F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices NAT and ALG Command Reference-6PW100

remote-host host-address: IP address of the remote host accessing the internal server.

lease-duration lease-time: Valid time of the service provided by the internal server. The lease-time

argument indicates the valid time in seconds, in the range of 0 to 4294967295. The value 0 indicates

that the service never expires.

description string: Detailed information about the internal server. The string argument is a

case-insensitive string of 1 to 256 characters.

track vrrp virtual-router-id: Associates the internal server with a VRRP group. The virtual-router-id

argument indicates the number of the VRRP group to be associated. Without this option specified, no

VRRP group is associated.

Usage guidelines

Using the address and port defined by the global-address and global-port parameters, external users

can access the internal server with an IP address of local-address and a port of local-port.

If one of the two arguments global-port and local-port is set to any, the other must also be any or remain

undefined.

Using this command, you can configure internal servers (such as Web, FTP, Telnet, POP3, and DNS

servers) to provide services for external users. An internal server can reside in an internal network or a

VPN.

The maximum number of internal server configuration commands that can be configured on an interface

depends on the device model. The number of internal servers that each command can define equals the

difference between global-port2 and global-port1. Up to 4096 internal servers can be configured on an

interface. The system allows up to 1024 internal server configuration commands.

In general, this command is configured on an interface that serves as the egress of an internal network

and connects to the external network.

The device supports using an interface address as the external IP address of an internal server, which is

Easy IP. If you specify the current-interface keyword, the internal server uses the current primary IP

address of the current interface. If you use interface { interface-type interface-number } to specify an

interface, the interface must be an existing loopback interface and the current primary IP address of the

loopback interface is used.

HP recommends that if an internal server using Easy IP is configured on the current interface, the IP

address of this interface should not be configured as the external address of another internal server and

vice versa. This is because that the interface address that is referenced by the internal server using Easy

IP serves as the external address of the internal server.

In stateful failover networking, make sure you associate the public address of an internal server on an

interface with one VRRP group only. Otherwise, the system associates the public address with the VRRP

group having the highest group ID.

When the protocol type is not udp (with a protocol number of 17) or tcp (with a protocol number of 6),

you can configure one-to-one NAT between an internal IP address and an external IP address only, but

cannot specify port numbers.

Examples

# Allow external users to access the internal Web server 10.110.10.10 on the L AN through

http://202.110.10.10:8080, and the internal FTP ser ver 10.110.10.11 in VPN vrf10 through

ftp://202.110.10.10/. Assume that the interface GigabitEthernet 0/1 is connected to the external

network.

<Sysname> system-view

[Sysname] interface gigabitethernet 0/1