start-address end-address: Specifies the start and end IP addresses of the address range. The end address must not be lower than the start address. If they are the same, the address range has only one IP address.

Usage guidelines

A NAT address group is a set of address ranges. The source address in a packet destined for an external network is translated into an address in one of the address ranges.

You can specify a maximum of 65535 addresses in one command execution. Make sure the address ranges do not overlap.

The maximum number of address ranges in total for all NAT address groups varies by device model.

The address command and the address interface command are mutually exclusive for one NAT address group.

Examples

# Add address ranges to an address group.

<Sysname> system-view

[Sysname] nat address-group 2

[Sysname-address-group-2] address 10.1.1.1 10.1.1.15

[Sysname-address-group-2] address 10.1.1.20 10.1.1.30

# Create a configuration profile ap1 and add address ranges to an address group in the configuration profile.

<Sysname> system-view

[Sysname] configuration profile ap1 model WA6320

[Sysname-config-profile-ap1] nat address-group 2

[Sysname-config-profile-ap1-address-group-2] address 10.1.1.1 10.1.1.15

[Sysname-config-profile-ap1-address-group-2] address 10.1.1.20 10.1.1.30

Related commands

address interface

nat address-group

address interface

Use address interface to add the IP address of an interface to a NAT address group.

Use undo address interface to restore the default.

Syntax

address interface interface-type interface-number

undo address interface

Default

No interface address exists in a NAT address group.

Views

NAT address group view

Predefines user roles

network-admin

Parameters

interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

This command is applicable to Easy IP with the IP address of the NAT interface dynamically obtained through DHCP or PPPoE. After you configure this command, the primary IPv4 address of the specified interface will be added to the NAT address group.

You can specify only one interface for a NAT address group.

The address command and the address interface command are mutually exclusive for one NAT address group.

The IP address of an interface cannot be added to different NAT address groups.

Make sure addresses in different NAT address groups do not overlap.

Examples

# Add the IP address of GigabitEthernet 1/0/2 to NAT address group 2.

<Sysname> system-view

[Sysname] nat address-group 2

[Sysname-address-group-2] address interface gigabitethernet 1/0/2

Related commands

address

nat address-group

block-size

Use block-size to set the port block size.

Use undo block-size to restore the default.

Syntax

block-size block-size

undo block-size

Default

The port block size is 256.

Views

NAT port block group view

Predefined user roles

network-admin

Parameters

block-size: Specifies the number of ports for a port block. The value range for this argument is 1 to 65535.

Usage guidelines

Set an appropriate port block size based on the number of private IP addresses, the number of public IP addresses, and the port range in the port block group.

The port block size cannot be larger than the number of ports in the port range.

Examples

# Set the port block size to 1024 for port block group 1.

<Sysname> system-view

[Sysname] nat port-block-group 1

[Sysname-port-block-group-1] block-size 1024

Related commands

nat port-block-group

description (NAT address group view)

Use description to configure a description for a NAT address group.

Use undo description to delete the description for a NAT address group.

Syntax

description text

undo description

Default

A NAT address group does not have any description.

Views

NAT address group view

Predefined user roles

network-admin

Parameters

text: Specifies a description, a case-insensitive string of 1 to 63 characters.

Examples

# Configure description test1 for NAT address group 1.

<Sysname> system-view

[Sysname] nat address-group 1

[Sysname-nat-address-group-1] description test1

display nat address-group

Use display nat address-group to display NAT address group information.

Syntax

display nat address-group [ group-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

group-id: Specifies the ID of a NAT address group. The value range for this argument is 0 to 65535. If you do not specify the group-id argument, this command displays information about all NAT address groups.

Examples

# Display information about all NAT address groups.

<Sysname> display nat address-group

NAT address group information:

Totally 5 NAT address groups.

Address group ID: 1 Address group name: a

Description : group1

Port range: 1-65535

Address information:

Start address End address

202.110.10.10 202.110.10.15

Address group ID: 2

Port range: 1-65535

Address information:

Start address End address

202.110.10.20 202.110.10.25

202.110.10.30 202.110.10.35

Address group ID: 3

Port range: 1024-65535

Address information:

Start address End address

202.110.10.40 202.110.10.50

Address group ID: 4

Port range: 10001-65535

Port block size: 500

Extended block number: 1

Address information:

Start address End address

202.110.10.60 202.110.10.65

Address group ID: 5

Port range: 1-1024

Port block size: 500

Address information:

20.1.1.1 (GigabitEthernet1/0/1)

Address group ID: 6

Port range: 1-65535

Address information:

Start address End address

--- ---

# Display information about NAT address group 1.

<Sysname> display nat address-group 1

Address group ID: 1 Address group name: a

Description : group1

Port range: 1-65535

Address information:

Start address End address

202.110.10.10 202.110.10.15

Table 1 Command output

Field	Description
NAT address group information	Information about the NAT address group
Address group ID	ID of the NAT address group.
Totally n NAT address groups	Total number of NAT address groups.
Address group name	Name of the NAT address group. If no address group name is configured, this field is not displayed.
Description	Description for the NAT address group. If no description is configured, this field is not displayed.
Port range	Port range for public IP addresses.
Port block size	Number of ports in a port block. This field is not displayed if the port block size is not set.
Extended block number	Number of extended port blocks. This field is not displayed if the number of extended port blocks is not set.
Blade-load-sharing-group	Load sharing group specified for the address group.
Address information	Information about the IP addresses in the address group. · For addresses added by using the address command: ¡ Start address—Start IP address of an address range. If you do not specify a start address for the range, this field displays hyphens (---). ¡ End address—End IP address of an address range. If you do not specify an end address for the range, this field displays hyphens (---). · For addresses added by using the address interface command: ¡ 20.1.1.1 (GigabitEthernet1/0/1)—IP address 20.1.1.1 of GigabitEthernet 1/0/1 has been added to the NAT address group. ¡ --- (GigabitEthernet1/0/2)—Failed to add the IP address of GigabitEthernet 1/0/2 to the NAT address group because this interface does not have an IP address.

‌

Related commands

nat address-group

display nat alg

Use display nat alg to display the NAT ALG status for all supported protocols.

Syntax

display nat alg

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the NAT ALG status for all supported protocols.

<Sysname> display nat alg

NAT ALG:

DNS : Enabled

FTP : Enabled

H323 : Disabled

ICMP-ERROR : Enabled

ILS : Disabled

MGCP : Disabled

NBT : Disabled

PPTP : Enabled

RTSP : Enabled

RSH : Disabled

SCCP : Disabled

SCTP : Disabled

SIP : Disabled

SQLNET : Disabled

SUNRPC : Disabled

TFTP : Disabled

XDMCP : Disabled

Related commands

display nat all

Use display nat all to display all NAT configuration information.

Syntax

display nat all

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# ‌Display all NAT configuration information.

<Sysname> display nat all

NAT address group information:

Totally 5 NAT address groups.

Address group 1:

Description : group1

Port range: 1-65535

Address information:

Start address End address

202.110.10.10 202.110.10.15

Address group 2:

Port range: 1-65535

Address information:

Start address End address

202.110.10.20 202.110.10.25

202.110.10.30 202.110.10.35

Address group 3:

Port range: 1024-65535

Address information:

Start address End address

202.110.10.40 202.110.10.50

Address group 4:

Port range: 10001-65535

Port block size: 500

Extended block number: 1

Address information:

Start address End address

202.110.10.60 202.110.10.65

Address group 6:

Port range: 1-65535

Address information:

Start address End address

--- ---

NAT server group information:

Totally 3 NAT server groups.

Group Number Inside IP Port Weight

1 192.168.0.26 23 100

192.168.0.27 23 500

2 --- --- ---

3 192.168.0.26 69 100

NAT inbound information:

Totally 1 NAT inbound rules.

Interface: GigabitEthernet1/0/2

ACL: 2038

Address group ID: 2

Add route: Y NO-PAT:Y Reversible: N

Rule name: abc

Priority: 1000

Description: NatInbound1

Config status: Active

NAT outbound information:

Totally 2 NAT outbound rules.

Interface: GigabitEthernet1/0/1

ACL: 2036

Address group ID: 1

Port-preserved: Y NO-PAT: N Reversible: N

Configuration mode : NETCONF (action)

Rule name: lee

Priority: 122

Description: NatOutbound1

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL.

Interface: GigabitEthernet1/0/1

ACL: 2037

Address group ID: 1

Port-preserved: N NO-PAT: Y Reversible: Y

Rule name: rabbit

Priority: 100

The following items don't exist or aren't effective: ACL.

NAT internal server information:

Totally 2 internal servers.

Interface: GigabitEthernet1/0/1

Global ACL : 2000

Local IP/port : 192.168.10.1/23

Rule name : sept

Priority : 1000

Configuration mode : NETCONF (action)

NAT counting : 0

Description : NatServerDescription1

Config status : Active

Interface: GigabitEthernet1/0/2

Protocol: 6(TCP)

Global IP/port: 50.1.1.1/23

Local IP/port : 192.168.10.15/23

ACL : 2000

Rule name : blue

NAT counting : 0

Config status : Active

Static NAT mappings:

Totally 2 inbound static NAT mappings.

Net-to-net:

Global IP : 2.2.2.1 – 2.2.2.255

Local IP : 1.1.1.0

Netmask : 255.255.255.0

ACL : 3000

Reversible : Y

Rule name : green

Priority : 4

Config status: Active

IP-to-IP:

Global IP : 5.5.5.5

Local IP : 4.4.4.4

ACL : 2001

Reversible : Y

Rule name : blue

Priority : 4

Packet type ignore: Y

Description : NatStaticDescription1

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL.

Totally 2 outbound static NAT mappings.

Net-to-net:

Local IP : 1.1.1.1 - 1.1.1.255

Global IP : 2.2.2.0

Netmask : 255.255.255.0

ACL : 3000

Reversible : Y

Rule name : yellow

Priority : 5

Config status: Active

IP-to-IP:

Local IP : 4.4.4.4

Global IP : 5.5.5.5

ACL: : 2001

Reversible : Y

Rule name : pink

Priority : 6

Packet type ignore: Y

Description : NatStaticDescription2

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL.

Interfaces enabled with static NAT:

Totally 2 interfaces enabled with static NAT.

Interface: GigabitEthernet1/0/2

Config status: Active

Interface: GigabitEthernet1/0/3

Config status: Active

NAT DNS mappings:

Totally 2 NAT DNS mappings.

Domain name : www.example.com

Global IP : 6.6.6.6

Global port : 23

Protocol : TCP(6)

Config status: Active

Domain name : service.example.com

Global IP : ---

Global port : 12

Protocol : TCP(6)

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: interface IP address.

NAT logging:

Log enable : Enabled(ACL 2000)

Flow-begin : Disabled

Flow-end : Disabled

Flow-active : Enabled(10 minutes)

Port-block-assign : Disabled

Port-block-withdraw : Disabled

Alarm : Disabled

NO-PAT IP usage : Disabled

NAT log flow-match : Enabled

NAT hairpinning:

Totally 2 interfaces enabled with NAT hairpinning.

Interface: GigabitEthernet1/0/1

Config status: Active

Interface: GigabitEthernet1/0/2

Config status: Active

NAT mapping behavior:

Mapping mode : Endpoint-Independent

ACL : 2050

Config status: Active

NAT ALG:

DNS : Enabled

FTP : Enabled

H323 : Disabled

ICMP-ERROR : Enabled

ILS : Disabled

MGCP : Disabled

NBT : Disabled

PPTP : Enabled

RTSP : Enabled

RSH : Disabled

SCCP : Disabled

SCTP : Disabled

SIP : Disabled

SQLNET : Disabled

SUNRPC : Disabled

TFTP : Disabled

XDMCP : Disabled

NAT port block group information:

Totally 3 NAT port block groups.

Port block group 1:

Port range: 1-65535

Block size: 256

Local IP address information:

Start address End address VPN instance

172.16.1.1 172.16.1.254 ---

192.168.1.1 192.168.1.254 ---

192.168.3.1 192.168.3.254 ---

Global IP pool information:

Start address End address

201.1.1.1 201.1.1.10

201.1.1.21 201.1.1.25

Port block group 2:

Port range: 10001-30000

Block size: 500

Local IP address information:

Start address End address VPN instance

10.1.1.1 10.1.10.255 ---

Global IP pool information:

Start address End address

202.10.10.101 202.10.10.120

Port block group 3:

Port range: 1-65535

Block size: 256

Local IP address information:

Start address End address VPN instance

--- --- ---

Global IP pool information:

Start address End address

--- ---

NAT outbound port block group information:

Totally 2 outbound port block group items.

Interface: GigabitEthernet1/0/2

port-block-group: 2

Rule name : red

Priority : 4

Config status : Active

Interface: GigabitEthernet1/0/2

port-block-group: 10

Rule name: lee

Config status : Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: port block group.

Static NAT load balancing: Disabled

NAT configuration-for-new-connection: Disabled

NAT global-policy compatible-previous-version rule-type ipv4-snat-and-dnat translate-before-secp : Disabled

NAT gratuitous-arp: Enabled

NAT zone-switch recreate-session: Enabled

The output shows all NAT configuration information. Table 2 describes only the fields for the output of the nat hairpin enable, nat mapping-behavior, and nat alg commands.

Table 2 Command output

Field	Description
NAT address group information	Information about the NAT address group. See Table 1 for output description.
NAT server group information	Information about the internal server group. See Table 14 for output description.
NAT inbound information:	Inbound dynamic NAT configuration. See Table 5 for output description.
NAT outbound information	Outbound dynamic NAT configuration. See Table 8 for output description.
NAT internal server information	NAT server mapping configuration. See Table 13 for output description.
Static NAT mappings	Static NAT mappings. See Table 17 for output description.
NAT DNS mappings	NAT DNS mappings. See Table 3 for output description.
NAT logging	NAT logging configuration. See Table 6 for output description.
NAT log flow-match	Status of fast output of new NAT flow logs: · Enabled. · Disabled.
NAT hairpinning	NAT hairpin configuration.
Totally n interfaces enabled NAT hairpinning	Number of interfaces with NAT hairpin enabled.
Interface	NAT hairpin-enabled interface.
Rule name	Name of the NAT rule.
Priority	Priority of the NAT rule.
Config status	Status of the NAT hairpin configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status	Reasons why the NAT hairpin configuration does not take effect. This field is available when the Config status field displays Inactive.
NAT mapping behavior	Mapping behavior mode of PAT: Endpoint-Independent or Address and Port-Dependent.
ACL	ACL number or name. If no ACL is specified for NAT, this field displays hyphens (---).
Config status	Status of the NAT mapping behavior configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status	Reasons why the NAT mapping behavior configuration does not take effect. This field is available when the Config status field displays Inactive.
NAT ALG	NAT ALG configuration for different protocols.
NAT port block group information	Configuration information about NAT port block groups. See Table 11 for output description.
NAT outbound port block group information	Configuration information about static outbound port block mapping rules. See Table 9 for output description.
Static NAT load balancing	Whether load balancing is enabled for static NAT on service engines: · Enabled. · Disabled.
NAT configuration-for-new-connection	Whether NAT configuration changes taking effect only on new connections is enabled: · Enabled. · Disabled.
NAT global-policy compatible-previous-version rule-type ipv4-snat-and-dnat translate-before-secp	Whether source and destination address translation based on the NAT-type SNAT+DNAT rule in the global NAT policy being prior to security policy matching for compatibility with the earlier versions is enabled: · Enabled. · Disabled.
NAT gratuitous-arp	Whether the NAT module is enabled to advertise public IP-MAC mappings in gratuitous ARP packets: · Enabled. · Disabled.
NAT zone-switch recreate-session	Whether NAT session recreation after a security zone change of output interfaces upon link switchover is enabled: · Enabled. · Disabled.

