Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

8-7
Configuring Network Address Translation (NAT)
Overview
You might use dynamic NAT on wired traffic when your wireless network
receives a great deal of public traffic. You can then conceal the IP addresses
of devices in your private network from the wireless users. (See Figure 8-3.)
Figure 8-3. Dynamic Source NAT
Again, whether you apply dynamic NAT to inside or outside traffic depends
on how you have defined interfaces. In this example, you have defined the
VLAN used in the wired network as an outside interface, so you configure
outside dynamic NAT.
If you want to allow wireless users to access internal servers, you must
configure destination NAT to translate the publicly known IP address back to
the servers’ internal addresses. (See “Static NAT on Destination Addresses”
on page 8-8.)
In fact, instead of configuring dynamic source NAT to conceal private
addresses, you might want to configure only destination NAT. The Wireless
Edge Services xl Module automatically performs source NAT on the traffic
returning from the server.
Port Address Translation for Dynamic NAT
To enable multiple users to share one IP address, the Wireless Edge Services
xl Module uses port address translation in conjunction with NAT. When the
module translates a local IP address to a global address, it assigns each local
address a unique port number, as shown in Table 8-1.