H3C Access Points
Comware 7 NAT Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document version: 6W100-20201125

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring NAT· 1

Network configuration· 1

Restrictions and guidelines· 1

Procedures· 2

Configuring fat AP· 2

Verifying the configuration· 3

Configuration files· 4

Related documentation· 5

 

Introduction

The following information provides an example for configuring NAT.

Prerequisites

This document applies to Comware 7-based fat APs. Procedures and information in the examples might be slightly different depending on the software or hardware version of the fat APs.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of NAT.

Example: Configuring NAT

Network configuration

As shown in Figure 1, the wireless clients access the network through the fat AP. The fat AP obtains an IP address through a DHCP server in the IP network.

To allow the internal wireless clients to access the external network, it is required to perform the following configuration:

·     Configure the fat AP to act as the DHCP server to assign IP addresses to the wireless clients.

·     Configure outbound NAT on the fat AP to perform address translation for wireless clients.

Figure 1 Network diagram

 

Restrictions and guidelines

By default, the device uses the default service template (template 1) with SSID H3C to provide wireless services. To use user-defined wireless service settings, disable or delete the default service template. In this example, the service template is disabled.

Procedures

Configuring fat AP

1.     Configure VLANs and VLAN interfaces on the fat AP:

# Create VLAN 100 and VLAN interface, and assign an IP address to the VLAN interface.

<FAT AP> system-view

[FAT AP] vlan 100

[FAT AP-vlan100] quit

[FAT AP] interface vlan-interface 100

[FAT AP-Vlan-interface100] ip address 192.1.0.1 24

[FAT AP-Vlan-interface100] quit

# Configure the upstream interface VLAN-interface 1 to obtain an IP address through DHCP.

[FAT AP] interface vlan-interface 1

[FAT AP-Vlan-interface1] undo ip address

[FAT AP-Vlan-interface1] ip address dhcp-alloc

[FAT AP-Vlan-interface1] quit

2.     Configure the wireless service template:

# Enter the view of service template 1 and disable the template.

[FAT AP] wlan service-template 1

[FAT AP-wlan-st-1] undo service-template enable

[FAT AP-wlan-st-1] quit

# Create service template service and enter its view.

[FAT AP] wlan service-template service

# Configure service as the SSID.

[FAT AP-wlan-st-service] ssid service

# Assign clients coming online through service template 100 to VLAN 100.

[FAT AP-wlan-st-service] vlan 100

# Enable the service template.

[FAT AP-wlan-st-service] service-template enable

[FAT AP-wlan-st-service] quit

# Enter interface view of WLAN-Radio 1/0/1.

[FAT AP] interface wlan-radio 1/0/1

# Bind service template service to interface WLAN-Radio 1/0/1.

[FAT AP-WLAN-Radio1/0/1] service-template service

[FAT AP-WLAN-Radio1/0/1] quit

3.     Configure the DHCP server:

# Configure DHCP address pool 100 for address allocation to the wireless clients.

[FAT AP] dhcp server ip-pool 100

[FAT AP-dhcp-pool-100] network 192.1.0.0 mask 255.255.255.0

[FAT AP-dhcp-pool-100] gateway-list 192.1.0.1

[FAT AP-dhcp-pool-100] quit

# Enable the DHCP service.

[FAT AP] dhcp enable

4.     Configure NAT:

# Configure ACL 2000 to identify packets source from 192.1.0.0.

[FAT AP] acl basic 2000

[FAT AP-acl-ipv4-basic-2000] rule 0 permit source 192.1.0.0 0.0.0.255

[FAT AP-acl-ipv4-basic-2000] quit

# Configure an outbound dynamic PAT rule on VLAN-interface 1 to translate the source IP addresses permitted by ACL 2000

[FAT AP] interface vlan-interface 1

[FAT AP-Vlan-interface1] nat outbound 2000

[FAT AP-Vlan-interface1] quit

Verifying the configuration

# Display client information on the fat AP.

[FAT AP] display wlan client

Total number of clients: 1

MAC address    User name         AP name               RID  IP address      VLAN

bc6c-2213-7cb7 N/A               fatap                 1    192.1.0.2       100

# Verify that VLAN-interface 1 has obtained an IP address through DHCP.

[FAT AP] display dhcp client interface vlan-interface 1

Vlan-interface1 DHCP client information:

  Current state: BOUND

  Allocated IP: 2.2.2.2 255.255.255.0

  Allocated lease: 86400 seconds, T1: 36532 seconds, T2: 75600 seconds

  DHCP server: 2.2.2.1

# Ping the DHCP server at 2.2.2.1 from a client. On the fat AP, display NAT session information.

 [FAT AP] display nat session verbose

Initiator:

  Source      IP/port: 192.1.0.2/768

  Destination IP/port: 2.2.2.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Vlan-interface100

Responder:

  Source      IP/port: 2.2.2.1/1

  Destination IP/port: 2.2.2.2/0

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Vlan-interface1

State: ICMP_REPLY

Application: ICMP

Rule ID: -/-/-

Rule name:

Start time: 2016-01-01 05:27:35  TTL: 7s

Initiator->Responder:            0 packets          0 bytes

Responder->Initiator:            0 packets          0 bytes

Total sessions found: 1

Configuration files

#

 sysname FAT AP

#

 dhcp enable

#

vlan 1

#

vlan 100

#

dhcp server ip-pool 100

 gateway-list 192.1.0.1

 network 192.1.0.0 mask 255.255.255.0

#

wlan service-template 1

 ssid H3C

#

wlan service-template service

 ssid service

 vlan 100

 service-template enable

#

interface Vlan-interface1

 ip address dhcp-alloc

 nat outbound 2000

#

interface Vlan-interface100

 ip address 192.1.0.1 255.255.255.0

#

interface WLAN-Radio1/0/1

 service-template 1

 service-template service

#

interface WLAN-Radio1/0/2

 service-template 1

#

interface WLAN-Radio1/0/3

 service-template 1

#

acl basic 2000

 rule 0 permit source 192.1.0.0 0.0.0.255

#

return

Related documentation

·     Network Connectivity Command Reference in H3C Access Points Configuration Guides

·     Network Connectivity Configuration Guide in H3C Access Points Configuration Guides

·     WLAN Access Command Reference in H3C Access Points Configuration Guides

·     WLAN Access Configuration Guide in H3C Access Points Configuration Guides