- Related Documents
-
Title | Size | Download |
---|---|---|
01-H3C_NAT_Configuration_Examples | 74.48 KB |
|
H3C NAT Configuration Examples |
|
|
|
Software version: Release 7951P01
Document version: 6W100-20200625
Copyright © 2020 New H3C Technologies Co., Ltd. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.
The information in this document is subject to change without notice.
Contents
Introduction
This document provides NAT configuration examples.
Prerequisites
This document is not restricted to specific software or hardware versions.
The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
The following information is provided based on the assumption that you have basic knowledge of NAT.
Restrictions and guidelines
NAT is available on service modules except CSPC-CP2LB.
A QoS policy is required on an interface to redirect the incoming traffic to the NAT-capable service module specified for the traffic outbound interface. For more information about QoS policies, see ACL and QoS Configuration Guide.
Example: Configuring NAT
Network configuration
As shown in Figure 1, the internal users use the IP addresses in the range of 10.110.0.0 to 10.110.2.255. The private IP addresses of the FTP servers are from 10.110.3.1 to 10.110.3.3. These servers provide FTP services to external users. The company has three public IP addresses from 61.16.0.1 to 61.16.0.3.
Configure NAT on the device to implement the following:
· Allow the internal and external users to use the IP address 61.16.0.1 to access the FTP servers.
· Implement load sharing among the FTP servers and do not allow connections that are initiated by the FTP servers to the external network.
Analysis
· To translate IP addresses in the range of 10.110.0.0 to 10.110.2.255 into IP addresses in the range of 61.16.0.2 to 61.16.0.3, configure an ACL to identify these packets. Then configure outbound address translation on packets identified by the ACL on GigabitEthernet 3/1/2.
· To allow three FTP servers to load share services, configure NAT server group to implement load sharing.
· To allow internal hosts to access the internal FTP server by using a public IP address, enable AT hairpin on GigabitEthernet 3/1/1 of the device.
Procedures
Specifying IP addresses for the interfaces
# Specify IP addresses for GigabitEthernet 3/1/1 and GigabitEthernet 3/1/2.
<Device> system-view
[Device] interface gigabitethernet 3/1/1
[Device-GigabitEthernet3/1/1] ip address 10.110.0.1 255.255.252.0
[Device-GigabitEthernet3/1/1] quit
[Device] interface gigabitethernet 3/1/2
[Device-GigabitEthernet3/1/2] ip address 61.16.0.1 255.255.255.0
[Device-GigabitEthernet3/1/2] quit
Configuring outbound NAT for internal users
# Configure NAT address group 0, and add public IP address 61.16.0.2 and 61.16.0.3 to the group.
[Device-nat-address-group-0] address 61.16.0.2 61.16.0.3
[Device-nat-address-group-0] quit
# Configure ACL 2000 to identify packets only from subnet 10.110.0.0 to 10.110.2.255.
[Device-acl-ipv4-basic-2000] rule permit source 10.110.0.0 0.0.1.255
[Device-acl-ipv4-basic-2000] rule permit source 10.110.2.0 0.0.0.255
[Device-acl-ipv4-basic-2000] quit
[Device] interface gigabitethernet 3/1/2
[Device-GigabitEthernet3/1/2] nat outbound 2000 address-group 0
[Device-GigabitEthernet3/1/2] quit
Implementing load sharing among FTP servers
# Create NAT server group 0, and add servers at 10.110.3.1, 10.110.3.2, 10.110.3.3 to the group.
[Device-nat-server-group-0] inside ip 10.110.3.1 port 21
[Device-nat-server-group-0] inside ip 10.110.3.2 port 21
[Device-nat-server-group-0] inside ip 10.110.3.3 port 21
[Device-nat-server-group-0] quit
[Device] interface gigabitethernet 3/1/2
[Device-GigabitEthernet3/1/2] nat server protocol tcp global 61.16.0.1 ftp inside server-group 0
# Enable NAT hairpin on GigabitEthernet 3/1/1.
[Device] interface gigabitethernet 3/1/1
[Device-GigabitEthernet3/1/1] nat hairpin enable
Specifying a NAT-capable service module to provide NAT service
# Specify the service module in slot 4 to provide the NAT service for GigabitEthernet 3/1/1.
[Device-GigabitEthernet3/1/1] nat service slot 4
[Device-GigabitEthernet3/1/1] quit
# Specify the service module in slot 4 to provide the NAT service for GigabitEthernet 3/1/2.
[Device] interface gigabitethernet 3/1/2
[Device-GigabitEthernet3/1/2] nat service slot 4
[Device-GigabitEthernet3/1/2] quit
Configuring a QoS policy to redirect traffic to the NAT-capable service module
# Configure ACL 2001 to identify packets to be redirected to the NAT-capable service module. In this example, the packets are those to be translated, therefore, define the same ACL rules as those in ACL 2000.
