H3C Technologies H3C S12500 Series Switches - Manual (Page 113)

99
Step Command
1. Enter system view. system-view
2. Configure a net-to-net static NAT
mapping. nat static net-to-net local-start-address local-end-address global
global-network { netmask-length | netmask }
3. Enter interface view. interface interface-type interface-number
4. Enable static NAT on the interface. nat outbound static
Configuring dynamic NAT
Dynamic NAT is usually implemented by associating an ACL with an address pool (or the address of an
interface) on an interface.
• To select the address of an interface as the translated address, use Easy IP.
• To select an address from an address pool as the translated address, use No-PAT or NAPT for
dynamic address translation. No-PAT is used in many-to-many address translation but does not
translate TCP/UDP port numbers. NAPT allows for many-to-one address translation by translating
also TCP/UDP port numbers.
A NAT entry is configured on the outbound interface of the NAT device. If internal hosts need to access
external networks through multiple outbound interfaces on the NAT device, you must configure NAT
entries on each of the interfaces. To avoid this, the switch supports configuring a NAT entry on the
inbound interface on the NAT device. When hosts in a VPN want to access other VPNs through multiple
outbound interfaces on a NAT device, you can configure a NAT entry on the inbound interface on the
NAT device, simplifying NAT configuration.
When a packet from an internal host to the external network arrives:
• If it is the first packet and an address pool is associated with an outbound interface, NAT
determines whether to translate the packet based on the ACL (or its source IP address). If yes, NAT
chooses an address from the associated address pool or gets the associated interface address,
performs address translation, and then saves the address mapping in the address translation table.
All subsequent packets from the internal host are serviced by NAT directly according to the
mapping entry.
• If an address pool is associated with an inbound interface, NAT determines whether to translate the
packet based on the ACL (or packet source address). If yes, NAT redirects the packet to the NAT
board and performs address translation as in the above-mentioned process. This case does not
support Easy IP.
NOTE:
If both the inbound and outbound interfaces of a NAT device are associated with an address pool, a
packet matching both of them uses an address from the address pool associated with the outbound
interface for address translation.
Configuration prerequisites
• Configure an ACL to specify IP addresses permitted to be translated. For more information about
ACL, see ACL and QoS Configuration Guide.
• Determine whether to use an interface’s IP address as the translated source address.
• Determine a public IP address pool for address translation.