Configuration Restrictions And Guidelines; Configuration Prerequisites; Configuring Outbound Dynamic Nat - HP FlexNetwork MSR2003 Configuration Manual

Configuration restrictions and guidelines

When you configure dynamic NAT, follow these restrictions and guidelines:
•
You can configure multiple inbound or outbound dynamic NAT rules.
•
A NAT rule with an ACL takes precedence over a rule without any ACL.
•
The priority for the ACL-based dynamic NAT rules depends on ACL number. A higher ACL
number represents a higher priority.

Configuration prerequisites

Perform the following tasks before configuring dynamic NAT:
•
Configure an ACL to identify the IP addresses to be translated. The match criteria include the
source IP address, source port number, destination IP address, destination port number,
transport layer protocol, and VPN instance. For more information about ACLs, see ACL and
QoS Configuration Guide.
•
Determine whether to enable the Easy IP function. If you use the IP address of an interface as
the public address, you are configuring Easy IP.
•
Determine a public IP address pool for address translation.
•
Determine whether to translate port numbers. Use NO-PAT to translate only IP addresses and
PAT to translate both IP addresses and port numbers.

Configuring outbound dynamic NAT

To translate private IP addresses into public IP addresses, configure outbound dynamic NAT on the
interface connected to the external network.
The source IP addresses of the outgoing packets that match the ACL permit rule are translated into
IP addresses in the address group.
The reversible keyword enables the device to perform the following operations:
•
Compare the destination IP address in the first packet from the public network with existing
NO-PAT entries.
•
Translate the destination address into the private address in a matching NO-PAT entry.
To configure outbound dynamic NAT:
Step
1. Enter system view.
2. Configure an address
group and enter its
view.
3. Add an address range
to the address group.
4. Return to system
view.
5. Enter interface view.
6. Configure outbound
dynamic NAT.
Command
system-view
nat address-group group-number
address start-address end-address
quit
interface interface-type
interface-number
•
Configure NO-PAT:
nat outbound [ acl-number |
132
Remarks
N/A
By default, no address group exists.
By default, no address range exists.
You can add multiple address
ranges to an address group. The
address ranges must not overlap.
N/A
N/A
By default, outbound dynamic NAT
is not configured.