‌

display nat dns-map

Use display nat dns-map to display NAT DNS mappings.

Syntax

display nat dns-map

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display NAT DNS mappings.

<Sysname> display nat dns-map

NAT DNS mapping information:

Totally 2 NAT DNS mappings.

Domain name : www.example.com

Global IP : 6.6.6.6

Global port : 23

Protocol : TCP(6)

Config status: Active

Domain name : service.example.com

Global IP : ---

Global port : 12

Protocol : TCP(6)

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: interface IP address.

Table 3 Command output

Field	Description
NAT DNS mapping information	Information about NAT DNS mappings.
Totally n NAT DNS mappings	Total number of NAT DNS mappings.
Domain name	Domain name of the internal server.
Global IP	Public IP address of the internal server. · If Easy IP is configured, this field displays the IP address of the specified interface. · If you do not specify a public IP address, this field displays hyphens (---).
Global port	Public port number of the internal server.
Protocol	Protocol name and number of the internal server.
Config status	Status of the DNS mapping configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status	Reasons why the DNS mapping configuration does not take effect. This field is available when the Config status field displays Inactive.

‌

Related commands

nat dns-map

display nat eim

Use display nat eim to display information about NAT Endpoint-Independent Mapping (EIM) entries.

Syntax

display nat eim

Views

Any view

Predefined user roles

network-admin

network-operator

Usage guidelines

EIM entries are created when PAT operates in EIM mode. An EIM entry is a 3-tuple entry, and it records the mapping between a private address/port and a public address/port.

The EIM entry provides the following functions:

· The same EIM entry applies to subsequent connections initiated from the same source IP and port.

· The EIM entries allow reverse translation for connections initiated from external hosts to internal hosts.

Examples

# ‌Display information about NAT EIM entries.

<Sysname> display nat eim

Slot 0:

Local IP/port: 192.168.100.100/1024

Global IP/port: 200.100.1.100/2048

Protocol: TCP(6)

Local IP/port: 192.168.100.200/2048

Global IP/port: 200.100.1.200/4096

Protocol: UDP(17)

Total entries found: 2

Table 4 Command output

Field	Description
Protocol	Protocol name and number.
Total entries found	Total number of EIM entries.

Related commands

nat mapping-behavior

nat outbound

display nat inbound

Use display nat inbound to display inbound dynamic NAT configuration.

Syntax

display nat inbound

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# ‌Display inbound dynamic NAT configuration.

<Sysname> display nat inbound

NAT inbound information:

Totally 2 NAT inbound rules.

Interface: GigabitEthernet1/0/2

ACL: 2038

Address group ID: 2

Add route: Y NO-PAT: Y Reversible: N

Rule name: abcd

Priority: 1000

Description: NatInbound1

NAT counting: 0

Config status: Active

Interface: GigabitEthernet1/0/3

ACL: 2037

Address group ID: 1 Address group name: abc

Add route: Y NO-PAT: Y Reversible: N

Rule name: eif

Priority: 1000

NAT counting: 0

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL.

Table 5 Command output

Field	Description
NAT inbound information	Information about inbound dynamic NAT configuration.
Totally n NAT inbound rules	Total number of inbound dynamic NAT rules.
Interface	Interface where the inbound dynamic NAT rule is configured.
ACL	ACL number or name.
Address group ID	ID of the NAT address group used by the inbound dynamic NAT rule.
Address group name	Name of the NAT address group. If no address group name is configured, this field is not displayed.
Add route	Whether to add a route when a packet matches the inbound dynamic NAT rule: · Y—Adds a route. · N—Does not add a route.
NO-PAT	Whether NO-PAT or PAT is used: · Y—NO-PAT is used. · N—PAT is used.
Reversible	Whether reverse address translation is allowed: · Y—Reverse address translation is allowed. · N—Reverse address translation is not allowed.
Rule name	Name of the NAT rule.
Priority	Priority of the NAT rule.
Description	Description of the NAT rule. This field is not displayed if no description is configured for the rule.
NAT counting	Number of times the NAT rule is matched.
Config status	Status of the inbound dynamic NAT configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status	Reasons why the inbound dynamic NAT configuration does not take effect: This field is available when the Config status field displays Inactive.

‌

Related commands

nat inbound

display nat log

Use display nat log to display NAT logging configuration.

Syntax

display nat log

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display NAT logging configuration.

<Sysname> display nat log

NAT logging:

Log enable : Enabled(ACL 2000)

Flow-begin : Disabled

Flow-end : Disabled

Flow-active : Enabled(10 minutes)

Port-block-assign : Disabled

Port-block-withdraw : Disabled

Alarm : Disabled

NO-PAT IP usage : Disabled

Table 6 Command output

Field	Description
NAT logging	NAT logging configuration.
Log enable	Enabling status of NAT logging. If an ACL is specified for NAT logging, this field also displays the ACL number or name.
Flow-begin	Enabling status of logging for NAT session establishment events.
Flow-end	Enabling status of logging for NAT session removal events.
Flow-active	Enabling status of logging for active NAT flows. If it is enabled, this field also displays the interval in minutes at which active flow logs are generated.
Port-block-assign	‌ Enabling status of NAT444 user logging for port block assignment.
Port-block-withdraw	‌ Enabling status of NAT444 user logging for port block withdrawal.
Alarm	‌ Enabling status of logging for NAT444 alarms.
NO-PAT IP usage	Enabling status of logging for IP usage of NAT address groups when NO-PAT mode is used. If it is enabled, this field also displays IP usage for each configured NAT address group, in percentage.

Related commands

nat log enable

nat log flow-active

nat log flow-begin

display nat no-pat

Use display nat no-pat command to display information about NAT NO-PAT entries.

Syntax

display nat no-pat { ipv4 | ipv6 }

Views

Any view

Default user roles

network-admin

network-operator

Parameters

ipv4: Displays NO-PAT entry information for IPv4 NAT sessions.

ipv6: Displays NO-PAT entry information for IPv6 NAT sessions.

Usage guidelines

A NO-PAT entry records the mapping between a private address and a public address.

The NO-PAT entry provides the following functions:

· The same entry applies to subsequent connections initiated from the same source IP address.

· The NO-PAT entries allow reverse translation for connections initiated from external hosts to internal hosts.

Outbound and inbound NO-PAT address translations create their own NO-PAT tables. These two types of tables are displayed separately.

Examples

# ‌Display information about NO-PAT entries for IPv4 NAT sessions on all cards.

<Sysname> display nat no-pat ipv4

Slot 0:

Global IPv4: 200.100.1.100

Local IPv4: 192.168.100.100

Reversible: N

Type : Inbound

Local IPv4: 192.168.100.200

Global IPv4: 200.100.1.200

Reversible: Y

Type : Outbound

Total Ipv4 entries found: 2

# ‌Display information about NO-PAT entries for IPv6 NAT sessions on all cards.

<Sysname> display nat no-pat ipv6

Slot 0:

Global IPv6: FD01:203:405::1

Local IPv6: 2001:DB8:1::100

Reversible: N

Type : Inbound

Total Ipv6 entries found: 1

Table 7 Command output

Field	Description
Global IPv4	Public IPv4 address.
Local IPv4	Private IPv4 address.
Global IPv6	Public IPv6 address.
Local IPv6	Private IPv6 address.
Reversible	Whether reverse address translation is allowed: · Y—Reverse address translation is allowed. · N—Reverse address translation is not allowed.
Type	Type of the NO-PAT entry: · Inbound—A NO-PAT entry created during inbound dynamic NAT. · Outbound—A NO-PAT entry created during outbound dynamic NAT.
Total Ipv4 entries found	Total number of IPv4 NO-PAT entries.
Total Ipv6 entries found	Total number of IPv6 NO-PAT entries.

Related commands

nat inbound

nat outbound

display nat outbound

Use display nat outbound to display outbound dynamic NAT configuration.

Syntax

display nat outbound

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# ‌Display outbound dynamic NAT configuration.

<Sysname> display nat outbound

NAT outbound information:

Totally 2 NAT outbound rules.

Interface: GigabitEthernet1/0/1

Address group ID: 1

Port-preserved: Y NO-PAT: N Reversible: N

Rule name: acdefg

Configuration mode : NETCONF (action)

Priority: 1000

Description: NatOutbound1

NAT counting: 0

Config status: Active

Interface: GigabitEthernet1/0/1

ACL: 2037

Address group ID: ---

Port-preserved: N NO-PAT: Y Reversible: Y

Rule name: abefg

Priority: 1000

NAT counting: 0

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL

Interface: GigabitEthernet1/0/1

ACL: 2100

Address group ID: 2

Port-preserved: N NO-PAT: N Reversible: N

Priority: 0

NAT counting: 0

Config status: Active

Table 8 Command output

Field	Description
NAT outbound information	Information about outbound dynamic NAT configuration.
Totally n NAT outbound rules	Total number of outbound dynamic NAT rules.
Interface	Interface where the outbound dynamic NAT rule is configured.
ACL	IPv4 ACL number or name. If no IPv4 ACL is specified for outbound dynamic NAT rule, this field displays hyphens (---).
Address group ID	ID of the address group used by the outbound dynamic NAT rule. If no address group is specified, the field displays hyphens (---).
Address group name	Name of the NAT address group. If no address group name is configured, this field is not displayed.
Port-preserved	Whether to try to preserve the port numbers for PAT. · Y—Tries to preserve the port numbers. · N—Allows translating port numbers.
NO-PAT	Whether NO-PAT is used: · Y—NO-PAT is used. · N—PAT is used.
Reversible	Whether reverse address translation is allowed: · Y—Reverse address translation is allowed. · N—Reverse address translation is not allowed.
Rule name	Name of the NAT rule.
Priority	Priority of the NAT rule.
Description	Description of the NAT rule. This field is not displayed if no description is configured for the rule.
Configuration mode	Configuration method of the device. · This field displays NETCONF (action) if the device is configured by using a NETCONF action operation. · This field is not displayed if the device is configured by using other methods.
NAT counting	Number of times the NAT rule is matched.
Config status	Status of the outbound dynamic NAT configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status	Reasons why the outbound dynamic NAT configuration does not take effect. This field is available when the Config status field displays Inactive.

Related commands

nat outbound

display nat outbound port-block-group

Use display nat outbound port-block-group to display static outbound port block mapping rules for NAT444.

Syntax

display nat outbound port-block-group

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display static outbound port block mapping rules for NAT444.

<Sysname> display nat outbound port-block-group

NAT outbound port block group information:

Totally 2 outbound port block group items.

Interface: GigabitEthernet1/0/2

port-block-group: 2

Rule name: abcdefg

NAT counting: 0

Config status : Active

Interface: GigabitEthernet1/0/2

port-block-group: 10

Rule name: abcfg

NAT counting: 0

Config status : Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: port block group.

Table 9 Command output

Field	Description
NAT outbound port block group information	Information about static outbound port block mapping rules.
Totally n outbound port block group items	Total number of static outbound port block mapping rules.
Interface	Interface where the static outbound port block mapping rules configured.
port-block-group	ID of the port block group.
Rule name	Name of the static outbound port block mapping rule
NAT counting	Number of times the mapping rule is matched.
Config status	Status of the port block mapping rule: · Active—The rule is taking effect. · Inactive—The rule is not taking effect.
Reasons for inactive status	Reasons why the port block mapping rule does not take effect. This field is available when the Config status field displays Inactive.

Related commands

nat outbound port-block-group

display nat port-block

Use display nat port-block to display NAT port block mappings.

Syntax

display nat port-block { dynamic [ address-group { group-id | name group-name } ] | static [ port-block-group group-id ] }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

dynamic: Displays dynamic port block mappings.

address-group: Displays port block mappings for the specified address group. If you do not specify a NAT address group, this command displays port block mappings for all address groups.

group-id: Specifies the ID of the address group. The value range for this argument is 0 to 65535.

name group-name: Specifies the name of the address group. The name is a case-insensitive string of 1 to 63 characters.

static: Displays static port block mappings.

port-block-group group-id: Displays port block mappings for the specified port block group. The group-id argument specifies the ID of the port block group. The value range for the group-id argument is 0 to 65535. If you do not specify a port block group, this command displays port block mappings for all port block groups.

Examples

# ‌Display static port block mappings.

<Sysname> display nat port-block static

Slot 0:

Local VPN Local IP Global IP Port block Connections

--- 100.100.100.111 202.202.100.101 10001-10256 0

--- 100.100.100.112 202.202.100.101 10257-10512 0

--- 100.100.100.113 202.202.100.101 10513-10768 0

--- 100.100.100.113 202.202.100.101 10769-11024 0

Total mappings found: 4

# ‌Display dynamic port block mappings.

<Sysname> display nat port-block dynamic

Slot 0:

Local VPN Local IP Global IP Port block Connections BackUp

--- 101.1.1.12 192.168.135.201 10001-11024 1 N

Total mappings found: 1

Table 10 Command output

Field	Description
Local VPN	This field is not supported in the current software version. MPLS L3VPN instance to which the private IP address belongs. If the private IP address does not belong to any VPN instance, this field displays hyphens (---).
Local IP	Private IP address.
Global IP	Public IP address.
Port block	Port block defined by a start port number and an end port number.
Connections	Number of connections established by using the ports in the port block.
BackUp	Whether the port block is backed up from the peer device on a hot backup system: · Y—The port block is backed up from the peer device. · N—The port block is created by the local device.

‌

display nat port-block-group

Use display nat port-block-group to display NAT port block group configuration.

Syntax

display nat port-block-group [ group-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

group-id: Specifies the ID of a NAT port block group. The value range for this argument is 0 to 65535. If you do not specify this argument, the command displays configuration of all NAT port block groups.

Examples

# Display configuration of all NAT port block groups.

<Sysname> display nat port-block-group

NAT port block group information:

Totally 3 NAT port block groups.

Port block group 1:

Port range: 1-65535

Block size: 256

Local IP address information:

Start address End address VPN instance

172.16.1.1 172.16.1.254 ---

192.168.1.1 192.168.1.254 ---

192.168.3.1 192.168.3.254 ---

Global IP pool information:

Start address End address

201.1.1.1 201.1.1.10

201.1.1.21 201.1.1.25

Port block group 2:

Port range: 10001-30000

Block size: 500

Local IP address information:

Start address End address VPN instance

10.1.1.1 10.1.10.255 ---

Global IP pool information:

Start address End address

202.10.10.101 202.10.10.120

Port block group 3:

Port range: 1-65535

Block size: 256

Local IP address information:

Start address End address VPN instance

--- --- ---

Global IP pool information:

Start address End address

--- ---

# Display information about NAT port block group 1.

<Sysname> display nat port-block-group 1

Port block group 1:

Port range: 1-65535

Block size: 256

Local IP address information:

Start address End address VPN instance

172.16.1.1 172.16.1.254 ---

192.168.1.1 192.168.1.254 ---

192.168.3.1 192.168.3.254 ---

Global IP pool information:

Start address End address

201.1.1.1 201.1.1.10

201.1.1.21 201.1.1.25

Table 11 Command output

Field	Description
NAT port block group information	Information about the port block group configuration.
Totally n NAT port block groups	Total number of port block groups.
Port block group	ID of the port block group.
Port range	Port range for the public IP addresses.
Block size	Number of ports in a port block.
Local IP address information	Information about the private IP addresses.
Global IP pool information	Information about the public IP addresses.
Start address	Start IP address of a private or public IP address range. If no start IP address is specified for the address range, this field displays hyphens (---).
End address	End IP address of a private or public IP address range. If no end IP address is specified for the address range, this field displays hyphens (---).
VPN instance	This field is not supported in the current software version. MPLS L3VPN instance to which the private IP address range belongs. If no VPN instance is specified for the private address range, this field displays hyphens (---).

