- Table of Contents
-
- 04-CLI configuration examples (AP standalone)
- 01-WPA2-PSK Encryption Configuration Examples
- 02-Client Rate Limiting Configuration Examples
- 03-NAT Configuration Examples
- 04-PPPoE Configuration Examples
- 05-Mesh WDS Configuration Examples
- 06-Local MAC Authentication (IPv6) Configuration Examples
- 07-IPv6 Configuration Examples
- 08-Layer 2 IPv6 Multicast Configuration Examples
- 09-Interoperation of Fat APs and Switch for WLAN Access and Roaming Configuration Examples
- 10-Remote 802.1X Authentication Configuration Examples
- 11-Remote MAC Authentication Configuration Examples
- 12-Anchor AC Mode Local Forwarding Configuration Examples
- 13-Anchor AC Mode Dual-Link Backup Configuration Examples
- 14-Anchor AC Mode Internal-to-External Access Through NAT Configuration Examples
- 15-Anchor AC Mode Remote Portal Auth in Local Forwarding Configuration Examples
- 16-Anchor AC Mode Remote Portal Auth in Centralized Forwarding Configuration Examples
- 17-Anchor AC Mode Remote 802.1X Auth in Local Forwarding Configuration Examples
- 18-Anchor AC Mode Remote 802.1X Auth in Centralized Forwarding Configuration Examples
- 19-Anchor AC Mode Remote AP Configuration Examples
- Related Documents
-
Title | Size | Download |
---|---|---|
03-NAT Configuration Examples | 69.65 KB |
|
H3C Access Points |
Comware 7 NAT Configuration Examples |
|
|
Copyright © 2022 New H3C Technologies Co., Ltd. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.
The information in this document is subject to change without notice.
Contents
Introduction
The following information provides an example for configuring NAT.
Prerequisites
This document applies to Comware 7-based APs. Procedures and information in the examples might be slightly different depending on the software or hardware version of the APs.
The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
This document assumes that you have basic knowledge of NAT.
Example: Configuring NAT
Network configuration
As shown in Figure 1, the wireless clients access the network through the AP. The AP obtains an IP address through a DHCP server in the IP network.
To allow the internal wireless clients to access the external network, it is required to perform the following configuration:
· Configure the AP to act as the DHCP server to assign IP addresses to the wireless clients.
· Configure outbound NAT on the AP to perform address translation for wireless clients.
Procedures
Configuring AP
1. Configure VLANs and VLAN interfaces on the AP:
# Create VLAN 100 and VLAN interface, and assign an IP address to the VLAN interface.
<AP> system-view
[AP] vlan 100
[AP-vlan100] quit
[AP] interface vlan-interface 100
[AP-Vlan-interface100] ip address 192.1.0.1 24
[AP-Vlan-interface100] quit
# Configure the upstream interface VLAN-interface 1 to obtain an IP address through DHCP.
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address dhcp-alloc
[AP-Vlan-interface1] quit
2. Configure the wireless service template:
# Create service template service and enter its view.
[AP] wlan service-template service
# Configure service as the SSID.
[AP-wlan-st-service] ssid service
# Assign clients coming online through service template 100 to VLAN 100.
[AP-wlan-st-service] vlan 100
# Configure the PSK AKM mode and the 12345678 plaintext key.
[AP-wlan-st-service] akm mode psk
[AP-wlan-st-service] preshared-key pass-phrase simple 12345678
# Configure CCMP as the cipher suite and RSN as the security IE.
[AP-wlan-st-service] cipher-suite ccmp
[AP-wlan-st-service] security-ie rsn
# Enable the service template.
[AP-wlan-st-service] service-template enable
[AP-wlan-st-service] quit
# Enter interface view of WLAN-Radio 1/0/1.
[AP] interface wlan-radio 1/0/1
# Bind service template service to interface WLAN-Radio 1/0/1.
[AP-WLAN-Radio1/0/1] service-template service
[AP-WLAN-Radio1/0/1] quit
3. Configure the DHCP server:
# Configure DHCP address pool 100 for address allocation to the wireless clients.
[AP] dhcp server ip-pool 100
[AP-dhcp-pool-100] network 192.1.0.0 mask 255.255.255.0
[AP-dhcp-pool-100] gateway-list 192.1.0.1
[AP-dhcp-pool-100] quit
# Enable the DHCP service.
[AP] dhcp enable
4. Configure NAT:
# Configure ACL 2000 to identify packets source from 192.1.0.0.
[AP] acl basic 2000
[AP-acl-ipv4-basic-2000] rule 0 permit source 192.1.0.0 0.0.0.255
[AP-acl-ipv4-basic-2000] quit
# Configure an outbound dynamic PAT rule on VLAN-interface 1 to translate the source IP addresses permitted by ACL 2000
[AP] interface vlan-interface 1
[AP-Vlan-interface1] nat outbound 2000
[AP-Vlan-interface1] quit
Verifying the configuration
# Display client information on the AP.
[AP] display wlan client
Total number of clients: 1
MAC address User name R IP address VLAN
bc6c-2213-7cb7 N/A 1 192.1.0.2 100
# Verify that VLAN-interface 1 has obtained an IP address through DHCP.
[AP] display dhcp client interface vlan-interface 1
Vlan-interface1 DHCP client information:
Current state: BOUND
Allocated IP: 2.2.2.2 255.255.255.0
Allocated lease: 86400 seconds, T1: 36532 seconds, T2: 75600 seconds
DHCP server: 2.2.2.1
# Ping the DHCP server at 2.2.2.1 from a client. On the AP, display NAT session information.
[AP] display nat session verbose
Initiator:
Source IP/port: 192.1.0.2/768
Destination IP/port: 2.2.2.1/2048
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: ICMP(1)
Inbound interface: Vlan-interface100
Responder:
Source IP/port: 2.2.2.1/1
Destination IP/port: 2.2.2.2/0
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: ICMP(1)
Inbound interface: Vlan-interface1
State: ICMP_REPLY
Application: ICMP
Rule ID: -/-/-
Rule name:
Start time: 2016-01-01 05:27:35 TTL: 7s
Initiator->Responder: 0 packets 0 bytes
Responder->Initiator: 0 packets 0 bytes
Total sessions found: 1
Configuration files
dhcp enable
#
vlan 1
#
vlan 100
#
dhcp server ip-pool 100
gateway-list 192.1.0.1
network 192.1.0.0 mask 255.255.255.0
#
wlan service-template service
ssid service
vlan 100
akm mode psk
preshared-key pass-phrase cipher $c$3$7hZ2DNiI+h/ajPE7DhZbD6Y7py9vqf4721sp
cipher-suite ccmp
security-ie rsn
service-template enable
#
interface Vlan-interface1
ip address dhcp-alloc
nat outbound 2000
#
interface Vlan-interface100
ip address 192.1.0.1 255.255.255.0
#
interface WLAN-Radio1/0/1
service-template service
#
acl basic 2000
rule 0 permit source 192.1.0.0 0.0.0.255
#
return
Related documentation
· Network Connectivity Command Reference in H3C Access Points Command References
· Network Connectivity Configuration Guide in H3C Access Points Configuration Guides
· WLAN Access Command Reference in H3C Access Points Command References
· WLAN Access Configuration Guide in H3C Access Points Configuration Guides