Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

8-17
Configuring Network Address Translation (NAT)
Planning the NAT Configuration
For this NAT implementation, you would record the IP addresses specified in
the DHCP pool and configure an ACL that selects those addresses. Table 8-3
lists the actual IP addresses that you would record for the sample network
shown in Figure 8-7.
Table 8-3. Recording Addresses for Dynamic NAT on a Sample Network
Planning the Configuration for Static NAT
For static NAT, you manually specify the IP address and port settings within
each NAT configuration. You must configure a separate static definition
specifically for each IP address that your Wireless Edge Services xl Module
must translate.
Before configuring static destination NAT for traffic destined to network
servers, collect the following information:
■ the IP address that you want to advertise to wireless stations (through,
for example, a DNS server)
This will be the original destination address (local address) for incoming
packets.
■ the destination port for traffic that will be subject to NAT (local port) and
the corresponding protocol (TCP or UDP)
This setting is for port translation, which enables multiple internal servers
to share one advertised IP address. For example, the Wireless Edge
Services xl Module can select traffic destined to:
• a Web server on port 80
• an FTP server on port 21
■ the internal device’s IP address on your LAN
This will be the translated destination address (global address).
■ the translated destination port (global port)
This setting is also optional. If you do not specify this port, the module
forwards traffic to the destination port on which it arrived.
NAT Interface Type
(Inside or Outside)
NAT Address
Type
Local or Global Address Recorded Addresses for the Sample
Network
Inside Source Local (stations’ IP addresses as they
appear on the wireless network)
10.1.1.0/24 subnetwork—assigned through
DHCP and specified in an ACL
Inside Source Global (IP address for all stations as
it appears on the wired network)
192.168.1.10—module’s vlan 1 IP address