Related commands

nat port-block-group

display nat port-block-usage

Use display nat port-block-usage to display the port block usage for address groups.

Syntax

display nat port-block-usage [ address-group group-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

address-group group-id: Specifies the ID of an address group. The value range for the group-id argument is 0 to 65535. If you do not specify an address group, this command displays the port block usage for all address groups.

Examples

# ‌Display the port block usage for address groups.

<Sysname> display nat port-block-usage

Slot 1:

Address group 0 on channel 0:

Total port block entries :10

Active port block entries:9

Current port block usage :90%

Total NAT address groups found: 1

Table 12 Command output

Field	Description
Address group	ID of the address group.
channel	Field-programmable gate array (FPGA) ID.
Total port block entries	Total number of port blocks in the address group.
Active port block entries	Total number of assigned port blocks in the address group.
Current port block usage	Port block usage in the address group.
Total NAT address groups found	Total number of address groups.

‌

display nat server

Use display nat server to display NAT server mappings.

Syntax

display nat server

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# ‌Display NAT server mappings.

<Sysname> display nat server

NAT internal server information:

Totally 2 internal servers.

Interface: GigabitEthernet1/0/1

Protocol: 6(TCP)

Global IP/port: 50.1.1.1/23-30

Local IP/port : 192.168.10.15-192.168.10.22/23

Rule name : abcg

Configuration mode : NETCONF (action)

NAT counting : 0

Description : NatServerDescription1

Config status : Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL.

Interface: GigabitEthernet1/0/2

Protocol: 255(Reserved)

Global IP/port: 50.1.1.100/---

Local IP/port : 192.168.10.150/---

Rule name : abcdefg

NAT counting : 0

Config status : Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: interface IP address.

Table 13 Command output

Field	Description
Priority	Priority of the NAT server mapping.
Configuration mode	Configuration method of the device. · This field displays NETCONF (action) if the device is configured by using a NETCONF action operation. · This field is not displayed if the device is configured by using other methods.
NAT internal server information	Information about NAT server mapping.
Interface	Interface where the NAT server mapping is configured.
Protocol	Protocol number and name of the internal server.
Global IP/port	Public IP address and port number of the internal server. · Global IP—A single IP address or an IP address range. If you use Easy IP, this field displays the IP address of the specified interface. If you do not specify an address for the interface, the Global IP field displays hyphens (---). · port—A single port number or a port number range. If no port number is in the specified protocol, the port field displays hyphens (---).
Local IP/port	For common NAT server mappings and object group-based NAT server mappings, this field displays the private IP address and port number of the internal server. · Local IP—A single IP address or an IP address range. · port—A single port number or a port number range. If no port number is in the specified protocol, the port field displays hyphens (---). For a load sharing NAT server mapping, this field displays the internal server group ID, IP address, port number, and number of connections of each member.
ACL	ACL number or name. If no ACL is specified, this field is not displayed.
Rule name	Name of the NAT server mapping.
NAT counting	Number of times the NAT server mapping is matched.
Description	Description of the NAT server mapping. This field is not displayed if no description is configured for the mapping.
Config status		Status of the NAT server mapping configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status		Reasons why the NAT server mapping configuration does not take effect. This field is available when the Config status field displays Inactive.

‌

Related commands

nat server

display nat server-group

Use display nat server-group to display internal server group configuration.

Syntax

display nat server-group [ group-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

group-id: Specifies the ID of the internal server group. The value range for this argument is 0 to 65535. If you do not specify this argument, the command displays the configuration of all internal server groups.

Examples

# Display the configuration of all internal server groups.

<Sysname> display nat server-group

NAT server group information:

Totally 3 NAT server groups.

Group Number Inside IP Port Weight

1 192.168.0.26 23 100

192.168.0.27 23 500

2 --- --- ---

3 192.168.0.26 69 100

# Display the configuration of internal server group 1.

<Sysname> display nat server-group 1

Group Number Inside IP Port Weight

1 192.168.0.26 23 100

192.168.0.27 23 500

Table 14 Command output

Field	Description
NAT server group information	Information about the NAT server group configuration.
Totally n NAT server groups	Total number of NAT server groups.
Group Number	ID of the internal server group.
Inside IP	Private IP address of a server in the internal server group. If no address is specified, this field displays hyphens (---).
Port	Private port number of a server in the internal server group. If no port number is specified, this field displays hyphens (---).
Weight	Weight of a server in the internal server group. If no weight value is specified, this field displays hyphens (---).

‌

Related commands

nat server-group

display nat session

Use display nat session to display NAT sessions.

Syntax

display nat session [ [ responder ] { source-ip source-ip-start [ source-ip-end ] | destination-ip destination-ip-start [ destination-ip-end ] | source-port source-port | destination-port destination-port | protocol { dccp | icmp | raw-ip | sctp | tcp | udp | udp-lite } | application application-name | state { dccp-closereq | dccp-closing | dccp-open | dccp-partopen | dccp-request | dccp-respond | dccp-timewait | icmp-reply | icmp-request | rawip-open | rawip-ready | sctp-closed | sctp-cookie-echoed | sctp-cookie-wait | sctp-established | sctp-shutdown-ack-sent | sctp-shutdown-recd | sctp-shutdown-sent | tcp-close | tcp-close-wait | tcp-est | tcp-fin-wait | tcp-last-ack | tcp-syn-recv | tcp-syn-sent | tcp-syn-sent2 | tcp-time-wait | udp-open | udp-ready | udplite-open | udplite-ready } | interface { interface-name | interface-type interface-number } } * ] [ brief | verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

responder: Displays NAT sessions by responder. If you do not specify this keyword, this command displays NAT sessions by initiator.

source-ip source-ip-start [ source-ip-end ]: Displays NAT sessions for the specified source IP address or source IP address range. To specify only one source IP address, specify only the source-ip-start argument. To specify a source IP address range, specify both the source-ip-start and source-ip-end arguments. The source-ip-start and source-ip-end arguments specify the start and end source IP addresses of the source IP address range, respectively. The specified IP address must be the source IP address of the packet that triggers the session establishment.

destination-ip destination-ip-start [ destination-ip-end ]: Displays NAT sessions for the specified destination IP address or destination IP address range. To specify only one destination IP address, specify only the destination-ip-start argument. To specify a destination IP address range, specify both the destination-ip-start and destination-ip-end arguments. The destination-ip-start and destination-ip-end arguments specify the start and end destination IP addresses of the destination IP address range, respectively. The specified IP address must be the destination IP address of the packet that triggers the session establishment.

source-port source-port: Specifies a source port by its number. The value range for the source-port argument is 0 to 65535.

destination-port destination-port: Specifies a destination port by its number. The value range for the destination-port argument is 0 to 65535.

protocol { dccp | icmp | raw-ip | sctp | tcp | udp | udp-lite }: Specifies an IPv4 transport layer protocol, including DCCP, ICMP, Raw IP, SCTP, TCP, UDP, and UDP-Lite.

application application-name: Specifies an application by its name, a case-insensitive string of 1 to 63 characters. Names invalid and other are not allowed.

interface interface-type interface-number: Specifies an interface by its type and number.

state: Specifies an IPv4 unicast session state. Table 15 describes the available IPv4 unicast session states.

Table 15 IPv4 unicast session states

Field	Description
dccp-closereq	A request was sent to close the DCCP connection.
dccp-closing	The DCCP protocol is closing the connection.
dccp-open	The DCCP connection is fully open.
dccp-partopen	The DCCP connection is half open.
dccp-request	A request was sent to initiate a DCCP connection.
dccp-respond	A DCCP-Response packet was sent.
dccp-timewait	The DCCP protocol is in waiting state.
icmp-reply	An ICMP echo reply was sent.
icmp-request	A request was sent to initiate an ICMP connection.
rawip-open	The RawIP connection is open.
rawip-ready	The RawIP connection is ready.
sctp-closed	The SCTP connection is closed.
sctp-cookie-echoed	The SCTP connection is not fully established.
sctp-cookie-wait	The SCTP connection is in waiting state.
sctp-established	The SCTP connection was established.
sctp-shutdown-ack-sent	A shutdown ACK chunk was sent.
sctp-shutdown-recd	An SCTP shutdown chunk was received.
sctp-shutdown-sent	An SCTP shutdown chunk was sent.
tcp-close	The TCP connection is closed.
tcp-close-wait	The TCP connection is waiting for being closed.
tcp-est	The TCP connection was established.
tcp-fin-wait	A FIN packet was sent to close the connection.
tcp-last-ack	The TCP connection is in the last acknowledgement state.
tcp-syn-recv	The server received a SYN packet from the client and sent an ACK packet.
tcp-syn-sent	The client sent a SYN packet to initiate a connection and is waiting for the server's response.
tcp-syn-sent2	The TCP connection is in the second connection request state.
tcp-time-wait	The session termination initiator received a FIN packet and returned an ACK packet.
udp-open	The UDP connection is open.
udp-ready	The UDP connection is ready.
udplite-open	The UDP-Lite connection is open.
udplite-ready	The UDP-Lite connection is ready.

brief: Displays brief information about NAT sessions.

verbose: Displays detailed information about NAT sessions.

Usage guidelines

If you do not specify any parameters, this command displays detailed information about session initiators of all NAT sessions.

Examples

# ‌Display detailed information about NAT sessions.

<Sysname> display nat session verbose

Slot 0:

Initiator:

Source IP/port: 192.168.1.18/1877

Destination IP/port: 192.168.1.55/22

DS-Lite tunnel peer: -

VPN instance/VLAN ID/Inline ID: -/-/-

Protocol: TCP(6)

Inbound interface: GigabitEthernet1/0/1

Responder:

Source IP/port: 192.168.1.55/22

Destination IP/port: 192.168.1.10/1877

DS-Lite tunnel peer: -

VPN instance/VLAN ID/VLL ID: -/-/-

Protocol: TCP(6)

Inbound interface: GigabitEthernet1/0/2

State: TCP_SYN_SENT

Application: SSH

Rule ID: -/-/-

Rule name:

Start time: 2011-07-29 19:12:36 TTL: 28s

Initiator->Responder: 1 packets 48 bytes

Responder->Initiator: 0 packets 0 bytes

Total sessions found: 1

# ‌Display brief information about NAT sessions.

<Sysname> display nat session brief

Slot 0:

Protocol Source IP/port Destination IP/port Global IP/port

TCP 2.1.1.20/1351 10.1.1.110/21 2.1.1.50/1025

Total sessions found: 1

Table 16 Command output

Field	Description
Initiator	Session information about the initiator.
Responder	Session information about the responder.
Source IP/port	Source IP address and port number.
Destination IP/port	Destination IP address and port number.
Global IP/port	Public IP address and port number.
DS-Lite tunnel peer	Destination address of the DS-Lite tunnel interface. If the session does not belong to any DS-Lite tunnel, this field displays a hyphen (-).
VPN instance/VLAN ID/Inline ID	The fields identify the following information: · VPN instance—MPLS L3VPN instance to which the session belongs. The VPN instance field is not supported in the current software version. · VLAN ID—VLAN ID to which the session belongs for Layer 2 forwarding. · Inline ID——INLINE to which the session belongs for Layer 2 forwarding. If no VPN instance, VLAN ID, or inline ID is specified, a hyphen (-) is displayed for the related field.
Protocol	Transport layer protocol type: DCCP, ICMP, Raw IP, SCTP, TCP, UDP, or UDP-Lite.
Inbound interface	Input interface.
State	NAT session status.
Application	Application layer protocol type, such as FTP and DNS. This field displays OTHER for the protocol types identified by non-well-known ports.
Rule ID	ID of the security policy rule.
Rule name	Name of the security policy rule.
Start time	Time when the session starts.
TTL	Remaining NAT session lifetime in seconds.
Initiator->Responder	Number of packets and packet bytes from the initiator to the responder.
Responder->Initiator	Number of packets and packet bytes from the responder to the initiator.
Total sessions found	Total number of sessions.

‌

Related commands

reset nat session

display nat static

Use display nat static to display static NAT mappings.

Syntax

display nat static

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# ‌Display static NAT mappings.

<Sysname> display nat static

Static NAT mappings:

Totally 2 inbound static NAT mappings.

Net-to-net:

Global IP : 1.1.1.1 - 1.1.1.255

Local IP : 2.2.2.0

Netmask : 255.255.255.0

ACL : 2000

Reversible : Y

NAT counting : 0

Description : NatStaticDescription1

Rule name : abcdefg

Priority : 1000

Config status: Active

IP-to-IP:

Global IP : 5.5.5.5

Local IP : 4.4.4.4

ACL : 2000

Reversible : Y

Rule name : abefg

Priority : 1000

Packet type ignore: Y

NAT counting : 0

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: local VPN, global VPN, and ACL.

Totally 2 outbound static NAT mappings.

Net-to-net:

Local IP : 1.1.1.1 - 1.1.1.255

Global IP : 2.2.2.0

Netmask : 255.255.255.0

ACL : 2000

Reversible : Y

Rule name : abefg

Priority : 1000

NAT counting : 0

Config status: Active

IP-to-IP:

Local IP : 4.4.4.4

Global IP : 5.5.5.5

ACL: : 2001

Reversible : Y

Rule name : abcd

Priority : 1000

Packet type ignore: Y

NAT counting : 0

Config status: Inactive

Reasons for inactive status:

The following items don't exist or aren't effective: ACL.

Interfaces enabled with static NAT:

Totally 2 interfaces enabled with static NAT.

Interface: GigabitEthernet1/0/2

Config status: Active

Interface: GigabitEthernet1/0/3

Config status: Active

Table 17 Command output

Field	Description
Static NAT mappings	Information about static NAT mapping configuration.
Totally n inbound static NAT mappings	Total number of inbound static NAT mappings.
Totally n outbound static NAT mappings	Total number of outbound static NAT mappings.
Net-to-net	Net-to-net static NAT mapping.
IP-to-IP	One-to-one static NAT mapping.
Local IP	Private IP address or address range.
Global IP	Public IP address or address range.
Netmask	Network mask.
ACL	ACL number or name. If no ACL is specified, this field is not displayed.
Reversible	Whether reverse address translation is allowed. If reverse address translation is allowed, this field displays Y. If reverse address translation is not allowed, this field is not displayed.
Interfaces enabled with static NAT	Interfaces on which static NAT is enabled.
Totally n interfaces enabled with static NAT	Total number of interfaces where static NAT is enabled.
Interface	Interface on which static NAT is enabled.
Rule name	Name of the NAT rule.
Priority	Priority of the NAT rule.
Packet type ignore	Whether the NAT device checks the protocol packet type when TCP, ICMP, or SCTP packet exchanges trigger the creation of session entries. · If this field displays Y, the NAT device does not check the protocol packet type. · If this field is not displayed, the NAT device checks the protocol packet type.
NAT counting	Number of times the NAT rule is matched.
Description	Description of the NAT rule. This field is not displayed if no description is configured for the rule.
Config status	Status of the static NAT mapping configuration: · Active—The configuration is taking effect. · Inactive—The configuration is not taking effect.
Reasons for inactive status	Reasons why the static NAT mapping configuration does not take effect. This field is available when the Config status field displays Inactive.

‌

Related commands

nat static enable

nat static inbound

nat static inbound net-to-net

nat static outbound

nat static outbound net-to-net

display nat statistics

Use display nat statistics to display NAT statistics.

