R3303-HP HSR6800 Routers Layer 3 - IP Services Command Reference

131
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the addresses of the address pool
belong. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. With this option,
inter-VPN access through NAT is supported. Without this option, the addresses in the address pool do
not belong to any VPN.
no-pat: Indicates that no many-to-many NAT is implemented. If this keyword is not configured,
many-to-one NAT is implemented using the TCP/UDP port information.
track vrrp virtual-router-id: Associates address translation on a specific outbound interface with a VRRP
group. The virtual-router-id argument indicates the number of the VRRP group in the range of 1 to 255.
Without this argument specified, no VRRP group is associated.
Usage guidelines
You can configure multiple associations or use the undo command to remove an association on an
interface that serves as the egress of an internal network to the external network.
When an ACL rule is not operative, no new NAT session entry depending on the rule can be created.
However, existing connections are still available for communication.
You can bind an ACL to only one address pool on an interface. An address pool can be bound to
multiple ACLs.
In stateful failover networking, make sure you associate each address pool configured on an interface
with one VRRP group only. Otherwise, the system associates the address pool with the VRRP group
having the highest group ID.
For some devices, the ACL rules referenced by the same interface cannot conflict. That is, the source IP
address, destination IP address and VPN instance information in any two ACL rules cannot be the same.
For basic ACLs (numbered from 2000 to 2999), if the source IP address and VPN instance information
in any two ACL rules are the same, a conflict occurs.
Examples
# Configure NAT for hosts on subnet 10.110.10.0/24. The NAT address pool contains addresses
202.110.10.10 through 202.110.10.12. Assume that interface Serial 2/1/0 is connected to the Internet.
<Sysname> system-view
[Sysname] acl number 2001
[Sysname-acl-basic-2001] rule permit source 10.110.10.0 0.0.0.255
[Sysname-acl-basic-2001] rule deny
[Sysname-acl-basic-2001] quit
[Sysname] nat address-group 1 202.110.10.10 202.110.10.12
# Configure address pool 1.
[Sysname] nat address-group 1 202.110.10.10 202.110.10.12
# Use addresses in address pool 1 as translated addresses and TCP/UDP port information.
[Sysname] interface serial 2/1/0
[Sysname-Serial2/1/0] nat outbound 2001 address-group 1
# Use addresses in address pool 1 as translated addresses without using TCP/UDP port information.
<Sysname> system-view
[Sysname] interface serial 2/1/0
[Sysname-Serial2/1/0] nat outbound 2001 address-group 1 no-pat
# Use the IP address of interface Serial 2/1/0 as translated address.
<Sysname> system-view
[Sysname] interface serial 2/1/0