[Device] acl basic 2001
[Device-acl-ipv4-basic-2001] rule permit source 10.110.0.0 0.0.1.255
[Device-acl-ipv4-basic-2001] rule permit source 10.110.2.0 0.0.0.255
[Device-acl-ipv4-basic-2001] quit
# Create traffic class 1 and define a match criterion for the traffic class to match ACL 2001.
[Device] traffic classifier 1
[Device-classifier-1] if-match acl 2001
[Device-classifier-1] quit
# Create traffic behavior 1 and configure redirecting traffic to slot 4 in the traffic behavior 1.
[Device] traffic behavior 1
[Device-behavior-1] redirect slot 4
[Device-behavior-1] quit
# Create QoS policy 1 and associate traffic class 1 with traffic behavior 1 in the QoS policy.
[Device] qos policy 1
[Device-qospolicy-1] classifier 1 behavior 1
[Device-qospolicy-1] quit
# Apply the QoS policy to the inbound direction of GigabitEthernet 3/1/1.
[Device] interface Gigabitethernet 3/1/1
[Device-GigabitEthernet3/1/1] qos apply policy 1 inbound
[Device-GigabitEthernet3/1/1] quit
Verifying the configuration
# Access the WWW server from PC 1. Verify that a NAT session is created on the device.
[Device] display nat session verbose
Initiator:
Source IP/port: 10.110.1.10/1024
Destination IP/port: 200.1.1.10/80
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/1
Responder:
Source IP/port: 200.1.1.10/80
Destination IP/port: 61.16.0.2/1025
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/2
State: TCP_CLOSE
Application: HTTP
Role: -
Failover group ID: -
Start time: 2014-07-08 13:30:47
Initiator->Responder: 0 packets 0 bytes
Responder->Initiator: 0 packets 0 bytes
Total sessions found: 1
# Use two external hosts at the IP address of 61.16.0.10 and 61.16.0.11 to request FTP services at the same time. On the device, verify that two NAT sessions are created, and FTP server 1 and FTP server 2 provide FTP services for the two hosts, respectively.
[Device] display nat session verbose
Initiator:
Source IP/port: 61.16.0.11/1024
Destination IP/port: 61.16.0.1/21
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/2
Responder:
Source IP/port: 10.110.3.1/21
Destination IP/port: 61.16.0.11/1024
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/1
State: TCP_ESTABLISHED
Application: FTP
Role: -
Failover group ID: -
Start time: 2014-07-08 14:11:41
Initiator->Responder: 0 packets 0 bytes
Responder->Initiator: 0 packets 0 bytes
Initiator:
Source IP/port: 61.16.0.10/1024
Destination IP/port: 61.16.0.1/21
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/2
Responder:
Source IP/port: 10.110.3.2/21
Destination IP/port: 61.16.0.10/1024
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/1
State: TCP_ESTABLISHED
Application: FTP
Role: -
Failover group ID: -
Start time: 2014-07-08 14:12:00
Initiator->Responder: 0 packets 0 bytes
Responder->Initiator: 0 packets 0 bytes
Total sessions found: 2
# Access an FTP server through 61.16.0.1 from PC 1. Verify that a NAT session is created.
[Device] display nat session verbose
Initiator:
Source IP/port: 10.110.1.10/1024
Destination IP/port: 61.16.0.1/21
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/1
Responder:
Source IP/port: 10.110.3.1/21
Destination IP/port: 61.16.0.2/1025
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet3/1/1
State: TCP_ESTABLISHED
Application: FTP
Role: -
Failover group ID: -
Start time: 2014-07-08 14:24:15
Initiator->Responder: 0 packets 0 bytes
Responder->Initiator: 0 packets 0 bytes
Total sessions found: 1
Configuration files
#
traffic classifier 1 operator and
if-match acl 2001
#
traffic behavior 1
redirect slot 4
#
qos policy 1
classifier 1 behavior 1
#
interface GigabitEthernet3/1/1
ip address 10.110.0.1 255.255.252.0
qos apply policy 1 inbound
nat hairpin enable
nat service slot 4
#
interface GigabitEthernet3/1/2
ip address 61.16.0.1 255.255.255.0
nat outbound 2000 address-group 0
nat server protocol tcp global 61.16.0.1 21 inside server-group 0
#
acl basic 2000
rule 0 permit source 10.110.0.0 0.0.1.255
rule 5 permit source 10.110.2.0 0.0.0.255
#
acl basic 2001
rule 0 permit source 10.110.0.0 0.0.1.255
rule 5 permit source 10.110.2.0 0.0.0.255
#
address 61.16.0.2 61.16.0.3
#
nat server-group 0
inside ip 10.110.3.1 port 21
inside ip 10.110.3.2 port 21
inside ip 10.110.3.3 port 21
#
Related documentation
· H3C CR16000-F Routers NAT Configuration Guide-R7951P01
· H3C CR16000-F Routers NAT Command Reference-R7951P01