Syntax

display nat statistics [ summary ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

summary: Displays NAT statistics summary. If you do not specify this keyword, this command displays detailed NAT statistics.

Examples

# ‌Display detailed information about NAT statistics.

<Sysname> display nat statistics

Slot 0:

Total session entries: 100

Total EIM entries: 1

Total inbound NO-PAT entries: 0

Total outbound NO-PAT entries: 0

Total static port block entries: 10

Total dynamic port block entries: 15

Active static port block entries: 0

Active dynamic port block entries: 0

Table 18 Command output

Field	Description
Total session entries	Number of NAT session entries.
Total EIM entries	Total number of EIM entries.
Total inbound NO-PAT entries	Total number of inbound NO-PAT entries.
Total outbound NO-PAT entries	Total number of outbound NO-PAT entries.
Total static port block entries	‌ Total number of static NAT444 mappings.
Total dynamic port block entries	‌ Total number of dynamic port block mappings that can be created. It equals the number of port blocks for dynamic assignment, including the assigned and unassigned port blocks.
Active static port block entries	‌ Number of static port block mappings that are in use.
Active dynamic port block entries	‌ Number of dynamic port block mappings that have been created. It equals the number of dynamically assigned port blocks.

‌

# ‌Display NAT statistics summary.

<Sysname> display nat statistics summary

EIM: Total EIM entries.

SPB: Total static port block entries.

DPB: Total dynamic port block entries.

ASPB: Active static port block entries.

ADPB: Active dynamic port block entries.

Slot Sessions EIM SPB DPB ASPB ADPB

0 100 1 10 15 0 0

Table 19 Command output

Field	Description
Sessions	Number of NAT session entries.
EIM	Number of EIM entries.
SPB	‌ Number of static NAT444 mappings.
DPB	‌ Number of dynamic port block mappings that can be created. It equals the number of port blocks for dynamic assignment, including the assigned and unassigned port blocks.
ASPB	‌ Number of static port block mappings in use.
ADPB	‌ Number of dynamic port block mappings that have been created. It equals the number of dynamically assigned port blocks.

‌

global-ip-pool

Use global-ip-pool to add a public IP address range to a NAT port block group.

Use undo global-ip-pool to remove a public IP address range from a NAT port block group.

Syntax

global-ip-pool start-address end-address

undo global-ip-pool start-address [ end-address ]

Default

No public IP address ranges exist.

Views

NAT port block group view

Predefined user roles

network-admin

Parameters

start-address end-address: Specifies the start IP address and end IP address of a public IP address range. The end IP address cannot be lower than the start IP address. If the start and end IP addresses are the same, only one public IP address is specified.

Usage guidelines

A static port block mapping maps a public IP address to multiple private IP addresses and assigns a unique port block to each private IP address. The number of port blocks that a public IP address can assign is determined by dividing the number of ports in the port range by the port block size.

Every time you execute this command, an address range can contain a maximum of 256 public IP addresses. All public IP address ranges in one port block group cannot overlap.

Public IP address ranges in different port block groups can overlap. The port ranges for overlapped public IP address ranges cannot overlap.

Examples

# Add a public IP address range to the port block group 1. The public IP address range consists of IP addresses from 202.10.1.1 to 202.10.1.10.

<Sysname> system-view

[Sysname] nat port-block-group 1

[Sysname-port-block-group-1] global-ip-pool 202.10.1.1 202.10.1.10

Related commands

nat port-block-group

inside ip

Use inside ip to add a server to an internal server group.

Use undo inside ip to remove a server from an internal server group.

Syntax

inside ip inside-ip port port-number [ weight weight-value ]

undo inside ip inside-ip port port-number

Default

An internal server group has no server members.

Views

Internal server group view

Predefined user roles

network-admin

Parameters

inside-ip: Specifies the IP address of an internal server.

port port-number: Specifies the port number of an internal server, in the range of 1 to 65535, excluding FTP port 20.

weight weight-value: Specifies the weight of the internal server. The value range is 1 to 1000, and the default value is 100.

Usage guidelines

An internal server with a larger weight receives a larger percentage of connections in the internal server group.

Examples

# Add a server with IP address 10.1.1.2 and port number 30 to internal server group 1.

<Sysname> system-view

[Sysname] nat server-group 1

[Sysname-nat-server-group-1] inside ip 10.1.1.2 port 30

Related commands

nat server-group

local-ip-address

Use local-ip-address to add a private IP address range to a NAT port block group.

Use undo local-ip-address to remove a private IP address range from a NAT port block group.

Syntax

local-ip-address start-address end-address

undo local-ip-address start-address end-address

Default

No private IP address ranges exist in a NAT port block group.

Views

NAT port block group view

Predefined user roles

network-admin

Parameters

start-address end-address: Specifies the start IP address and end IP address of a private IP address range. The end IP address cannot be lower than the start IP address. If the start and end IP addresses are the same, only one private IP address is specified.

Usage guidelines

A static port block mapping maps one public IP address to multiple private IP addresses and assigns a unique port block to each private IP address.

When you add multiple private IP address ranges to the same port block group, the private IP address ranges cannot overlap.

The private IP address ranges in different port block groups cannot overlap.

In a NAT port block group, the number of private IP addresses cannot be larger than the number of assignable port blocks. Otherwise, some private IP addresses cannot obtain port blocks. The number of port blocks that a public IP address can assign is determined by dividing the number of ports in the port range by the port block size.

Examples

# Add a private IP address range to port block group 1. The private IP address range consists of IP addresses from 172.16.1.1 to 172.16.1.255.

<Sysname> system-view

[Sysname] nat port-block-group 1

[Sysname-port-block-group-1] local-ip-address 172.16.1.1 172.16.1.255

Related commands

nat port-block-group

nat address-group

Use nat address-group to create a NAT address group and enter its view, or enter the view of an existing NAT address group.

Use undo nat address-group to delete a NAT address group.

Syntax

nat address-group group-id [ name group-name ]

undo nat address-group group-id

Default

No NAT address groups exist.

Views

System view

Configuration profile view

Predefined user roles

network-admin

Parameters

group-id: Specifies the ID of a NAT address group. The value range for this argument is 0 to 65535.

name group-name: Assigns a name to the NAT address group. The group-name argument is a case-sensitive string of 1 to 63 characters.

Usage guidelines

A NAT address group can contain multiple address ranges added by using the address command. Dynamic NAT translates the source IP address of a packet into an IP address in the address group.

Examples

# Create a NAT address group numbered 1 and named abc.

<Sysname> system-view

[Sysname] nat address-group 1 name abc

# Create a configuration profile ap1. Create NAT address group numbered 1 and named abc in the configuration profile.

<Sysname> system-view

[Sysname] configuration profile ap1 model WA6320

[Sysname-config-profile-ap1] nat address-group 1 name abc

Related commands

address

display nat address-group

display nat all

nat inbound

nat outbound

nat alg

Use nat alg to enable NAT ALG for the specified or all supported protocols.

Use undo nat alg to disable NAT ALG for the specified or all supported protocols.

Syntax

nat alg { all | dns | ftp | h323 | icmp-error | ils | mgcp | nbt | pptp | rsh | rtsp | sccp | sctp | sip | sqlnet | sunrpc | tftp | xdmcp }

undo nat alg { all | dns | ftp | h323 | icmp-error | ils | mgcp | nbt | pptp | rsh | rtsp | sccp | sip | sqlnet | sunrpc | tftp | xdmcp }

Default

NAT ALG is enabled for DNS, FTP, ICMP error messages, PPTP, and RTSP, and is disabled for the other supported protocols.

Views

System view

Predefined user roles

network-admin

Parameters

all: Enables NAT ALG for all supported protocols.

dns: Enables NAT ALG for DNS.

ftp: Enables NAT ALG for FTP.

h323: Enables NAT ALG for H.323.

icmp-error: Enables NAT ALG for ICMP error packets.

ils: Enables NAT ALG for ILS.

mgcp: Enables NAT ALG for MGCP.

nbt: Enables NAT ALG for NBT.

pptp: Enables NAT ALG for PPTP.

rsh: Enables NAT ALG for RSH.

rtsp: Enables NAT ALG for RTSP.

sccp: Enables NAT ALG for SCCP.

sctp: Enables NAT ALG for SCTP.

sip: Enables NAT ALG for SIP.

sqlnet: Enables NAT ALG for SQLNET.

sunrpc: Enables NAT ALG for SUNRPC.

tftp: Enables NAT ALG for TFTP.

xdmcp: Enables NAT ALG for XDMCP.

Usage guidelines

NAT ALG translates address or port information in the application layer payload to ensure connection establishment.

For example, an FTP application includes a data connection and a control connection. The IP address and port number for the data connection depend on the payload information of the control connection. This requires NAT ALG to translate the address and port information to establish the data connection.

Examples

# Enable NAT ALG for FTP.

<Sysname> system-view

[Sysname] nat alg ftp

Related commands

display nat all

nat dns-map

Use nat dns-map to configure a NAT DNS mapping.

Use undo nat dns-map to remove a NAT DNS mapping.

Syntax

nat dns-map domain domain-name protocol pro-type { interface interface-type interface-number | ip global-ip } port global-port

undo nat dns-map domain domain-name

Default

No NAT DNS mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

domain domain-name: Specifies the domain name of an internal server. A domain name is a dot-separated case-insensitive string that can include letters, digits, hyphens (-), underscores (_), and dots (.) (for example, example.com). The domain name can contain a maximum of 253 characters, and each separated string contains no more than 63 characters.

protocol pro-type: Specifies the type of the protocol used by the internal server, tcp or udp.

interface interface-type interface-number: Enables Easy IP to use the IP address of the interface specified by its type and number as the public address of the internal server.

ip global-ip: Specifies the public IP address used by the internal server to provide services for the external network.

port global-port: Specifies the public port number used by the internal server to provide services for the external network. The port number format can be one of the following:

· A number in the range of 1 to 65535.

· A protocol name, a string of 1 to 15 characters. For example, ftp and telnet.

Usage guidelines

NAT DNS mapping must cooperate with the NAT Server feature.

· A NAT DNS mapping maps the domain name of an internal server to the public IP address, public port number, and protocol type of the internal server.

· A NAT server mapping maps the public IP and port to the private IP and port of the internal server.

The cooperation allows an internal host to access an internal server on the same private network by using the domain name of the internal server when the DNS server is on the public network. The DNS reply from the external DNS server contains only the domain name and public IP address of the internal server in the payload. The NAT interface might have multiple internal servers configured with the same public IP address but different private IP addresses. DNS ALG might find an incorrect internal server by using only the public IP address. If a DNS mapping is configured, DNS ALG can obtain the public IP address, public port number, and protocol type of the internal server by using the domain name. Then it can find the correct internal server by using the public IP address, public port number, and protocol type of the internal server.

You can configure multiple NAT DNS mappings.

Examples

# Configure a NAT DNS mapping to map the domain name www.example.com to the public IP address 202.112.0.1, public port number 12345, and protocol type TCP.

<Sysname> system-view

[Sysname] nat dns-map domain www.example.com protocol tcp ip 202.112.0.1 port 12345

Related commands

display nat all

display nat dns-map

nat server

nat gratuitous-arp

Use nat gratuitous-arp enable to enable the NAT module to advertise public IP-MAC mappings in gratuitous ARP packets.

Use undo nat gratuitous-arp enable to d isable the NAT module from advertising public IP-MAC mappings in gratuitous ARP packets.

Syntax

nat gratuitous-arp enable

undo nat gratuitous-arp enable

Default

The NAT module advertises public IP-MAC mappings in gratuitous ARP packets.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Application scenarios

By default, the NAT module advertises public IP-MAC mappings in gratuitous ARP packets to other nodes in the same LAN. When the NAT module has too many public IP addresses, it takes a long time to send gratuitous ARP packets, which might cause ARP service anomalies. To make sure the ARP service can operate correctly, you can temporarily disable the NAT module from advertising public IP-MAC mappings in gratuitous ARP packets. After you disable this feature, the NAT module does not send gratuitous ARP packets but responds to the gratuitous ARP packets received from other nodes in the same LAN.

Restrictions and guidelines

Disable this feature with caution, because the NAT module will not send gratuitous ARP packets upon the following events:

· A public IP address changes or the VRRP group corresponding to a public IP address changes in the NAT module.

· The MAC address or virtual MAC address of an interface changes.

· Link flapping occurs on an equal-cost egress.

As a result, other nodes in the same LAN might not update MAC address entries in time, resulting in service anomalies. Before disabling this feature, make sure you have understood the potential impact.

Examples

# Disable the NAT module from advertising public IP-MAC mappings in gratuitous ARP packets.

<Sysname> system-view

[Sysname] undo nat gratuitous-arp enable

Related commands

display nat all

nat hairpin enable

Use nat hairpin enable to enable NAT hairpin.

Use undo nat hairpin enable to disable NAT hairpin.

Syntax

nat hairpin enable

undo nat hairpin enable

Default

NAT hairpin is disabled.

Views

Interface view

Predefined user roles

network-admin

Usage guidelines

NAT hairpin allows internal hosts to access each other or allows internal hosts to access internal servers. It must cooperate with NAT Server, outbound dynamic NAT, or outbound static NAT. The source and destination IP addresses of the packets are translated on the interface connected to the internal network.

When NAT hairpin works in conjunction with NAT Server, you must configure NAT server mappings in one of the following methods with a protocol type specified:

· Configuring common NAT server mappings

· Configuring load sharing NAT server mappings

Examples

# Enable NAT hairpin on interface GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat hairpin enable

Related commands

display nat all

nat outbound

nat server

nat static outbound

nat icmp-error reply

Use nat icmp-error reply to enable sending ICMP error messages upon NAT failures.

Use undo nat icmp-error reply to restore the default.

Syntax

nat icmp-error reply

undo nat icmp-error reply

Default

No ICMP error messages are sent upon NAT failures.

Views

System view

Predefined user roles

network-admin

Usage guidelines

By default, sending ICMP error messages upon NAT failures is disabled on the NAT device. Applications using the ICMP protocol cannot be notified when an event occurs. With this feature enabled, the NAT device sends ICMP error messages upon NAT failures for the applications to locate and troubleshoot the failures.

Examples

# Enable sending ICMP error messages upon NAT failures.

<Sysname> system-view

[Sysname] nat icmp-error reply

nat inbound

Use nat inbound to configure an inbound dynamic NAT rule.

Use undo nat inbound to delete an inbound dynamic NAT rule.

Syntax

nat inbound { ipv4-acl-number | name ipv4-acl-name } address-group { group-id | name group-name } [ no-pat [ reversible ] [ add-route ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ] [ description text ]

undo nat inbound { ipv4-acl-number | name ipv4-acl-name }

Default

No inbound dynamic NAT rules exist.

Views

Interface view

Interface view (in configuration profile)

Predefined user roles

network-admin

Parameters

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

address-group group-id: Specifies an address group for address translation.

group-id: Specifies the address group ID. The value range for this argument is 0 to 65535.

name group-name: Specifies the address group name, a case-insensitive string of 1 to 63 characters.

no-pat: Uses the NO-PAT mode. If you do not specify this keyword, PAT is used. PAT supports only TCP, UDP, and ICMP query packets. For an ICMP packet, the ICMP ID is used as its source port number.

reversible: Enables reverse address translation. Reverse address translation uses existing NO-PAT entries to translate the destination address for connections actively initiated from the internal network to the external network.

add-route: Automatically adds a route to the source address after translation. The output interface is the NAT interface and the next hop is the source address before translation.

rule rule-name: Specifies a name for the rule, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the rule does not have a name.

priority priority: Specifies a priority for the rule, in the range of 0 to 2147483647. The default value is 4294967295. A smaller value represents a higher priority. If you do not specify this option, the rule has the lowest priority among the same type of NAT rules.

disable: Disables the inbound dynamic NAT rule. If you do not specify this keyword, the rule is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

description text: Specifies a description for the inbound dynamic NAT rule. The text argument is a case-insensitive string of 1 to 63 characters.

