Uses the NO-PAT mode. If you do not specify this keyword, PAT is used. PAT only supports TCP, UDP, and ICMP query packets. For an ICMP packet, the ICMP ID is used as its source port number.

reversible: Enables reverse address translation. Reverse address translation uses existing NO-PAT entries to translate the destination address for connections actively initiated from the external network to the internal network.

port-preserved: Tries to preserve port number for PAT.

rule rule-name: Specifies a name for the rule, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the rule does not have a name.

priority priority: Specifies a priority for the rule, in the range of 0 to 2147483647. A smaller value represents a higher priority. If you do not specify this option, the rule has the lowest priority among the same type of NAT rules.

disable: Disables the outbound dynamic NAT rule. If you do not specify this keyword, the rule is enabled.

description text: Specifies a description for the outbound dynamic NAT rule. The text argument is a case-insensitive string of 1 to 63 characters.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

Outbound dynamic NAT is typically configured on the interface connected to the external network. You can configure multiple outbound dynamic NAT rules on an interface.

Outbound dynamic NAT supports the following modes:

·     PAT—Performs both IP address translation and port translation. The PAT mode allows external hosts to actively access the internal hosts if the Endpoint-Independent Mapping behavior is used.

·     NO-PAT—Performs only IP address translation. The NO-PAT mode allows external hosts to actively access the internal hosts if you specify the reversible keyword. If an ACL is specified, reverse address translation only applies to packets permitted by ACL reverse matching. ACL reverse matching works as follows:

¡     Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡     Translates the destination IP address of the packet according to the matching NO-PAT entry, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

When you specify a NAT address group, follow these restrictions and guidelines:

·     An address group cannot be used by both the nat inbound and nat outbound commands.

·     An address group cannot be used by the nat outbound command in both PAT and NO-PAT modes.

When you specify an ACL, follow these restrictions and guidelines:

·     An ACL can be used by only one outbound dynamic NAT rule on an interface.

·     If you specify an ACL, NAT translates the source IP addresses of outgoing packets permitted by the ACL into IP addresses in the address group. If you do not specify an ACL, NAT translates all packets.

·     Outbound dynamic NAT rules with ACLs configured on an interface takes precedence over those without ACLs. If two ACL-based dynamic NAT rules are configured, the rule with the higher ACL number has higher priority.

Outbound dynamic NAT rules configured with the same priority value and an ACL are matched by using the ACLs in the rule.

·     NAT rules with named ACLs have higher priorities than NAT rules with unnamed ACLs.

·     NAT rules with named ACLs are matched in alphabetical order of their ACL names.

·     NAT rules with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure ACL 2001 to permit packets only from subnet 10.110.10.0/24 to pass through.

<Sysname> system-view

[Sysname] acl basic 2001

[Sysname-acl-ipv4-basic-2001] rule permit source 10.110.10.0 0.0.0.255

[Sysname-acl-ipv4-basic-2001] rule deny

[Sysname-acl-ipv4-basic-2001] quit

# Create address group 1 and add the address range of 202.110.10.10 to 202.110.10.12 to the group.

[Sysname] nat address-group 1

[Sysname-address-group-1] address 202.110.10.10 202.110.10.12

[Sysname-address-group-1] quit

# Configure an outbound dynamic PAT rule on interface VLAN-interface 10 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1.

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] nat outbound 2001 address-group 1

[Sysname-Vlan-interface10] quit

Or

# Configure an outbound NO-PAT rule on interface VLAN-interface 10 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1.

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] nat outbound 2001 address-group 1 no-pat

[Sysname-Vlan-interface10] quit

Or

# Enable Easy IP to use the IP address of VLAN-interface 10 as the translated address.

[Sysname] interface Vlan-interface 10

[Sysname-Vlan-interface10] nat outbound 2001

[Sysname-Vlan-interface10] quit

Or

# Configure an outbound NO-PAT rule on VLAN-interface 10 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1. Enable reverse address translation.

[Sysname] interface Vlan-interface 10

[Sysname-Vlan-interface10] nat outbound 2001 address-group 1 no-pat reversible

Related commands

display nat eim

display nat outbound

nat mapping-behavior

nat outbound rule move

Use nat outbound rule move to change the priority of an outbound dynamic NAT rule.

Syntax

nat outbound rule move nat-rule-name1 { after | before } nat-rule-name2

Views

Interface view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

after: Moves the rule nat-rule-name1 to the line after the rule nat-rule-name2 (called the reference rule). The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule plus one.

before: Moves the rule nat-rule-name1 to the line before the rule nat-rule-name2. The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule minus one.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named outbound dynamic NAT rules.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the outbound dynamic NAT rule abc to the line before the rule def.

