Contents

Example: Configuring bidirectional NAT and NAT Server with easy IP·· 1

Network configuration· 1

Analysis· 1

Procedures· 1

Configuring Device A· 1

Configuring the host 3

Verifying the configuration· 3

Configuration files· 4

 

Example: Configuring bidirectional NAT and NAT Server with easy IP

Network configuration

As shown in Figure 1, Device A acts as an egress gateway. A CGN card is installed on slot 2 of Device A, which provides address translation. For security, configure service traffic between the host and FTP server to be forwarded by Device A:

·     The IP address used by the FTP server for providing services is the primary IP address of Loopback 10 on Device A.

·     The source IP address of packets sent from the host to the FTP server is IP address 22.2.2.2 in NAT address group 1.

Bidirectional NAT enables the host and the FTP server to communicate with each other without perceiving each other's real IP address on the public network.

Figure 1 Network diagram

 

Analysis

To hide the real IP addresses of the host and FTP server on the public network, perform the following tasks:

·     Configure destination address translation and set the IP address used by the FTP server for providing services to the IP address of Loopback 10.

·     Configure source address translation. Configure Device A to translate the source IP address of packets sent from the host to the FTP server into the IP address in NAT address group 1.

Procedures

Configuring Device A

1.     Specify IPv4 addresses for the interfaces on Device A.

<DeviceA> system-view

[DeviceA] interface ten-gigabitethernet 3/1/1

[DeviceA-Ten-GigabitEthernet3/1/1] ip address 1.1.1.1 255.255.255.0

[DeviceA-Ten-GigabitEthernet3/1/1] quit

[DeviceA] interface ten-gigabitethernet 3/1/2

[DeviceA-Ten-GigabitEthernet3/1/2] ip address 2.1.1.1 255.255.255.0

[DeviceA-Ten-GigabitEthernet3/1/2] quit

[DeviceA] interface loopback 10

[DeviceA-LoopBack10] ip address 11.1.1.1 255.255.255.0

[DeviceA-LoopBack10] quit

2.     Configure an ACL:

# Configure ACL 3001 to permit all packets.

[DeviceA] acl advanced 3001

[DeviceA-acl-ipv4-adv-3001] rule 1 permit ip source any

[DeviceA-acl-ipv4-adv-3001] quit

3.     Configure a failover group:

# Specify the CGN card in slot 2 as the primary node in failover group cgn1.

[DeviceA] failover group cgn1 id 1

[DeviceA-failover-group-cgn] bind slot 2 primary

[DeviceA-failover-group-cgn] quit

4.     Create service instance group 1 and associate it with failover group cgn1.

[DeviceA] service-instance-group 1

[DeviceA-service-instance-group 1] failover-group cgn1

[DeviceA-service-instance-group 1] quit

5.     Configure a NAT address group:

# Create address group 1 and add address 22.2.2.2 to the group.

[DeviceA] nat address-group 1

[DeviceA-address-group-1] address 22.2.2.2 22.2.2.2

[DeviceA-address-group-1] quit

6.     Configure a NAT instance:

# Create a NAT instance named a with ID 1.

[DeviceA] nat instance a id 1

# Associate NAT instance a with service instance group 1.

[DeviceA-nat-instance-a] service-instance-group 1

# Configure outbound dynamic NAT to use NAT address group 1 to translate packets permitted by ACL 3001.

[DeviceA-nat-instance-a] nat outbound 3001 address-group 1

# Configure a NAT server mapping to translate packets with the primary IP address of Loopback 10 as the destination address and port 21. After address translation, the destination IP address is 202.1.1.1 and the port number is 21.

[DeviceA-nat-instance-a] nat server protocol tcp global interface loopback 10 21 inside 202.1.1.1 ftp

[DeviceA-nat-instance-a] quit

7.     Configure a QoS policy to redirect traffic to the NAT instance for address translation:

# Configure traffic class a and traffic behavior a.

[DeviceA] traffic classifier a operator and

[DeviceA-classifier-a] if-match acl 3001

[DeviceA-classifier-a] quit

[DeviceA] traffic behavior cgn

[DeviceA-behavior-a] bind nat-instance a

[DeviceA-behavior-a] quit

# Create QoS policy a and associate the traffic class with the traffic behavior.

[DeviceA] qos policy a

[DeviceA-qospolicy-a] classifier a behavior a

[DeviceA-qospolicy-a] quit

# Apply the QoS policy to the inbound traffic on Ten-GigabitEthernet3/1/1 and Ten-GigabitEthernet3/1/2.

[DeviceA] interface ten-gigabitethernet 3/1/1

[DeviceA-Ten-GigabitEthernet3/1/1] qos apply policy a inbound

[DeviceA-Ten-GigabitEthernet3/1/1] quit

[DeviceA] interface ten-gigabitethernet 3/1/2

[DeviceA-Ten-GigabitEthernet3/1/2] qos apply policy a inbound

[DeviceA-Ten-GigabitEthernet3/1/2] quit

Configuring the host

Make sure the host and Device A can reach each other.

Verifying the configuration

# Access the FTP server by using IP address 11.1.1.1 on the host. Display NAT session information generated on Device A when Host A accesses the FTP server.

[DeviceA] display nat session verbose

Slot 3:

Initiator:

  Source      IP/port: 200.1.1.1/30929

  Destination IP/port: 11.1.1.1/21

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: TCP(6)

  Inbound interface: GigabitEthernet0/0

Responder:

  Source      IP/port: 202.1.1.1/21

  Destination IP/port: 22.2.2.2/1025

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: TCP(6)

  Inbound interface: GigabitEthernet0/1

State: TCP_ESTABLISHED

Application: FTP

Role: Master

Failover group ID: 1

Start time: 2023-03-07 08:20:14    TTL: 3598s

Initiator->Responder:            0 packets          0 bytes

Responder->Initiator:            0 packets          0 bytes

Total sessions found: 1

The output shows that the host (session initiator) regards the IP address of the FTP server as 11.1.1.1 and the FTP server (session responder) regards the IP address of the host as 22.2.2.2. They cannot perceive each other's real IP address on the public network.

Configuration files

Device A:

#

interface LoopBack10

 ip address 11.1.1.1 255.255.255.0

#

interface Ten-GigabitEthernet3/1/1

 ip address 1.1.1.1 255.255.255.0

 qos apply policy a inbound

#

interface Ten-GigabitEthernet3/1/2

 ip address 2.1.1.1 255.255.255.0

 qos apply policy a inbound

#

acl advanced 3001

 rule 1 permit ip

#

failover group cgn1 id 1

 bind slot 2 primary

#

service-instance-group 1

 failover-group cgn1

#

nat instance a id 1

 service-instance-group 1

 nat outbound 3001 address-group 1

 nat server protocol tcp global interface LoopBack10 21 inside 202.1.1.1 21

#

traffic classifier a operator and

 if-match acl 3001

#

traffic behavior a

 bind nat-instance a

#

qos policy a

 classifier a behavior a

#

nat address-group 1

 address 22.2.2.2 22.2.2.2

#