Usage guidelines

Inbound dynamic NAT translates the source IP addresses of incoming packets permitted by the ACL into IP addresses in the address group.

Inbound dynamic NAT supports the following modes:

· PAT—Performs both IP address translation and port translation.

· NO-PAT—Performs only IP address translation.

The NO-PAT mode supports reverse address translation. Reverse address translation uses ACL reverse matching to identify packets to be translated. ACL reverse matching works as follows:

· Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

· Translates the destination IP address of the packet according to the matching NO-PAT entry, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Inbound dynamic NAT typically cooperates with one of the following to implement bidirectional NAT:

· Outbound dynamic NAT (the nat outbound command).

· NAT Server (the nat server command).

· Outbound static NAT (the nat static command).

An address group cannot be used by both the nat inbound and nat outbound commands. It cannot be used by the nat inbound command in both PAT and NO-PAT modes.

Do not specify the add-route keyword if the subnets where the internal and external networks reside overlap. For other network scenarios:

· If you specify the add-route keyword, the device automatically adds a route to the source address after translation for a packet. The destination address is the NAT address in the NAT address group, the output interface is the interface where the command is executed, and the next hop is the source address before translation. To avoid communication failure caused by ARP resolution failure, configure a route on the device in the following condition:

To ensure successful communication, when the device receives a packet in which the source address and its input interface address belong to different network segments, it typically performs ARP resolution on the source address to obtain its corresponding MAC address. However, if ARP resolution fails, the packet cannot reach its destination, causing communication failure.

To resolve such an issue, configure a static route on the device. Configure the destination address of the static route as the source address of the packet and the next hop address as the peer device address in the target network. The 32-bit host route (with a mask of 255.255.255.255) makes sure all packets sent to the source address can be forwarded to the correct next hop, which does not need ARP resolution. The configuration avoids ARP resolution failure in communication between different network segments and ensures network stability and communication reliability.

· If you do not specify the add-route keyword, you must manually add the route. As a best practice, add routes manually because automatic route adding is slow.

An ACL can be used by only one inbound dynamic NAT rule on an interface.

You can configure multiple inbound dynamic NAT rules on an interface.

Inbound dynamic NAT rules configured with the same priority value are matched by using their ACLs.

· NAT rules with named ACLs have higher priorities than NAT rules with unnamed ACLs.

· NAT rules with named ACLs are matched in alphabetical order of their ACL names.

· NAT rules with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure ACL 2001 to permit packets only from subnet 10.110.10.0/24 to pass through.

<Sysname> system-view

[Sysname] acl basic 2001

[Sysname-acl-ipv4-basic-2001] rule permit source 10.110.10.0 0.0.0.255

[Sysname-acl-ipv4-basic-2001] rule deny

[Sysname-acl-ipv4-basic-2001] quit

# Create address group 1 and add the address range of 202.110.10.10 to 202.110.10.12 to the group.

[Sysname] nat address-group 1

[Sysname-address-group-1] address 202.110.10.10 202.110.10.12

[Sysname-address-group-1] quit

# Configure an inbound NO-PAT rule on interface GigabitEthernet 1/0/1. NAT translates the source addresses of incoming packets into the addresses in address group 1, and automatically adds routes for translated packets. Set the rule name to abc, and the priority to 0.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat inbound 2001 address-group 1 no-pat add-route rule abc priority 0

# Create a configuration profile ap1. In the configuration profile, configure ACL 2001 to permit packets only from subnet 10.110.10.0/24 to pass through.

<Sysname> system-view

[Sysname] configuration profile ap1 model WA6320

[Sysname-config-profile-ap1] acl basic 2001

[Sysname-config-profile-ap1-acl-ipv4-basic-2001] rule permit source 10.110.10.0 0.0.0.255

[Sysname-config-profile-ap1-acl-ipv4-basic-2001] rule deny

[Sysname-config-profile-ap1-acl-ipv4-basic-2001] quit

# In configuration profile ap1, create address group 1 and add the address range of 202.110.10.10 to 202.110.10.12 to the group.

[Sysname-config-profile-ap1] nat address-group 1

[Sysname-config-profile-ap1-address-group-1] address 202.110.10.10 202.110.10.12

[Sysname-config-profile-ap1-address-group-1] quit

# In configuration profile ap1, configure an inbound NO-PAT rule on interface VLAN-interface 10. NAT translates the source addresses of incoming packets into the addresses in address group 1, and automatically adds routes for translated packets. Set the rule name to abc, and the priority to 0.

[Sysname-config-profile-ap1] interface vlan-interface 10

[Sysname-config-profile-ap1-Vlan-interface10] nat inbound 2001 address-group 1 no-pat add-route rule abc priority 0

Related commands

display nat all

display nat inbound

display nat no-pat

nat inbound rule move

Use nat inbound rule move to change the priority of an inbound dynamic NAT rule.

Syntax

nat inbound rule move nat-rule-name1 { after | before } nat-rule-name2

Views

Interface view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the rule be moved.

after: Moves the rule nat-rule-name1 to the line after the rule nat-rule-name2 (called the reference rule). The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule plus one.

before: Moves the rule nat-rule-name1 to the line before the rule nat-rule-name2. The priority value of the reference rule is not changed. The priority value of the moved rule equals the priority value of the reference rule minus one.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named inbound dynamic NAT rules.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the inbound dynamic NAT rule abc to the line before the rule def.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat inbound rule move abc before def

Related commands

nat inbound

nat log alarm

Use nat log alarm to enable NAT alarm logging.

Use undo nat log alarm to disable NAT alarm logging.

Syntax

nat log alarm

undo nat log alarm

Default

NAT alarm logging is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Packets that need to be translated are dropped if the NAT resources are not enough. In NO-PAT, the NAT resources refer to the public IP addresses. In EIM PAT, the NAT resources refer to public IP addresses and ports. In NAT444, the NAT resources refer to public IP addresses, port blocks, or ports in port blocks. NAT alarm logging monitors the usage of NAT resources and outputs logs if the NAT resources are not enough.

For NAT444 dynamic port block mappings, an alarm log is generated upon the port block assignment failure or the failure that port resources cannot meet the user address translation requirement.

Before configuring alarm logging for NAT, you must configure the custom NAT log generation and outputting features. For more information about information center, see System Management Configuration Guide.

This command take effect only after you use the nat log enable command to enable NAT logging.

Examples

# Enable NAT alarm logging.

<Sysname> system-view

[Sysname] nat log alarm

Related commands

display nat all

display nat log

nat log enable

Use nat log enable to enable NAT logging.

Use undo nat log enable to disable NAT logging.

Syntax

nat log enable [ acl { ipv4-acl-number | name ipv4-acl-name } ]

undo nat log enable

Default

NAT logging is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

acl: Specifies an ACL.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

Usage guidelines

You must enable NAT logging before you enable NAT session logging, NAT444 user logging (including port block assignment and withdrawal logging), NAT alarm logging, or NAT NO-PAT logging.

The acl keyword takes effect only for NAT session logging. If an ACL is specified, flows matching the permit rule might trigger NAT session logs. If you do not specify an ACL, all flows processed by NAT might trigger NAT session logs.

Examples

# Enable NAT logging.

<Sysname> system-view

[Sysname] nat log enable

Related commands

display nat all

display nat log

nat log alarm

nat log flow-active

nat log flow-begin

nat log flow-end

· nat log port-block-assign

· nat log port-block-withdraw

nat log flow-active

Use nat log flow-active to enable logging for active NAT flows and set the logging interval.

Use undo nat log flow-active to disable logging for active NAT flows.

Syntax

nat log flow-active time-value

undo nat log flow-active

Default

Logging for active NAT flows is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

time-value: Specifies the interval for logging active NAT flows, in the range of 1 to 6000 minutes.

Usage guidelines

Active NAT flows are NAT sessions that last for a long time. The logging feature helps track active NAT flows by periodically logging the active NAT flows.

Logging for active NAT flows takes effect only after you enable NAT logging.

Examples

# Enable logging for active NAT flows and set the logging interval to 10 minutes.

<Sysname> system-view

[Sysname] nat log flow-active 10

Related commands

display nat all

display nat log

nat log enable

nat log flow-begin

Use nat log flow-begin to enable logging for NAT session establishment events.

Use undo nat log flow-begin to disable logging for NAT session establishment events.

Syntax

nat log flow-begin

undo nat log flow-begin

Default

Logging for NAT session establishment events is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Logging for NAT session establishment events takes effect only after you enable NAT logging.

Examples

# Enable logging for NAT session establishment events.

<Sysname> system-view

[Sysname] nat log flow-begin

Related commands

display nat all

display nat log

nat log enable

nat log flow-end

Use nat log flow-end to enable logging for NAT session removal events.

Use undo nat log flow-end to disable logging for NAT session removal events.

Syntax

nat log flow-end

undo nat log flow-end

Default

Logging for NAT session removal events is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Logging for NAT session removal events takes effect only after you enable NAT logging.

Examples

# Enable logging for NAT session removal events.

<Sysname> system-view

[Sysname] nat log flow-end

Related commands

display nat all

display nat log

nat log enable

nat log flow-match

Use nat log flow-match to enable fast output of new NAT flow logs.

Use undo nat log flow-match to disable fast output of new NAT flow logs.

Syntax

nat log flow-match

undo nat log flow-match

Default

Fast output of new NAT flow logs is enabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Application scenarios

Use this feature in scenarios that require fast output of new NAT flow logs.

Operating mechanism

NAT supports fast outputting new flow logs to log hosts or Data Analysis Center (DAC), which meets the requirements for simplified configuration and fast output of new NAT flow logs.

· In a scenario where new flow logs are output to log hosts, perform the following tasks after you configure the customlog host v2 command and exporting NAT logs:

¡ If fast output of new NAT flow logs is not enabled, you must configure both the nat log enable and nat log flow-begin commands.

¡ If fast output of new NAT flow logs is enabled, you do not need to configure the nat log enable or nat log flow-begin command.

· In a scenario where new flow logs are output to DAC, perform the following tasks after you configure the dac log-collect service nat flow_log enable command:

¡ If fast output of new NAT flow logs is not enabled, you must configure both the nat log enable and nat log flow-begin commands.

¡ If fast output of new NAT flow logs is enabled, you do not need to configure the nat log enable or nat log flow-begin command.

For more information about DAC, see data analysis center in DPI Configuration Guide.

Restrictions and guidelines

With fast output of new NAT flow logs enabled, the NAT device generates the following types of logs when a new flow is established if both the nat log enable and nat log flow-begin commands are configured:

· NAT_FLOW.

· NAT_IPV4_MATCH.

· NAT_IPV6_MATCH.

Examples

# Enable fast output of new NAT flow logs.

<Sysname> system-view

[Sysname] nat log flow-match

Related commands

customlog host v2 (Network Management and Monitoring Command Reference)

dac log-collect enable (DPI Command Reference)

nat log no-pat ip-usage

Use nat log no-pat ip-usage to enable logging for the IP usage of a NAT address group in NO-PAT mode and set a usage threshold.

Use undo nat log no-pat ip-usage to disable logging for the IP usage of a NAT address group in NO-PAT mode.

Syntax

nat log no-pat ip-usage [ threshold value ]

undo nat log no-pat ip-usage

Default

Logging for the IP usage of a NAT address group is disabled.

Views

System view

Predefines user roles

network-admin

Parameters

threshold value: Specifies the IP usage threshold of a NAT address group, in percentage. The value range is 40 to 100, and the default is 90%.

Usage guidelines

The system generates a log if the IP usage of a NAT address group exceeds the threshold.

This command takes effect only after you enable the NAT logging by using the nat log enable command.

Examples

# Enable logging for the IP usage of a NAT address group in NO-PAT mode and set the threshold to 60%.

<Sysname> system-view

[Sysname] nat log no-pat ip-usage threshold 60

Related commands

display nat log

display nat no-pat ip-usage

nat log enable

nat log port-block usage threshold

Use nat log port-block usage threshold to set the port block usage threshold.

Use undo nat log port-block port-usage threshold to restore the default.

Syntax

nat log port-block usage threshold threshold-value

undo nat log port-block usage threshold

Default

The port block usage threshold is 90%.

Views

System view

Predefined user roles

network-admin

Parameters

threshold-value: Specifies a threshold in the range of 40 to 100 in percentage.

Usage guidelines

A log is generated when the port block usage exceeds the threshold.

Examples

# Set the port block usage threshold to 60%.

<Sysname> system-view

[Sysname] nat log port-block usage threshold 60

Related commands

display nat all

display nat log

nat log enable

nat log port-block-assign

Use nat log port-block-assign to enable NAT444 user logging for port block assignment.

Use undo nat log port-block-assign to disable NAT444 user logging for port block assignment.

Syntax

nat log port-block-assign

undo nat log port-block-assign

Default

NAT444 user logging is disabled for port block assignment.

Views

System view

Predefined user roles

network-admin

Usage guidelines

For static port block mappings, the NAT444 gateway generates a user log when it translates the first connection from a private IP address.

For dynamic port block mappings, the NAT444 gateway generates a user log when it assigns or extends a port block for a private IP address.

This command takes effect only after you use the nat log enable command to enable NAT logging.

Examples

# Enable NAT444 user logging for port block assignment.

<Sysname> system-view

[Sysname] nat log port-block-assign

Related commands

display nat all

display nat log

nat log enable

nat log port-block-withdraw

Use nat log port-block-withdraw to enable NAT444 user logging for port block withdrawal.

Use undo nat log port-block-withdraw to disable NAT444 user logging for port block withdrawal.

Syntax

nat log port-block-withdraw

undo nat log port-block-withdraw

Default

NAT444 user logging is disabled for port block withdrawal.

Views

System view

Predefined user roles

network-admin

Usage guidelines

For static port block mappings, the NAT444 gateway generates a user log when all connections from a private IP address are disconnected.

For dynamic port block mappings, the NAT444 gateway generates a user log when all the following conditions are met:

· The port blocks (including the extended ones) assigned to the private IP address are withdrawn.

· The corresponding mapping entry is deleted.

This command takes effect only after you use the nat log enable command to enable NAT logging.

Examples

# Enable NAT444 user logging for port block withdrawal.

<Sysname> system-view

[Sysname] nat log port-block-withdraw

Related commands

display nat all

display nat log

nat log enable

nat mapping-behavior endpoint-independent

Use nat mapping-behavior endpoint-independent to specify the Endpoint-Independent Mapping (EIM) mode for PAT.

Use undo nat mapping-behavior to restore the default.

Syntax

nat mapping-behavior endpoint-independent [ acl { ipv4-acl-number | name ipv4-acl-name } ]

undo nat mapping-behavior endpoint-independent

Default

Address and Port-Dependent Mapping applies.

Views

System view

Predefined user roles

network-admin

Parameters

acl: Specifies an ACL to define the applicable scope of Endpoint-Independent Mapping.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

Usage guidelines

PAT supports the following NAT mapping modes:

· Endpoint-Independent Mapping—Uses the same IP and port mapping (EIM entry) for packets from the same source and port to any destination. EIM allows external hosts to access the internal hosts by using the NAT IP address and port. It allows internal hosts behind different NAT gateways to access each other.

· Address and Port-Dependent Mapping—Uses different IP and port mappings for packets with the same source IP and port to different destination IP addresses and ports. APDM allows an external host to access an internal host only under the condition that the internal host has previously accessed the external host. It is secure, but it does not allow internal hosts behind different NAT gateways to access each other.

