Troubleshooting Nat; Before Getting Started - Avaya 2330/4134 Troubleshooting Manual

Troubleshooting security
Example
SR# debug tacacs

Troubleshooting NAT

This section details techniques used to troubleshoot NAT.

Before getting started

In the Secure Router series, the Network Address Translation and Port Translation features
are implemented as a feature of the firewall. This gives the firewall and Application Level
Gateways visibility into the NAT mappings and provides a rich capability in terms of tracking
the opening of new control/data connections and being sure to also allow them through the
firewall. On the other hand, bringing in the firewall to the NAT capability leads to some
complexity.
Troubleshooting NAT connections brings in all the necessary knowledge and privilege of
Troubleshooting firewall connections. To summarize those points, you will need a Policy Goals
Description and a network map.
Because NAT policies ride on firewall policies, and because transit firewall policies are
expressed in a trusted zone, NAT policies must be expressed in the trusted zone. This may
appear counter-intuitive as many NAT devices administrators are historically used to
equipment which expresses NAT policy on the egress/untrusted interface, not the ingress
interface/trusted.
In the Secure Router, several different forms of NAT may be configured. Most commonly the
"nat-ip" or "pat" form will be used which uses a port restricted Cone NAT port allocation
algorithm. This allows STUN and STUN like protocols to work through NATting Secure
Routers.
• nat-ip or pat: Many to one address and port mangling with a cone nat allocation
• static: one to one address (only) mangling
• dynamic: Many to Many address (only) mangling
Generally, the policy configuration of NAT requires a two step process; first configure a NAT-
object in the firewall global area, and second apply the NAT-object to a policy in the firewall
<zoneName> area. The NAT-object selects the type of NAT and the size of the address pool,
but in the case of a pat type of NAT-object, the address-pool size is always exactly 1. Therefore,
in the case of pat, the Secure Router allows a configuration short cut where, without defining
a pat type of NAT-object, a 'nat-ip' parameter may be configured directly onto the policy. A
NAT-ip policy is the same as a policy with a pat type of NAT-object applied.
202 Troubleshooting
Comments? infodev@avaya.com
August 2013