<Sysname> system-view

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] nat outbound rule move abc before def

Related commands

nat outbound

nat static enable

Use nat static enable to enable static NAT on an interface.

Use undo nat static enable to disable static NAT on an interface.

Syntax

nat static enable

undo nat static enable

Default

Static NAT is disabled.

Views

Interface view

Predefined user roles

network-admin

Usage guidelines

Static NAT mappings take effect on an interface only after static NAT is enabled on the interface.

Examples

# Configure an outbound static NAT mapping between private IP address 192.168.1.1 and public IP address 2.2.2.2, and enable static NAT on VLAN-interface 10.

<Sysname> system-view

[Sysname] nat static outbound 192.168.1.1 2.2.2.2

[Sysname] interface vlan-interface 10

[Sysname-Vlan-interface10] nat static enable

Related commands

display nat all

display nat static

nat static

nat static net-to-net

nat static inbound

Use nat static inbound to configure a one-to-one mapping for inbound static NAT.

Use undo nat static inbound to delete a one-to-one mapping for inbound static NAT.

Syntax

nat static inbound global-ip local-ip [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ]

undo nat static inbound global-ip local-ip

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

global-ip: Specifies a public IP address.

local-ip: Specifies a private IP address.

acl: Specifies an ACL to identify the internal hosts that can access the external network.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the internal network to the private IP address.

rule rule-name: Specifies a name for the mapping, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the mapping does not have a name.

priority priority: Specifies a priority for the mapping, in the range of 0 to 2147483647. A smaller value represents a higher priority. If you do not specify this option, the mapping has the lowest priority among the same type of NAT rules.

disable: Disables the one-to-one inbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

When the source IP address of a packet from the external network to the internal network matches the global-ip, the source IP address is translated into the local-ip. When the destination IP address of a packet from the internal network to the external network matches the local-ip, the destination IP address is translated into the global-ip.

When you specify an ACL, follow these restrictions and guidelines:

·     If you do not specify an ACL, the source address of all incoming packets and the destination address of all outgoing packets are translated.

·     If you specify an ACL and do not specify the reversible keyword, the source address of incoming packets permitted by the ACL is translated. The destination address is not translated for connections actively initiated from the internal network to the private IP address.

·     If you specify both an ACL and the reversible keyword, the source address of incoming packets permitted by the ACL is translated. If packets of connections actively initiated from the internal network to the private IP address are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡     Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡     Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when both are configured on an interface.

You can configure multiple inbound static NAT mappings by using the nat static inbound command and the nat static inbound net-to-net command.

One-to-one mappings for inbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

·     Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

·     Mappings with named ACLs are matched in alphabetical order of their ACL names.

·     Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an inbound static NAT mapping between public IP address 2.2.2.2 and private IP address 192.168.1.1.

<Sysname> system-view

[Sysname] nat static inbound 2.2.2.2 192.168.1.1

Related commands

display nat all

display nat static

nat static enable

nat static inbound net-to-net

Use nat static inbound net-to-net to configure a net-to-net mapping for inbound static NAT.

Use undo nat static inbound net-to-net to remove a net-to-net mapping for inbound static NAT.

Syntax

nat static inbound net-to-net global-start-address global-end-address local local-network { mask-length | mask } [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ]

undo nat static inbound net-to-net global-start-address global-end-address local local-network { mask-length | mask }

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

global-start-address global-end-address: Specifies a public address range which can contain a maximum of 255 addresses. The global-end-address must not be lower than global-start-address. If they are the same, only one public address is specified.

local-network: Specifies a private network address.

mask-length: Specifies the mask length of the private network address, in the range of 8 to 31.

mask: Specifies the mask of the private network address.

acl: Specifies an ACL to identify the internal hosts that can access the external network.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the internal network to the private IP addresses.

rule rule-name: Specifies a name for the mapping, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the mapping does not have a name.

priority priority: Specifies a priority for the mapping, in the range of 0 to 2147483647. A smaller value represents a higher priority. If you do not specify this option, the mapping has the lowest priority among the same type of NAT rules.

disable: Disables the net-to-net inbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

Specify a public network through a start address and an end address, and a private network through a private address and a mask.

When the source address of a packet from the external network matches the public address range, the source address is translated into a private address in the private address range. When the destination address of a packet from the internal network matches the private address range, the destination address is translated into a public address in the public address range.