This command takes effect only on outbound PAT. Address and Port-Dependent Mapping always applies to inbound PAT.

If you specify an ACL, Endpoint-Independent Mapping applies to packets that are permitted by the ACL. If you do not specify an ACL, Endpoint-Independent Mapping applies to all packets.

Examples

# Apply the Endpoint-Independent Mapping mode to all packets for address translation.

<Sysname> system-view

[Sysname] nat mapping-behavior endpoint-independent

# Apply the Endpoint-Independent Mapping mode to FTP and HTTP packets, and the Address and Port-Dependent Mapping mode to other packets for address translation.

<Sysname> system-view

[Sysname] acl advanced 3000

[Sysname-acl-ipv4-adv-3000] rule permit tcp destination-port eq 80

[Sysname-acl-ipv4-adv-3000] rule permit tcp destination-port eq 21

[Sysname-acl-ipv4-adv-3000] quit

[Sysname] nat mapping-behavior endpoint-independent acl 3000

Related commands

nat outbound

display nat eim

nat outbound

Use nat outbound to configure an outbound dynamic NAT rule.

Use undo nat outbound to delete an outbound dynamic NAT rule.

Syntax

NO-PAT:

nat outbound [ ipv4-acl-number | name ipv4-acl-name ] address-group { group-id | name group-name } no-pat [ reversible ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ] [ description text ]

undo nat outbound [ ipv4-acl-number | name ipv4-acl-name ]

PAT:

nat outbound [ ipv4-acl-number | name ipv4-acl-name ] [ address-group { group-id | name group-name } ] [ port-preserved ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ] [ description text ]

undo nat outbound [ ipv4-acl-number | name ipv4-acl-name ]

Default

No outbound dynamic NAT rules exist.

Views

Interface view

Interface view (in configuration profile)

Predefined user roles

network-admin

Parameters

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

address-group: Specifies an address group for NAT. If you do not specify an address group, the IP address of the interface is used as the NAT address. Easy IP is used.

group-id: Specifies the address group ID. The value range for this argument is 0 to 65535.

name group-name: Specifies the address group name, a case-insensitive string of 1 to 63 characters.

no-pat: Uses the NO-PAT mode. If you do not specify this keyword, PAT is used. PAT only supports TCP, UDP, and ICMP query packets. For an ICMP packet, the ICMP ID is used as its source port number.

port-preserved: Tries to preserve port number for PAT. This keyword does not take effect on dynamic NAT port block mapping.

disable: Disables the outbound dynamic NAT rule. If you do not specify this keyword, the rule is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

description text: Specifies a description for the outbound dynamic NAT rule. The text argument is a case-insensitive string of 1 to 63 characters.

Usage guidelines

Outbound dynamic NAT is typically configured on the interface connected to the external network. You can configure multiple outbound dynamic NAT rules on an interface.

Outbound dynamic NAT supports the following modes:

· PAT—Performs both IP address translation and port translation. The PAT mode allows external hosts to actively access the internal hosts if the Endpoint-Independent Mapping behavior is used.

· NO-PAT—Performs only IP address translation. The NO-PAT mode allows external hosts to actively access the internal hosts if you specify the reversible keyword. If an ACL is specified, reverse address translation only applies to packets permitted by ACL reverse matching. ACL reverse matching works as follows:

¡ Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡ Translates the destination IP address of the packet according to the matching NO-PAT entry, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Dynamic NAT444 does not support the NO-PAT mode.

When you specify a NAT address group, follow these restrictions and guidelines:

· An address group cannot be used by both the nat inbound and nat outbound commands.

· An address group cannot be used by the nat outbound command in both PAT and NO-PAT modes.

· When port block parameters are specified in the NAT address group, this command configures a dynamic NAT port block mapping. Packets matching the ACL permit rule are processed by dynamic NAT444.

When you specify an ACL, follow these restrictions and guidelines:

· An ACL can be used by only one outbound dynamic NAT rule on an interface.

· If you configure multiple outbound dynamic NAT rules, only one outbound dynamic NAT rule can contain no ACL.

· If you specify an ACL, NAT translates the source IP addresses of outgoing packets permitted by the ACL into IP addresses in the address group. If you do not specify an ACL, NAT translates all packets.

· Outbound dynamic NAT rules with ACLs configured on an interface takes precedence over those without ACLs. If two ACL-based dynamic NAT rules are configured, the rule with the higher ACL number has higher priority.

Outbound dynamic NAT rules configured with the same priority value and an ACL are matched by using the ACLs in the rule.

· NAT rules with named ACLs have higher priorities than NAT rules with unnamed ACLs.

· NAT rules with named ACLs are matched in alphabetical order of their ACL names.

· NAT rules with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure ACL 2001 to permit packets only from subnet 10.110.10.0/24 to pass through.

<Sysname> system-view

[Sysname] acl basic 2001

[Sysname-acl-ipv4-basic-2001] rule permit source 10.110.10.0 0.0.0.255

[Sysname-acl-ipv4-basic-2001] rule deny

[Sysname-acl-ipv4-basic-2001] quit

# Create address group 1 and add the address range of 202.110.10.10 to 202.110.10.12 to the group.

[Sysname] nat address-group 1

[Sysname-address-group-1] address 202.110.10.10 202.110.10.12

[Sysname-address-group-1] quit

# Configure an outbound dynamic PAT rule on interface GigabitEthernet 1/0/1 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat outbound 2001 address-group 1

[Sysname-GigabitEthernet1/0/1] quit

# Configure an outbound NO-PAT rule on interface GigabitEthernet 1/0/1 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat outbound 2001 address-group 1 no-pat

[Sysname-GigabitEthernet1/0/1] quit

# Enable Easy IP to use the IP address of GigabitEthernet 1/0/1 as the NAT address.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet 1/0/1] nat outbound 2001

[Sysname-GigabitEthernet 1/0/1] quit

# Configure an outbound NO-PAT rule on GigabitEthernet 1/0/1 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1. Enable reverse address translation.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat outbound 2001 address-group 1 no-pat reversible

# Create a configuration profile ap1. In the configuration profile, configure ACL 2001 to permit packets only from subnet 10.110.10.0/24 to pass through.

<Sysname> system-view

[Sysname] configuration profile ap1 model WA6320

[Sysname-config-profile-ap1] acl basic 2001

[Sysname-config-profile-ap1-acl-ipv4-basic-2001] rule permit source 10.110.10.0 0.0.0.255

[Sysname-config-profile-ap1-acl-ipv4-basic-2001] rule deny

[Sysname-config-profile-ap1-acl-ipv4-basic-2001] quit

# In configuration profile ap1, create address group 1 and add the address range of 202.110.10.10 to 202.110.10.12 to the group.

[Sysname-config-profile-ap1] nat address-group 1

[Sysname-config-profile-ap1-address-group-1] address 202.110.10.10 202.110.10.12

[Sysname-config-profile-ap1-address-group-1] quit

# In configuration profile ap1, configure an outbound dynamic PAT rule on interface VLAN-interface 10 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1.

[Sysname-config-profile-ap1] interface vlan-interface 10

[Sysname-config-profile-ap1-Vlan-interface10] nat outbound 2001 address-group 1

[Sysname-config-profile-ap1-Vlan-interface10] quit

# Configure an outbound NO-PAT rule on interface VLAN-interface 10 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1.

[Sysname-config-profile-ap1] interface vlan-interface 10

[Sysname-config-profile-ap1-Vlan-interface10] nat outbound 2001 address-group 1 no-pat

[Sysname-config-profile-ap1-Vlan-interface10] quit

# Enable Easy IP to use the IP address of VLAN-interface 10 as the translated address.

[Sysname-config-profile-ap1] interface vlan-interface 10

[Sysname-config-profile-ap1-Vlan-interface10] nat outbound 2001

[Sysname-config-profile-ap1-Vlan-interface10] quit

# Configure an outbound NO-PAT rule on VLAN-interface 10 to translate the source addresses of outgoing packets permitted by ACL 2001 into the addresses in address group 1. Enable reverse address translation.

[Sysname-config-profile-ap1] interface vlan-interface 10

[Sysname-config-profile-ap1-Vlan-interface10] nat outbound 2001 address-group 1 no-pat reversible

Related commands

display nat eim

display nat outbound

nat mapping-behavior

nat outbound port-block-group

Use nat outbound port-block-group to configure a static outbound port block mapping rule on an interface.

Use undo nat outbound port-block-group to delete a static port block mapping rule on an interface.

Syntax

nat outbound port-block-group group-id [ rule rule-name ] [ counting ]

undo nat outbound port-block-group group-id

Default

No static outbound port block mapping rule is configured on an interface.

Views

Interface view

Predefined user roles

network-admin

Parameters

group-id: Specifies a NAT port block group by its ID. The value range for this argument is 0 to 65535.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

After you configure this command on an interface, the system automatically computes the mappings and creates entries for them. When a private IP address accesses the public network, the private IP address is translated to the mapped public IP address, and the ports are translated to ports in the selected port block.

You can configure multiple port block mapping rules on an interface.

Examples

# Configure a static outbound port block mapping rule on GigabitEthernet 1/0/1, and specify the rule name as abc.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat outbound port-block-group 1 rule abc

Related commands

display nat all

display nat outbound port-block-group

display nat port-block

nat port-block-group

nat outbound rule move

Use nat outbound rule move to change the priority of an outbound dynamic NAT rule.

Syntax

nat outbound rule move nat-rule-name1 { after | before } nat-rule-name2

Views

Interface view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named outbound dynamic NAT rules.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the outbound dynamic NAT rule abc to the line before the rule def.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat outbound rule move abc before def

Related commands

nat outbound

nat port-block global-share enable

Use nat port-block global-share enable to enable port block global sharing.

Use undo nat port-block global-share enable to disable port block global sharing.

Syntax

nat port-block global-share enable

undo nat port-block global-share enable

Default

Port block global sharing is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When multiple interfaces have dynamic NAT port block mapping configured, the interfaces might create different port block mappings for packets from the same IP address. You can use this command to configure the interfaces to use the same port block mapping for translating packets from the same IP address.

Examples

# Enable port block global sharing.

<Sysname> system-view

[Sysname] nat port-block global-share enable

Related commands

port-block

nat port-block-group

Use nat port-block-group to create a NAT port block group and enter its view, or enter the view of an existing NAT port block group.

Use undo nat port-block-group to delete a NAT port block group.

Syntax

nat port-block-group group-id

undo nat port-block-group group-id

Default

No NAT port block groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Assigns an ID to the NAT port block group. The value range for this argument is 0 to 65535.

Usage guidelines

A NAT port block group is configured to implement static port block mapping for NAT444.

You must configure the following items for a NAT port block group:

· A minimum of one private IP address range (see the local-ip-address command).

· A minimum of one public IP address range (see the global-ip-address command).

· A port range (see the port-range command).

· A port block size (see the block-size command).

The system computes static port block mappings according to the port block group configuration, and creates entries for the mappings.

Examples

# Create NAT port block group 1.

<Sysname>system-view

[Sysname]nat port-block-group 1

[Sysname-port-block-group-1]

Related commands

block-size

display nat all

display nat port-block-group

global-ip-pool

local-ip-address

nat outbound port-block-group

port-range

nat redirect reply-route

Use nat redirect reply-route enable to enable NAT reply redirection.

Use undo nat redirect reply-route enable to disable NAT reply redirection.

Syntax

nat redirect reply-route enable

undo nat redirect reply-route enable

Default

NAT reply redirection is disabled.

Views

Interface view

Predefined user roles

network-admin

Usage guidelines

NAT reply redirection allows an interface to use the NAT session entry information to translate the destination IP addresses for NAT reply packets and find the output interfaces for the NATed reply packets.

Examples

# Enable NAT reply redirection on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat redirect reply-route enable

nat server

Use nat server to create a NAT server mapping (also called NAT server rule). The mapping maps the private IP address and port of an internal server to a public address and port.

Use undo nat server to delete a NAT server mapping.

Syntax

Common NAT server mapping:

· A single public address with no or a single public port:

nat server [ protocol pro-type ] global { global-address | current-interface | interface interface-type interface-number } [ global-port ] inside local-address [ local-port ] [ acl { ipv4-acl-number | name ipv4-acl-name } ] [ reversible ] [ rule rule-name ] [ disable ] [ counting ] [ description text ]

undo nat server [ protocol pro-type ] global { global-address | current-interface | interface interface-type interface-number } [ global-port ]

· A single public address with consecutive public ports:

nat server protocol pro-type global { global-address | current-interface | interface interface-type interface-number } global-port1 global-port2 inside { { local-address | local-address1 local-address2 } local-port | local-address local-port1 local-port2 } [ acl { ipv4-acl-number | name ipv4-acl-name } ] [ rule rule-name ] [ disable ] [ counting ] [ description text ]

undo nat server protocol pro-type global { global-address | current-interface | interface interface-type interface-number } global-port1 global-port2

· Consecutive public addresses with no public port:

nat server protocol pro-type global global-address1 global-address2 inside { local-address | local-address1 local-address2 } [ local-port ] [ acl { ipv4-acl-number | name ipv4-acl-name } ] [ rule rule-name ] [ disable ] [ counting ] [ description text ]

undo nat server protocol pro-type global global-address1 global-address2 [ global-port ]

· Consecutive public addresses with one single public port:

nat server protocol pro-type global global-address1 global-address2 global-port inside { local-address [ local-port1 local-port2 ] | [ local-address | local-address1 local-address2 ] [ local-port ] } [ acl { ipv4-acl-number | name ipv4-acl-name } ] [ rule rule-name ] [ disable ] [ counting ] [ description text ]

undo nat server protocol pro-type global global-address1 global-address2 global-port

Load sharing NAT server mapping:

nat server protocol pro-type global { { global-address | current-interface | interface interface-type interface-number } { global-port | global-port1 global-port2 } | global-address1 global-address2 global-port } inside server-group group-id [ acl { ipv4-acl-number | name ipv4-acl-name } ] [ rule rule-name ] [ disable ] [ counting ] [ description text ]

undo nat server protocol pro-type global { { global-address | current-interface | interface interface-type interface-number } { global-port | global-port1 global-port2 } | global-address1 global-address2 global-port }

ACL-based NAT server mapping:

nat server global { ipv4-acl-number | name ipv4-acl-name } inside local-address [ local-port ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ] [ description text ]

undo nat server global { ipv4-acl-number | name ipv4-acl-name }

Default

No NAT server mappings exist.

Views

Interface view

Predefined user roles

network-admin

Parameters

protocol pro-type: Specifies a protocol type. When the protocol is TCP or UDP, NAT Server can be configured with port information. If you do not specify a protocol type, the command applies to packets of all protocols. The protocol type format can be one of the following:

· A number in the range of 1 to 255.

· A protocol name of icmp, tcp, or udp.

global: Specifies the public network information about the internal server.

global-address: Specifies the public address of an internal server.

global-address1 global address2: Specifies a public IP address range, which can include a maximum of 10000 addresses. The global-address1 argument specifies the start address, and the global address2 argument specifies the end address that must be greater than the start address.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

current-interface: Enables Easy IP on the current interface. The primary IP address of the interface is used as the public address for the internal server.

interface interface-type interface-number: Enables Easy IP on the interface specified by its type and number. The primary IP address of the interface is used as the public address for the internal server. Only loopback interfaces are supported.

global-port1 global-port2: Specifies a public port number range, which can include a maximum of 10001 ports. The global-port1 argument specifies the start port, and the global-port2 argument specifies the end port that must be greater than the start port. The public port number format can be one of the following:

· A number in the range of 1 to 65535. Both the start port and the end port support this format.

