F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices NAT and ALG Configuration Guide-6PW100
Table Of Contents
- Title Page
- Table of Contents
- Configuring NAT
- Overview
- Configuration guidelines
- Configuring NAT in the Web interface
- Recommended configuration procedure
- Creating an address pool
- Configuring dynamic NAT on an interface
- Creating a static address mapping
- Enabling static NAT on an interface
- Configuring an internal server
- Configuring ACL-based NAT on the internal server
- Configuring DNS mapping
- NAT configuration example
- Internal server configuration example
- Configuring NAT at the CLI
- NAT configuration task list
- Configuring static NAT
- Configuring dynamic NAT
- Configuring an internal server
- Configuring ACL-based NAT on an internal server
- Configuring DNS mapping
- Displaying and maintaining NAT
- One-to-one static NAT configuration example
- Dynamic NAT configuration example
- Common internal server configuration example
- NAT DNS mapping configuration example
- Troubleshooting NAT
- Configuring NAT-PT
- Feature and hardware compatibility
- Overview
- NAT-PT configuration task list
- Configuration prerequisites
- Enabling NAT-PT
- Configuring a NAT-PT prefix
- Configuring IPv4/IPv6 address mappings on the IPv6 side
- Configuring IPv4/IPv6 address mappings on the IPv4 side
- Setting the ToS field after NAT-PT translation
- Setting the traffic class field after NAT-PT translation
- Configuring static NAPT-PT mappings of IPv6 servers
- Displaying and maintaining NAT-PT
- NAT-PT configuration examples
- Troubleshooting NAT-PT
- NAT444
- Configuring ALG
- Support and other resources
- Index
54
192.168.1.95 <-> 201.1.1.10 : (14001 - 15000 )
192.168.1.96 <-> 201.1.1.10 : (15001 - 16000 )
192.168.1.97 <-> 201.1.1.10 : (16001 - 17000 )
192.168.1.98 <-> 201.1.1.10 : (17001 - 18000 )
192.168.1.99 <-> 201.1.1.10 : (18001 - 19000 )
192.168.1.100 <-> 201.1.1.10 : (19001 - 20000 )
• Configure a dynamic NAT444 IP-port mapping:
# Configure address pool 1.
<Sysname> System-view
[Sysname] nat address-group 1 201.1.1.1 201.1.1.10
# Create ACL 3000, permitting packets from 192.168.1.0 to pass through.
[Sysname] acl number 3000
[Sysname-acl-adv-3000] rule 0 permit ip source 192.168.1.0 0.0.0.255
[Sysname-acl-adv-3000] quit
# Configure a dynamic NAT444 IP-port mapping.
[Sysname] interface Ten-GigabitEthernet0/0.1002
[Sysname-Ten-GigabitEthernet0/0.1002] vlan-type dot1q vid 1002
[Sysname-Ten-GigabitEthernet0/0.1002] nat444 outbound 3000 address-group 1
port-range 10001 20000 block-size 1000
[Sysname-Ten-GigabitEthernet0/0.1002] ip address 202.1.1.1 255.255.255.0
[Sysname-Ten-GigabitEthernet0/0.1002] quit
# Enable NAT444 logging.
[Sysname] nat444 log user
[Sysname] nat444 log session-start
# Display dynamic IP-port mappings.
[Sysname] display nat444 dynamic-ip-port-block
Dynamic NAT444 IP-port-block tables: (Used: 3, Unused:97)
Local-IP <-> Global-IP Port-block : Connections, Local-VPN
192.168.1.1 <-> 201.1.1.1 : (10001 - 11000) : 252, ---
192.168.1.2 <-> 201.1.1.1 : (11001 - 12000) : 252, ---
192.168.1.3 <-> 201.1.1.1 : (12001 - 13000) : 251, ---