The public end address cannot be greater than the greatest IP address in the subnet determined by the public start address and the private network mask. For example, if the private address is 2.2.2.0 with a mask 255.255.255.0 and the public start address is 1.1.1.100, the public end address cannot be greater than 1.1.1.255, the greatest IP address in the subnet 1.1.1.0/24.

When you specify an ACL, follow these restrictions and guidelines:

·     If you do not specify an ACL, the source address of all incoming packets and the destination address of all outgoing packets are translated.

·     If you specify an ACL and do not specify the reversible keyword, the source address of incoming packets permitted by the ACL is translated. The destination address is not translated for connections actively initiated from the internal network to the private IP addresses.

·     If you specify both an ACL and the reversible keyword, the source address of incoming packets permitted by the ACL is translated. If packets of connections actively initiated from the internal network to the private IP addresses are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡     Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡     Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when both are configured on an interface.

You can configure multiple inbound static NAT mappings by using the nat static inbound command and the nat static inbound net-to-net command.

Net-to-net mappings for inbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

·     Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

·     Mappings with named ACLs are matched in alphabetical order of their ACL names.

·     Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an inbound static NAT between public network address 202.100.1.0/24 and private network address 192.168.1.0/24.

<Sysname> system-view

[Sysname] nat static inbound net-to-net 202.100.1.1 202.100.1.255 local 192.168.1.0 24

Related commands

display nat all

display nat static

nat static enable

nat static inbound rule move

Use nat static inbound rule move to change the priority of an inbound one-to-one static NAT rule.

Syntax

nat static inbound rule move nat-rule-name1 { after | before } nat-rule-name2

Views

System view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

after: Moves the rule nat-rule-name1 to the line after the rule nat-rule-name2 (called the reference rule). The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule plus one.

before: Moves the rule nat-rule-name1 to the line before the rule nat-rule-name2. The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule minus one.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named inbound one-to-one static NAT rules.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the inbound one-to-one static NAT rule abc to the line before the inbound one-to-one static NAT rule def.

<Sysname> system-view

[Sysname] nat static inbound rule move abc before def

Related commands

nat static inbound

nat static outbound

Use nat static outbound to configure a one-to-one mapping for outbound static NAT.

Use undo nat static outbound to remove a one-to-one mapping for outbound static NAT.

Syntax

nat static outbound local-ip global-ip [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ]

undo nat static outbound local-ip global-ip

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

local-ip: Specifies a private IP address.

global-ip: Specifies a public IP address.

acl: Specifies an ACL to define the destination IP addresses that internal hosts can access.

ipv4-acl-number: Specifies an ACL by its number in the range of 3000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the external network to the public IP address.

rule rule-name: Specifies a name for the mapping, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the mapping does not have a name.

priority priority: Specifies a priority for the mapping, in the range of 0 to 2147483647. A smaller value represents a higher priority. If you do not specify this option, the mapping has the lowest priority among the same type of NAT rules.

disable: Disables the one-to-one outbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

When the source IP address of an outgoing packet matches the local-ip, the IP address is translated into the global-ip. When the destination IP address of an incoming packet matches the global-ip, the destination IP address is translated into the local-ip.

When you specify an ACL, follow these restrictions and guidelines:

·     If you do not specify an ACL, the source address of all outgoing packets and the destination address of all incoming packets are translated.

·     If you specify an ACL and do not specify the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. The destination address is not translated for connections actively initiated from the external network to the public IP address.

·     If you specify both an ACL and the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. If packets of connections actively initiated from the external network to the public IP address are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡     Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡     Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when they are both configured on an interface.

You can configure multiple outbound static NAT mappings by using the nat static outbound command and the nat static outbound net-to-net command.

One-to-one mappings for outbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

·     Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

·     Mappings with named ACLs are matched in alphabetical order of their ACL names.

·     Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an outbound static NAT mapping between public IP address 2.2.2.2 and private IP address 192.168.1.1.

<Sysname> system-view

[Sysname] nat static outbound 192.168.1.1 2.2.2.2

# Configure outbound static NAT, and allow the internal user 192.168.1.1 to access the external network 3.3.3.0/24 by using the public IP address 2.2.2.2.

<Sysname> system-view

[Sysname] acl advanced 3001

[Sysname-acl-ipv4-adv-3001] rule permit ip destination 3.3.3.0 0.0.0.255

[Sysname-acl-ipv4-adv-3001] quit

[Sysname] nat static outbound 192.168.1.1 2.2.2.2 acl 3001

Related commands

display nat all

display nat static

nat static enable

nat static outbound net-to-net

Use nat static outbound net-to-net to configure a net-to-net outbound static NAT mapping.

Use undo nat static outbound net-to-net to remove the specified net-to-net outbound static NAT mapping.