· A protocol name, a string of 1 to 15 characters. For example, http and telnet. Only the start port supports this format.

inside: Specifies the private network information about the internal server.

local-address1 local-address2: Specifies a private IP address range. The local-address1 argument specifies the start address, and the local-address2 argument specifies the end address that must be greater than the start address. The number of addresses in the range must equal the number of ports in the public port number range.

local-port: Specifies the private port number. The private port number format can be one of the following:

· A number in the range of 1 to 65535, excluding FTP port 20.

· A protocol name, a string of 1 to 15 characters. For example, http and telnet.

global-port: Specifies the public port number. The default value and value range are the same as those for the local-port argument.

local-address: Specifies the private IP address.

server-group group-id: Specifies the internal server group to which the internal server belongs. With this parameter, the load sharing NAT Server feature is configured. The group-id argument specifies the internal server group ID. The value range for the group-id argument is 0 to 65535.

acl: Specifies an ACL. If you specify an ACL, only packets permitted by the ACL can be translated by using the mapping.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Allows reverse address translation. Reverse address translation applies to connections actively initiated by internal servers to the external network. It translates the private IP addresses of the internal servers to their public IP addresses.

rule rule-name: Specifies a name for the mapping, a case-sensitive string of 1 to 63 characters. It cannot contain backward slashes (\), forward slashes (/), colons (:), asterisks (*), question marks (?), left angle brackets (<), right angle brackets (>), vertical bars (|), quotation marks ("), or at signs (@). If you do not specify this option, the mapping does not have a name.

priority priority: Specifies a priority for the mapping, in the range of 0 to 2147483647. The default value is 4294967295. A smaller value represents a higher priority. If you do not specify this option, the mapping has the lowest priority among the same type of NAT rules.

disable: Disables the NAT server mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

description text: Specifies a description for the NAT server mapping. The text argument is a case-insensitive string of 1 to 63 characters.

Usage guidelines

You can configure the NAT server mapping to allow servers (such as Web, FTP, Telnet, POP3, and DNS servers) in the internal network to provide services for external users.

NAT server mappings are usually configured on the interface connected to the external network on a NAT device. By using the global-address and global-port arguments, external users can access the internal server at local-address and local-port. When the protocol type is not udp (protocol number 17) or tcp (protocol number 6), you can configure only one-to-one IP address mappings. The following table describes the address-port mappings between an external network and an internal network for NAT Server.

Table 20 Address-port mappings for NAT Server

External network	Internal network
One public address	One private address
One public address and one public port number	One private address and one private port number
One public address and N consecutive public port numbers	· One private address and one private port number · N consecutive private addresses and one private port number · One private address and N consecutive private port numbers
N consecutive public addresses	· One private address · N consecutive private addresses
N consecutive public addresses and one public port number	· One private address and one private port number · N consecutive private addresses and one private port number · One private address and N consecutive private port numbers
One public address and one public port number	One internal server group
One public address and N consecutive public port numbers
N consecutive public addresses and one public port number
Public addresses matching an ACL	One private address
Public addresses matching an ACL	One private address and one private port

‌

The mapping of the protocol type, public address, and public port number must be unique for an internal server on an interface. This restriction also applies when Easy IP is used. The maximum number of NAT server mappings equals the number of public ports in the specified public port range.

As a best practice, do not configure Easy IP for multiple NAT server mappings by using the same interface.

If the IP address of an interface used by Easy IP changes and conflicts with the IP address of a NAT server mapping not using Easy IP, the Easy IP configuration becomes invalid. If the conflicting IP address is modified to another IP address or the NAT server mapping without Easy IP is removed, the Easy IP configuration takes effect.

When you configure a load sharing NAT server mapping, you must make sure a user uses the same public address and public port to access the same service on an internal server. For this purpose, make sure value N in the following mappings is equal to or less than the number of servers in the internal server group:

· One public address and N consecutive public port numbers are mapped to one internal server group.

· N consecutive public addresses and a public port number are mapped to one internal server group.

ACL-based NAT server mappings that are configured with the same priority value are matched by using the ACLs in their rules:

· Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

· Mappings with named ACLs are matched in alphabetical order of their ACL names.

· Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

An error message for a rollback failure when you perform a configuration rollback for an internal server in the following situation:

· In the running configuration, the name of a NAT server mapping is assigned automatically by the system.

· In the replacement configuration file, the name does not exist.

The system will compare the running configuration file and the replacement file, and display an error message about the mismatch. You can ignore the error message because the NAT server mapping configuration in the configuration file is installed successfully. For example, the NAT server mapping configuration is nat server global 112.1.1.1 inside 192.168.20.1 in the running configuration, and the is nat server global 112.1.1.1 inside 192.168.20.1 rule ServerRule_num in the replacement configuration file. After the rollback operation, the new NAT server configuration is successfully installed.

Examples

# Allow external users to access the internal Web server at 10.110.10.10 through https://202.110.10.10:8080.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat server protocol tcp global 202.110.10.10 8080 inside 10.110.10.10 https

[Sysname-GigabitEthernet1/0/1] quit

# Configure an ACL-based NAT server mapping to allow users to use IP addresses in subnet 192.168.0.0/24 to access the internal server at 10.0.0.172.

<Sysname> system-view

[Sysname] acl advanced 3000

[Sysname-acl-ipv4-adv-3000] rule 5 permit ip destination 192.168.0.0 0.0.0.255

[Sysname-acl-ipv4-adv-3000] quit

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat server global 3000 inside 10.0.0.172

Related commands

display nat all

display nat server

nat server-group

nat server rule move

Use nat server rule move to change the priority of an ACL-based NAT server rule.

Syntax

nat server rule move nat-rule-name1 { after | before } nat-rule-name2

Views

Interface view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

This command is applicable only to named ACL-based NAT server rules.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the ACL-based NAT server rule abc to the line before the ACL-based NAT server rule def.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat server rule move abc before def

Related commands

nat server

nat server-group

Use nat server-group to create an internal server group and enter its view, or enter the view of an existing internal server group.

Use undo nat server-group to delete an internal server group.

Syntax

nat server-group group-id

undo nat server-group group-id

Default

No internal server groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Assigns an ID to the internal server group.The value range for this argument is 0 to 65535.

Usage guidelines

An internal server group can contain multiple members configured by the inside ip command.

Examples

# Create internal server group 1.

<Sysname> system-view

[Sysname] nat server-group 1

Related commands

display nat all

display nat server-group

inside ip

nat server

nat static enable

Use nat static enable to enable static NAT on an interface.

Use undo nat static enable to disable static NAT on an interface.

Syntax

nat static enable

undo nat static enable

Default

Static NAT is disabled.

Views

Interface view

Predefined user roles

network-admin

Usage guidelines

Static NAT mappings take effect on an interface only after static NAT is enabled on the interface.

Examples

# Configure an outbound static NAT mapping between private IP address 192.168.1.1 and public IP address 2.2.2.2, and enable static NAT on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] nat static outbound 192.168.1.1 2.2.2.2

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] nat static enable

Related commands

display nat all

display nat static

nat static

nat static net-to-net

nat static inbound

Use nat static inbound to configure a one-to-one mapping for inbound static NAT.

Use undo nat static inbound to delete a one-to-one mapping for inbound static NAT.

Syntax

nat static inbound global-ip local-ip [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ] [ packet-type-ignore ] [ description text ]

undo nat static inbound global-ip local-ip

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

global-ip: Specifies a public IP address.

local-ip: Specifies a private IP address.

acl: Specifies an ACL to identify the internal hosts that can access the external network.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the internal network to the private IP address.

disable: Disables the one-to-one inbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

packet-type-ignore: Ignores the protocol packet type when the device creates session entries for TCP, ICMP, or SCTP. If you do not specify this keyword, the NAT device checks the protocol packet type and creates session entries for only protocol packets that pass the check. For example, the NAT device creates session entries for TCP packets only when the packet type is SYN or ACK.

description text: Specifies a description for the one-to-one inbound static mapping. The text argument is a case-insensitive string of 1 to 63 characters.

Usage guidelines

Application scenarios

When the source IP address of a packet from the external network to the internal network matches the global-ip, the source IP address is translated into the local-ip. When the destination IP address of a packet from the internal network to the external network matches the local-ip, the destination IP address is translated into the global-ip.

Recommended configuration

In an asymmetric routing scenario, if a session contains different types of protocol packets that are forwarded by different NAT devices, protocol packets of some types might be discarded. As a result, session status cannot be updated through protocol packet exchanges, causing abnormal service traffic forwarding. To avoid such an issue, specify the packet-type-ignore keyword when you use this command.

Restrictions and guidelines

When you specify an ACL, follow these restrictions and guidelines:

· If you do not specify an ACL, the source address of all incoming packets and the destination address of all outgoing packets are translated.

· If you specify an ACL and do not specify the reversible keyword, the source address of incoming packets permitted by the ACL is translated. The destination address is not translated for connections actively initiated from the internal network to the private IP address.

· If you specify both an ACL and the reversible keyword, the source address of incoming packets permitted by the ACL is translated. If packets of connections actively initiated from the internal network to the private IP address are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡ Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡ Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when both are configured on an interface.

You can configure multiple inbound static NAT mappings by using the nat static inbound command and the nat static inbound net-to-net command.

One-to-one mappings for inbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

· Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

· Mappings with named ACLs are matched in alphabetical order of their ACL names.

· Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an inbound static NAT mapping between public IP address 2.2.2.2 and private IP address 192.168.1.1.

<Sysname> system-view

[Sysname] nat static inbound 2.2.2.2 192.168.1.1

Related commands

display nat all

display nat static

nat static enable

nat static inbound net-to-net

Use nat static inbound net-to-net to configure a net-to-net mapping for inbound static NAT.

Use undo nat static inbound net-to-net to remove a net-to-net mapping for inbound static NAT.

Syntax

nat static inbound net-to-net global-start-address global-end-address local local-network { mask-length | mask } [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ]

undo nat static inbound net-to-net global-start-address global-end-address local local-network { mask-length | mask }

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

global-start-address global-end-address: Specifies a public address range which can contain a maximum of 256 addresses. The global-end-address must not be lower than global-start-address. If they are the same, only one public address is specified.

local-network: Specifies a private network address.

mask-length: Specifies the mask length of the private network address, in the range of 8 to 31.

mask: Specifies the mask of the private network address.

acl: Specifies an ACL to identify the internal hosts that can access the external network.

ipv4-acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the internal network to the private IP addresses.

disable: Disables the net-to-net inbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

Specify a public network through a start address and an end address, and a private network through a private address and a mask.

When the source address of a packet from the external network matches the public address range, the source address is translated into a private address in the private address range. When the destination address of a packet from the internal network matches the private address range, the destination address is translated into a public address in the public address range.

The public end address cannot be greater than the greatest IP address in the subnet determined by the public start address and the private network mask. For example, if the private address is 2.2.2.0 with a mask 255.255.255.0 and the public start address is 1.1.1.100, the public end address cannot be greater than 1.1.1.255, the greatest IP address in the subnet 1.1.1.0/24.

When you specify an ACL, follow these restrictions and guidelines:

· If you do not specify an ACL, the source address of all incoming packets and the destination address of all outgoing packets are translated.

· If you specify both an ACL and the reversible keyword, the source address of incoming packets permitted by the ACL is translated. If packets of connections actively initiated from the internal network to the private IP addresses are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡ Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡ Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when both are configured on an interface.

You can configure multiple inbound static NAT mappings by using the nat static inbound command and the nat static inbound net-to-net command.

Net-to-net mappings for inbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

· Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

· Mappings with named ACLs are matched in alphabetical order of their ACL names.

· Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an inbound static NAT between public network address 202.100.1.0/24 and private network address 192.168.1.0/24.

<Sysname> system-view

[Sysname] nat static inbound net-to-net 202.100.1.1 202.100.1.255 local 192.168.1.0 24

Related commands

display nat all

display nat static

nat static enable

nat static inbound net-to-net rule move

Use nat static inbound net-to-net rule move to change the priority of an inbound net-to-net static NAT rule.

Syntax

nat static inbound net-to-net rule move nat-rule-name1 { after | before } nat-rule-name2

Default

An inbound net-to-net static NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Views

System view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Restrictions and guidelines

When you change the priority of an inbound net-to-net static NAT rule, make sure the rule to be moved and the reference rule meet the following conditions:

· Both NAT rules are named.

· The external or internal network segments of the two NAT rules are the same. A minimum of one NAT rule references an ACL.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the inbound net-to-net static NAT rule abc to the line before the inbound net-to-net static NAT rule def.

<Sysname> system-view

[Sysname] nat static inbound net-to-net rule move abc before def

Related commands

nat static inbound net-to-net

nat static inbound rule move

Use nat static inbound rule move to change the priority of an inbound one-to-one static NAT rule.

Syntax

nat static inbound rule move nat-rule-name1 { after | before } nat-rule-name2

Default

The priority of a rule is determined by its location on the rule list. A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Views

System view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

When you change the priority of an inbound one-to-one static NAT rule, make sure the rule to be moved and the reference rule meet the following conditions:

· Both NAT rules are named.

· The public or private IP addresses of the two NAT rules are the same. A minimum of one NAT rule references an ACL.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the inbound one-to-one static NAT rule abc to the line before the inbound one-to-one static NAT rule def.

<Sysname> system-view

[Sysname] nat static inbound rule move abc before def

Related commands

nat static inbound

nat static outbound

Use nat static outbound to configure a one-to-one mapping for outbound static NAT.

Use undo nat static outbound to remove a one-to-one mapping for outbound static NAT.

Syntax

nat static outbound local-ip global-ip [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ] [ packet-type-ignore ] [ description text ]

undo nat static outbound local-ip global-ip

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

local-ip: Specifies a private IP address.

global-ip: Specifies a public IP address.

acl: Specifies an ACL to define the destination IP addresses that internal hosts can access.

ipv4-acl-number: Specifies an ACL by its number in the range of 3000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the external network to the public IP address.

disable: Disables the one-to-one outbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

description text: Specifies a description for the one-to-one outbound static mapping. The text argument is a case-insensitive string of 1 to 63 characters.

Usage guidelines

When the source IP address of an outgoing packet matches the local-ip, the IP address is translated into the global-ip. When the destination IP address of an incoming packet matches the global-ip, the destination IP address is translated into the local-ip.

When you specify an ACL, follow these restrictions and guidelines:

· If you do not specify an ACL, the source address of all outgoing packets and the destination address of all incoming packets are translated.

· If you specify an ACL and do not specify the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. The destination address is not translated for connections actively initiated from the external network to the public IP address.

· If you specify both an ACL and the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. If packets of connections actively initiated from the external network to the public IP address are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡ Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡ Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when they are both configured on an interface.

You can configure multiple outbound static NAT mappings by using the nat static outbound command and the nat static outbound net-to-net command.

One-to-one mappings for outbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

· Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

· Mappings with named ACLs are matched in alphabetical order of their ACL names.

· Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an outbound static NAT mapping between public IP address 2.2.2.2 and private IP address 192.168.1.1.

<Sysname> system-view

[Sysname] nat static outbound 192.168.1.1 2.2.2.2

# Configure outbound static NAT, and allow the internal user 192.168.1.1 to access the external network 3.3.3.0/24 by using the public IP address 2.2.2.2.

<Sysname> system-view

[Sysname] acl advanced 3001

[Sysname-acl-ipv4-adv-3001] rule permit ip destination 3.3.3.0 0.0.0.255

[Sysname-acl-ipv4-adv-3001] quit

[Sysname] nat static outbound 192.168.1.1 2.2.2.2 acl 3001

Related commands

display nat all

display nat static

nat static enable

nat static outbound net-to-net

Use nat static outbound net-to-net to configure a net-to-net outbound static NAT mapping.

