NAT Configuration Guide
Introduction
NAT (Network Address Translation) is a technology that maps one IP address space to another and is primarily used to allow multiple internal network devices to share fewer public IP addresses to communicate with external networks when existing IP address resources are limited.
Basic Concepts and Principles
A Network Address Translation (NAT) device, often a router or firewall, has an internal interface to the internal network and an external interface to an external network, such as the Internet. When a device on the internal network sends a packet out, the NAT device replaces the internal source IP address in the packet with one of its own external IP addresses, and records this translation relationship in the NAT table. When an external network device receives a packet and returns a response, the NAT device restores the destination IP address to the IP address of the internal device that originally initiated the request according to the records in the NAT table, thus forwarding the response packet to the internal device.
- Static NAT: This type maps an internal IP address to a fixed external IP address at all times. It is typically used in scenarios where you need to provide fixed accessibility for an internal server on an external network. For example, a company with an internal web server can use static NAT to make it accessible from the outside with a fixed public IP address on the Internet.
- Dynamic NAT: Dynamic NAT maintains a pool of available external IP addresses from which internal devices are dynamically assigned an external IP address for address translation when they need to access the external network. When used, the external IP address is released back into the address pool for use by other internal devices.
- Port Address Translation (PAT): Also known as NAPT (Network Address Port Translation), PAT is the most commonly used NAT technology. It translates not only IP addresses, but also port numbers (TCP or UDP ports). Multiple internal devices can share one or a few external IP addresses, distinguished by different port numbers on the NAT device. For example, if there are multiple devices on an internal network that need to access the Internet, PAT can use a single public IP address to establish a communication link for each device through a different port number, enabling "many-to-one" IP address translation.
NAT Configuration
Configure Port Domains
Operation | Command | Description |
|---|---|---|
Enter the system configuration view | configure terminal | - |
Enter the interface configuration view | interface type interface-number | Type has ethernat, vlan, lag, loopback,sub-ethernet |
Enable port nat output | nat-zone 1 | |
Disable port nat output | no nat-zone | |
Configure the nat function
Operation | Command | Description |
|---|---|---|
Enter the system configuration view | configure terminal | - |
Enable nat function | nat enable | |
Disable nat function | no nat enable | |
Configure static nat | nat static basic global_ip local_ip type | Global_ip is public network address, local_ip is private network address, and the type has snat and dnat. |
Delete static nat | no nat static basic global_ip local_ip type | |
Configure static napt | nat static {tcp|udp} global_ip global_port local_ip local_port type | Global_port is public network port, local_port is private network port. |
Delete static napt | no nat static {tcp|udp} global_ip global_port local_ip local_port | |
Configure a dynamic nat address pool | nat pool pool_name start_ip [end_ip] | Pool_name is the name of nat address pool, start_ip is the start ip of nat address pool, end_ip is the end ip of nat address pool, Configuring only start_ip means using a single address. |
Delete a dynamic nat address pool | no nat pool pool_name | |
Configure a binding dynamic address pool | nat binding binding_name pool_name [acl_name] | Binding_name is the name of bind operation, pool_name if the name of nat address pool, acl_name is the name of acl name. |
Delete a binding dynamic address pool | no nat binding binding_name | |
Display and Maintenance
Operation | Command | Description |
|---|---|---|
Display nat config infomation | show nat config | - |
Display nat translations | show nat translations | |
Display nat translations count | show nat translations_count | |
Display nat statistics | show nat statistics | |
Static nat Typical Scenario Configuration Example
Network requirements
The IP address of the router's outgoing interface 2 is 2.2.2.2/24 and the gateway address on the LAN side is 192.168.0.1/24. The address at the opposite end on the carrier side is 2.2.2.1/24. The host's intranet address is 192.168.0.2/24 and a static address of 2.2.2.3/24 must be used. The company must be able to convert the private address internally to a public address for connection to the WAN.
