H3C S7500 Series Ethernet Switches Command Manual

Command Manual – NAT, Netstream, Policy Routing
H3C S7500 Series Ethernet Switches Chapter 1
NAT Configuration Commands
1-15
group-number: Index of a NAT address pool, in the range from 0 to 319.
slot-number: Slot number of an LPU, to which the address pool will be bound. All NAT
operations using the NAT rule will be carried out on this LPU.
Description
Use the nat outbound command to associate an ACL with a NAT address pool, and
bind the address pool to an LPU, so as to translate the addresses matching the ACL to
the addresses in the pool on the LPU.
Use the undo nat outbound command to remove the configuration.
If you use the nat outbound command to associate an ACL with an address pool, the
NAT process will use the IP addresses in the pool to translate the source addresses of
the packets that match the ACL. You can configure multiple NAT associations on a
VLAN interface, which is normally connected to an ISP network and serves as the
egress of the internal network.
If you execute the nat outbound command without the address-group keyword, the
Easy IP feature is implemented, and the IP address of the interface is used to translate
the source addresses that match the specified ACL.
When you execute the nat outbound command on a VLAN interface with an address
pool specified, the address pool should be on the same network segment with the IP
address of the VLAN interface. Otherwise, NAT may not operate normally. In this case,
you can use one of the following two ways to solve the problem.
1) Configuring a static route: Configure a static route to the VLAN interface on an
upstream router (a router on the upstream network of the NAT-enabled switch).
2) Using routing protocol to advertise the routes of the IP addresses in the address
pool. To do this, you need to configure static routes for the IP addresses in the
address pool on the NAT-enabled switch, with the outbound interface being NULL.
Note that the configured static route segments should accommodate the
combined segments of the IP addresses in the address pool.
 Note:
z For NAT function, basic ACLs (2000 to 2999) support only source IP address as the
filtering item, advanced ACLs (3000 to 3999) support both source IP address and
destination IP address as filtering items. Other ACL filtering items are not supported
currently.
z After you configure the nat outbound command with an ACL, any modifications to
the ACL (adding/deleting rules) will not have effect on the NAT configuration.