Syntax

nat static outbound net-to-net local-start-address local-end-address global global-network { mask-length | mask } [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ]

undo nat static outbound net-to-net local-start-address local-end-address global global-network { mask-length | mask }

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

local-start-address local-end-address: Specifies a private address range which can contain a maximum of 255 addresses. The local-end-address must not be lower than local-start-address. If they are the same, only one private address is specified.

global-network: Specifies a public network address.

mask-length: Specifies the mask length of the public network address, in the range of 8 to 31.

mask: Specifies the mask of the public network address.

acl: Specifies an ACL to define the destination IP addresses that internal hosts can access.

ipv4-acl-number: Specifies an ACL number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the external network to the public IP addresses.

rule rule-name: Specifies a name for the mapping, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the mapping does not have a name.

priority priority: Specifies a priority for the mapping, in the range of 0 to 2147483647. A smaller value represents a higher priority. If you do not specify this option, the mapping has the lowest priority among the same type of NAT rules.

disable: Disables the net-to-net outbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

Specify a private network through a start address and an end address, and a public network through a public address and a mask.

When the source address of a packet from the internal network matches the private address range, the source address is translated into a public address in the public address range. When the destination address of a packet from the external network matches the public address range, the destination address is translated into a private address in the private address range.

The private end address cannot be greater than the greatest IP address in the subnet determined by the private start address and the public network mask. For example, the public address is 2.2.2.0 with a mask 255.255.255.0, and the private start address is 1.1.1.100. The private end address cannot be greater than 1.1.1.255, the greatest IP address in the subnet 1.1.1.0/24.

When you specify an ACL, follow these restrictions and guidelines:

·     If you do not specify an ACL, the source address of all outgoing packets and the destination address of all incoming packets are translated.

·     If you specify an ACL and do not specify the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. The destination address is not translated for connections actively initiated from the external network to the public IP addresses.

·     If you specify both an ACL and the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. If packets of connections actively initiated from the external network to the public IP addresses are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡     Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡     Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when they are both configured on an interface.

You can configure multiple outbound static NAT mappings by using the nat static outbound command and the nat static outbound net-to-net command.

Net-to-net mappings for outbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

·     Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

·     Mappings with named ACLs are matched in alphabetical order of their ACL names.

·     Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an outbound static NAT mapping between private network address 192.168.1.0/24 and public network address 2.2.2.0/24.

<Sysname> system-view

[Sysname] nat static outbound net-to-net 192.168.1.1 192.168.1.255 global 2.2.2.0 24

# Configure outbound static NAT. Allow internal users on subnet 192.168.1.0/24 to access the external subnet 3.3.3.0/24 by using public IP addresses on subnet 2.2.2.0/24.

<Sysname> system-view

[Sysname] acl advanced 3001

[Sysname-acl-ipv4-adv-3001] rule permit ip destination 3.3.3.0 0.0.0.255

[Sysname-acl-ipv4-adv-3001] quit

[Sysname] nat static outbound net-to-net 192.168.1.1 192.168.1.255 global 2.2.2.0 24 acl 3001

Related commands

display nat all

display nat static

nat static enable

nat static outbound rule move

Use nat static outbound rule move to change the priority of an outbound one-to-one static NAT rule.

Syntax

nat static outbound rule move nat-rule-name1 { after | before } nat-rule-name2

Views

System view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

after: Moves the rule nat-rule-name1 to the line after the rule nat-rule-name2 (called the reference rule). The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule plus one.

before: Moves the rule nat-rule-name1 to the line before the rule nat-rule-name2. The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule minus one.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named outbound one-to-one static NAT rules..

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the outbound one-to-one static NAT rule abc to the line before the outbound one-to-one static NAT rule def.

<Sysname> system-view

[Sysname] nat static outbound rule move abc before def

Related commands

nat static outbound

reset nat count statistics

Use reset nat count statistics to clear NAT counting statistics.

Syntax

reset nat count statistics { all | dynamic | static }

Views

User view

Predefined user roles

network-admin

Parameters

all: Clears all counting statistics for NAT mappings.

dynamic: Clears counting statistics for dynamic NAT mappings.

static: Clears counting statistics for static NAT mappings.

Examples

# Clear all counting statistics for static NAT mappings.

<Sysname> reset nat count statistics all

Related commands

display nat inbound

display nat outbound

display nat static

reset nat session

Use reset nat session to clear NAT sessions.

Syntax

reset nat session

Views

User view

Predefined user roles

network-admin

Parameters

Examples

# Clear all NAT sessions.

<Sysname> reset nat session

Related commands

display nat session