Table of Contents
Advertisement
Setting up the network
When the SF_VSU receives the reply packet through the tunnel, the tunnel NAT rule changes
the packet's destination address from 172.16.0.17 to 10.1.1.17 and the private interface NAT
rule changes the packet's source address from 172.16.1.20 to 10.0.88.20 before the packet is
sent out to the SF_Sales_Group client through the private interface.
The NAT rule applied to the public interface on each of the VSUs allows clients on the private
networks to access the Internet by mapping their private addresses to public address as
described in the previous section
Using NAT to support multiple gateway configurations
Figure 30
shows an example of using NAT to ensure that all replies to packets entering the
network through a security gateway exit the network through the same security gateway. The
NAT rule applied to the security gateway-B private interface dynamically maps the source IP
address of packets sent out the private interface of the security gateway-B to one of 16
addresses assigned to the security gateway-B address pool. Note that the IP address 0.0.0.0/0
matches any packet entering or leaving the security gateway through the designated interface.
When a packet is initially sent from Host A to Host B through the VPN tunnel, security
gateway-B dynamically maps the packet source address (X
selected from the address pool (Y
As a result, reply packets destined for Host A are sent to Y
ARPs for Y
.Y
1
B. When security gateway-B receives a reply packet on the private interface, it changes the
packet's destination address (Y
sending the reply to Host A through the VPN tunnel.
A possible alternative to configuring a NAT rule on the private interface of security gateway-B
shown in
Using NAT to Support Multiple Gateways
which sends packets destined for the X
92 Avaya VPNmanager Configuration Guide Release 3.7
Accessing the Internet from private
.Y
1
.Y
.X by sending its own MAC address in response to an ARP request from Host
2
3
.Y
.Y
1
2
.Y
.X) before sending the packet out the private interface.
2
3
.X) back to the original address (X
3
is to add a static route to the default router
.X
.X
.0/24 network through security gateway-B.
1
2
3
networks.
.X
.X
.11) to an IP address
1
2
3
.Y
.Y
.X. security gateway-B proxy
1
2
3
.X
.X
.11) before
1
2
3
Advertisement
Table of Contents