Procedure
1.Router configuration
# Configure the port ip address and set port 2 as the nat conversion output port
sonic(config)# interface ethernet 1
sonic(config-if-1)# ip address 192.168.0.1/24
sonic(config-if-1)# exit
sonic(config)# interface ethernet 2
sonic(config-if-2)# ip address 2.2.2.2/24
sonic(config-if-2)# nat-zone 1# Configure static routes
sonic(config)# ip route 0.0.0.0/0 2.2.2.1# Configure static nat
sonic(config)# nat enable
sonic(config)# nat static basic 2.2.2.3 192.168.0.1 snatVerify configuration
sonic(config)# do show nat config
Global Values
Admin Mode : enabled
Global Timeout : 600 secs
TCP Timeout : 86400 secs
UDP Timeout : 300 secs
Static Entries
Nat Type IP Protocol Global IP Global Port Local IP Local Port Twice-NAT Id
---------- ------------- ----------- ------------- ----------- ------------ ---------------
snat all 2.2.2.3 --- 192.168.0.1 --- ---
Pool Entries
Pool Name Global IP Range Global Port Range
----------- ----------------- -------------------
NAT Bindings
Binding Name Pool Name Access-List Nat Type Twice-NAT Id
-------------- ----------- ------------- ---------- --------------
NAT Zones
Port Zone
---------- ------
Ethernet1 0
Ethernet2 1
sonic(config)# do show nat translations
Static NAT Entries ..................... 2
Static NAPT Entries ..................... 0
Dynamic NAT Entries ..................... 0
Dynamic NAPT Entries ..................... 0
Static Twice NAT Entries ..................... 0
Static Twice NAPT Entries ..................... 0
Dynamic Twice NAT Entries ..................... 0
Dynamic Twice NAPT Entries ..................... 0
Total SNAT/SNAPT Entries ..................... 1
Total DNAT/DNAPT Entries ..................... 1
Total Entries ..................... 2
Protocol Source Destination Translated Source Translated Destination
---------- ----------- ------------- ------------------- ------------------------
all --- 2.2.2.3 --- 192.168.0.1
all 192.168.0.1 --- 2.2.2.3 ---
sonic(config)# do show nat statistics
Protocol Source Destination Packets Bytes
---------- ----------- ------------- --------- -------
all --- 2.2.2.3 0 0
all 192.168.0.1 --- 0 0Dynamic nat Typical Scenario Configuration Example
Network requirements
The users of a company's private network are connected to the Internet, and interface 3 on the router has a public address of 2.2.2.2/24 and a carrier-side address of 2.2.2.1/24. The users want to use addresses in the public address pool (2.2.2.100 to 2.2.2.200) to replace the internal host address (segment 192.168.20.0/24) with NAT to access the Internet.
Procedure
1.Router configuration
# Configure the port ip address and set port 2 as the nat conversion output port
sonic(config)# interface ethernet 1
sonic(config-if-1)# ip address 192.168.20.1/24
sonic(config-if-1)# exit
sonic(config)# interface ethernet 2
sonic(config-if-2)# ip address 2.2.2.2/24
sonic(config-if-2)# nat-zone 1# Configure static routes
sonic(config)# ip route 0.0.0.0/0 2.2.2.1# Configure dynamic nat
sonic(config)# nat enable
sonic(config)# nat pool nat_pool 2.2.2.100 2.2.2.200
sonic(config)# nat binding test nat_poolVerify configuration
sonic(config)# do show nat config
Global Values
Admin Mode : enabled
Global Timeout : 600 secs
TCP Timeout : 86400 secs
UDP Timeout : 300 secs
Static Entries
Nat Type IP Protocol Global IP Global Port Local IP Local Port Twice-NAT Id
---------- ------------- ----------- ------------- ---------- ------------ ---------------
Pool Entries
Pool Name Global IP Range Global Port Range
----------- ------------------- -------------------
nat_pool 2.2.2.100-2.2.2.200 1024-65534
NAT Bindings
Binding Name Pool Name Access-List Nat Type Twice-NAT Id
-------------- ----------- ------------- ---------- --------------
test nat_pool snat ---
NAT Zones
Port Zone
---------- ------
Ethernet1 0
Ethernet2 1
sonic(config)# do show nat translations
Static NAT Entries ..................... 0
Static NAPT Entries ..................... 0
Dynamic NAT Entries ..................... 0
Dynamic NAPT Entries ..................... 0
Static Twice NAT Entries ..................... 0
Static Twice NAPT Entries ..................... 0
Dynamic Twice NAT Entries ..................... 0
Dynamic Twice NAPT Entries ..................... 0
Total SNAT/SNAPT Entries ..................... 0
Total DNAT/DNAPT Entries ..................... 0
Total Entries ..................... 0
Protocol Source Destination Translated Source Translated Destination
---------- -------- ------------- ------------------- ------------------------
tcp --- 2.2.2.100 --- 192.168.20.2
tcp 192.168.20.2 --- 2.2.2.100 ---
sonic(config)# do show nat statistics
Protocol Source Destination Packets Bytes
---------- ----------- ------------- --------- -------
tcp --- 2.2.2.100 0 0
tcp 192.168.20.2 --- 0 0