Use undo nat static outbound net-to-net to remove the specified net-to-net outbound static NAT mapping.

Syntax

nat static outbound net-to-net local-start-address local-end-address global global-network { mask-length | mask } [ acl { ipv4-acl-number | name ipv4-acl-name } [ reversible ] ] [ rule rule-name ] [ priority priority ] [ disable ] [ counting ]

undo nat static outbound net-to-net local-start-address local-end-address global global-network { mask-length | mask }

Default

No NAT mappings exist.

Views

System view

Predefined user roles

network-admin

Parameters

local-start-address local-end-address: Specifies a private address range which can contain a maximum of 256 addresses. The local-end-address must not be lower than local-start-address. If they are the same, only one private address is specified.

global-network: Specifies a public network address.

mask-length: Specifies the mask length of the public network address, in the range of 8 to 31.

mask: Specifies the mask of the public network address.

acl: Specifies an ACL to define the destination IP addresses that internal hosts can access.

ipv4-acl-number: Specifies an ACL number in the range of 2000 to 3999.

name ipv4-acl-name: Specifies an ACL by its name, a case-insensitive string of 1 to 63 characters. The ACL name must start with an English letter and to avoid confusion, it cannot be all.

reversible: Enables reverse address translation for connections actively initiated from the external network to the public IP addresses.

disable: Disables the net-to-net outbound static mapping. If you do not specify this keyword, the mapping is enabled.

counting: Enables NAT counting. The number of flows that use the address mapping is counted.

Usage guidelines

Specify a private network through a start address and an end address, and a public network through a public address and a mask.

When the source address of a packet from the internal network matches the private address range, the source address is translated into a public address in the public address range. When the destination address of a packet from the external network matches the public address range, the destination address is translated into a private address in the private address range.

The private end address cannot be greater than the greatest IP address in the subnet determined by the private start address and the public network mask. For example, the public address is 2.2.2.0 with a mask 255.255.255.0, and the private start address is 1.1.1.100. The private end address cannot be greater than 1.1.1.255, the greatest IP address in the subnet 1.1.1.0/24.

When you specify an ACL, follow these restrictions and guidelines:

· If you do not specify an ACL, the source address of all outgoing packets and the destination address of all incoming packets are translated.

· If you specify both an ACL and the reversible keyword, the source address of outgoing packets permitted by the ACL is translated. If packets of connections actively initiated from the external network to the public IP addresses are permitted by ACL reverse matching, the destination address is translated. ACL reverse matching works as follows:

¡ Compares the source IP address/port of a packet with the destination IP addresses/ports in the ACL.

¡ Translates the destination IP address of the packet according to the mapping, and then compares the translated destination IP address/port with the source IP addresses/ports in the ACL.

Static NAT takes precedence over dynamic NAT when they are both configured on an interface.

You can configure multiple outbound static NAT mappings by using the nat static outbound command and the nat static outbound net-to-net command.

Net-to-net mappings for outbound static NAT that are configured with the same priority value and an ACL are matched by using the ACLs in the mappings.

· Mappings with named ACLs have higher priorities than mappings with unnamed ACLs.

· Mappings with named ACLs are matched in alphabetical order of their ACL names.

· Mappings with unnamed ACLs are matched in descending order of their ACL numbers.

Examples

# Configure an outbound static NAT mapping between private network address 192.168.1.0/24 and public network address 2.2.2.0/24.

<Sysname> system-view

[Sysname] nat static outbound net-to-net 192.168.1.1 192.168.1.255 global 2.2.2.0 24

# Configure outbound static NAT. Allow internal users on subnet 192.168.1.0/24 to access the external subnet 3.3.3.0/24 by using public IP addresses on subnet 2.2.2.0/24.

<Sysname> system-view

[Sysname] acl advanced 3001

[Sysname-acl-ipv4-adv-3001] rule permit ip destination 3.3.3.0 0.0.0.255

[Sysname-acl-ipv4-adv-3001] quit

[Sysname] nat static outbound net-to-net 192.168.1.1 192.168.1.255 global 2.2.2.0 24 acl 3001

Related commands

display nat all

display nat static

nat static enable

nat static outbound net-to-net rule move

Use nat static outbound net-to-net rule move to change the priority of an outbound net-to-net static NAT rule.

Syntax

nat static outbound net-to-net rule move nat-rule-name1 { after | before } nat-rule-name2

Default

An outbound net-to-net static NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Views

System view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Restrictions and guidelines

When you change the priority of an outbound net-to-net static NAT rule, make sure the rule to be moved and the reference rule meet the following conditions:

· Both NAT rules are named.

· The external or internal network segments of the two NAT rules are the same. A minimum of one NAT rule references an ACL.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the outbound net-to-net static NAT rule abc to the line before the outbound net-to-net static NAT rule def.

<Sysname> system-view

[Sysname] nat static outbound net-to-net rule move abc before def

Related commands

nat static outbound net-to-net

nat static outbound rule move

Use nat static outbound rule move to change the priority of an outbound one-to-one static NAT rule.

Syntax

nat static outbound rule move nat-rule-name1 { after | before } nat-rule-name2

Default

The priority of a rule is determined by its location on the rule list. A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Views

System view

Predefined user roles

network-admin

Parameters

nat-rule-name1: Specifies the name of the NAT rule to be moved.

nat-rule-name2: Specifies the name of the NAT rule as a reference rule for the NAT rule to be moved.

Usage guidelines

When you change the priority of an outbound one-to-one static NAT rule, make sure the rule to be moved and the reference rule meet the following conditions:

· Both NAT rules are named.

· The public or private IP addresses of the two NAT rules are the same. A minimum of one NAT rule references an ACL.

A NAT rule appearing earlier on the rule list has a higher priority for packet matching.

Examples

# Move the outbound one-to-one static NAT rule abc to the line before the outbound one-to-one static NAT rule def.

<Sysname> system-view

[Sysname] nat static outbound rule move abc before def

Related commands

nat static outbound

nat timestamp delete

Use nat timestamp delete to enable the deletion of timestamps in TCP SYN and SYN ACK packets.

Use undo nat timestamp delete to restore the default.

Syntax

nat timestamp delete

undo nat timestamp delete

Default

The TCP SYN and SYN ACK packets carry the timestamp.

Views

System view

Predefined user roles

network-admin

Usage guidelines

If PAT mode is configured on an interface by using nat inbound or nat outbound, and the tcp_timestamp and tcp_tw_recycle function is configured on the TCP server, TCP connections might not be established. To solve the problem, you can shut down the tcp_tw_recycle function or configure the nat timestamp delete command.

Examples

# Enable the deletion of the timestamp for TCP SYN and SYN ACK packets on the public network.

<Sysname> system-view

[Sysname] nat timestamp delete

Related commands

nat outbound

nat inbound

nat trap no-pat ip-usage threshold

Use nat trap no-pat ip-usage threshold to set an alarm threshold for the IP usage of NAT address groups in NO-PAT mode.

Use undo nat trap no-pat ip-usage threshold to restore the default.

Syntax

nat trap no-pat ip-usage threshold threshold-value

undo nat trap no-pat ip-usage threshold

Default

The alarm threshold is 95% for the IP usage of NAT address groups in NO-PAT mode.

Views

System view

Predefines user roles

network-admin

Parameters

threshold value: Specifies the alarm threshold for the IP usage of NAT address groups, in percentage. The value range is 1 to 99.

Usage guidelines

Use this feature to configure the device to send a trap message to the network management system in the following scenarios:

· The IP usage of a NAT address group in NO-PAT mode reaches or exceeds the specified alarm threshold.

· The IP usage of a NAT address group in NO-PAT mode drops below the specified alarm threshold.

Examples

# Set the alarm threshold to 91% for the IP usage of NAT address groups in NO-PAT mode.

<Sysname> system-view

[Sysname] nat trap no-pat ip-usage threshold 91

nat trap nqa threshold

Use nat trap nqa threshold to set an alarm threshold for the unavailable IP address exclusion rate when the NAT address group probing uses an NQA template to detect the reachability of the addresses in the group.

Use undo nat trap nqa threshold to restore the default.

Syntax

nat trap nqa threshold upper-limit upperlimit-value lower-limit lowerlimit-value

undo nat trap nqa threshold

Default

The system sends a trap message when the unavailable IP address exclusion rate exceeds 90% or drops below 85%.

Views

System view

Predefines user roles

network-admin

Parameters

upper-limit upperlimit-value: Specifies the upper alarm threshold for the unavailable IP address exclusion rate, in percentage. The value range is 1 to 100.

lower-limit lowerlimit-value: Specifies the lower alarm threshold for the unavailable IP address exclusion rate, in percentage. The value range is 1 to 99. The value for the lowerlimit-value argument must be lower than that of the upperlimit-value argument.

Usage guidelines

When the NAT address group probing uses an NQA template to detect the reachability of the addresses in the group, unavailable IP addresses are excluded from the group. To specify a probe method for a NAT address group, use the probe command. In the process, the device sends a trap message to the network management system in the following scenarios:

· The unavailable IP address exclusion rate exceeds the specified upper alarm threshold, which indicates insufficient IP addresses.

· The unavailable IP address exclusion rate drops below the specified lower alarm threshold, which indicates sufficient IP addresses.

Examples

# Set the upper alarm threshold to 95% and lower upper limit threshold to 60% for the unavailable IP address exclusion rate.

<Sysname> system-view

[Sysname] nat trap nqa threshold upper-limit 95 lower-limit 60

nat trap port-block threshold

Use nat trap port-block threshold to set an alarm threshold for the dynamic port block usage.

Use undo nat trap port-block threshold to restore the default.

Syntax

nat trap port-block threshold threshold-value

undo nat trap port-block threshold

Default

The alarm threshold is 95% for the dynamic port block usage.

Views

System view

Predefines user roles

network-admin

Parameters

threshold value: Specifies the alarm threshold for the dynamic port block usage, in percentage. The value range is 1 to 99.

Usage guidelines

Use this feature to configure the device to send a trap message to the network management system in the following scenarios:

· The dynamic port block usage reaches or exceeds the specified alarm threshold.

· The dynamic port block usage drops below the specified alarm threshold.

Examples

# Set the alarm threshold to 90% for the dynamic port block usage.

<Sysname> system-view

[Sysname] nat trap port-block threshold 90

port-block

Use port block to configure port block parameters for a NAT address group.

Use undo port block to restore the default.

Syntax

port block block-size block-size [ extended-block-number extended-block-number ]

undo port block

Default

No port block parameters are configured for a NAT address group.

Views

NAT address group view

Predefined user roles

network-admin

Parameters

block-size block-size: Specifies the port block size. The value range for the block-size argument is 1 to 65535. In a NAT address group, the port block size cannot be larger than the number of ports in the port range.

extended-block-number extended-block-number: Specifies the number of extended port blocks, in the range of 1 to 5. When a private IP address accesses the public network, but the ports in the selected port block are all occupied, the NAT444 gateway extends port blocks one by one for the private IP address.

Usage guidelines

To configure dynamic port block mappings, port block parameters are required in the NAT address group. When a private IP address initiates a connection to the public network, the NAT444 gateway assigns it a public IP address and a port block, and creates an entry for the mapping. For subsequent connections from the private IP address, the NAT444 gateway translates the private IP address to the mapped public IP address and the ports to ports in the selected port block.

Examples

# Set the port block size to 256 and the number of extended port blocks to 1 in NAT address group 2.

<Sysname> system-view

[Sysname] nat address-group 2

[Sysname-address-group-2] port-block block-size 256 extended-block-number 1

Related commands

nat address-group

port-range

Use port-range to specify a port range for public IP addresses.

Use undo port-range to restore the default.

Syntax

port-range start-port-number end-port-number

undo port-range

Default

The port range for public IP addresses is 1 to 65535.

Views

NAT address group view

NAT port block group view

Predefined user roles

network-admin

Parameters

start-port-number end-port-number: Specifies the start port number and end port number for the port range. The end port number cannot be smaller than the start port number. As a best practice, set the start port number to be equal to or larger than 1024 to avoid an application protocol identification error.

Usage guidelines

The port range must include all ports that public IP addresses use for address translation.

The number of ports in a port range cannot be smaller than the port block size.

Examples

# Specify the port range as 1024 to 65535 for NAT address group 1.

<Sysname> system-view

[Sysname] nat address-group 1

[Sysname-address-group-1] port-range 1024 65535

# Specify the port range as 30001 to 65535 for NAT port block group 1.

<Sysname> system-view

[Sysname] nat port-block-group 1

[Sysname-port-block-group-1] port-range 30001 65535

Related commands

nat address-group

nat port-block-group

reset nat count statistics

Use reset nat count statistics to clear NAT counting statistics.

Syntax

reset nat count statistics { all | dynamic | policy | server | static | static-port-block }

Views

User view

Predefined user roles

network-admin

Parameters

all: Clears all counting statistics for NAT mappings.

dynamic: Clears counting statistics for dynamic NAT mappings.

policy: Clears counting statistics for the interface-based NAT policy.

server: Clears counting statistics for NAT server mappings.

static: Clears counting statistics for static NAT mappings.

static-port-block: Clears counting statistics for NAT444 mappings.

Examples

# Clear all counting statistics for NAT mappings.

<Sysname> reset nat count statistics all

Related commands

display nat inbound

display nat outbound

display nat outbound port-block-group

display nat port-block

display nat static

display nat server

reset nat session

Use reset nat session to clear NAT sessions.

Syntax

reset nat session

Views

User view

Predefined user roles

network-admin

Parameters

Examples

# ‌Clear all NAT sessions.

<Sysname> reset nat session

Related commands

display nat session

yundi alias

Use yundi alias to specify an alias and a tenant ID for a NAT address group or NAT rule on a Yundi network.

Use undo yundi alias to restore the default.

Syntax

yundi alias alias-name tenant tenant-id

undo yundi rule-name

Default

No alias or tenant ID is specified for a NAT address group or NAT rule on a Yundi network.

Views

NAT address group view

NAT-type rule view

Predefined user roles

network-admin

Parameters

alias-name: Specifies an alias, a case-insensitive string of 1 to 63 characters.

tenant-id: Specifies a tenant by its ID, a case-insensitive string of 1 to 63 characters. A tenant ID uniquely identifies a tenant.

Usage guidelines

On a Yundi network, the tenant specifies an alias and a tenant ID when creating a NAT address group or NAT rule on the controller, and then the controller deploys the alias and tenant ID to the device. As a best practice, do not perform this task manually on the device.

Examples

# Specify alias group1 and tenant ID abc for NAT address group 1.

<Sysname> system-view

[Sysname] nat address-group 1

[Sysname-nat-address-group-1] yundi alias group1 tenant abc

# Specify alias group1 and tenant ID abc for NAT rule 1 in the NAT policy.

<Sysname> system-view

[Sysname] nat policy

[Sysname-nat-policy] rule name 1

[Sysname-nat-policy-rule-1] yundi alias group1 tenant abc

# Specify alias group1 and tenant ID abc for NAT-type rule 1 in the global NAT policy.

<Sysname> system-view

[Sysname] nat global-policy

[Sysname-nat-global-policy] rule name 1

[Sysname-nat-global-policy-rule-1] yundi alias group1 tenant abc

05-Network Connectivity Command Reference

Application scenarios

Restrictions and guidelines

Application scenarios

Operating mechanism

Restrictions and guidelines

nat mapping-behavior endpoint-independent

nat outbound port-block-group

Application scenarios

Recommended configuration

Restrictions and guidelines

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us