HP FlexNetwork MSR2003 Configuration Manual page 171

Figure 69 Network diagram
192.168.1.2/24
Host A
Host B
192.168.1.3/24
Requirements analysis
To allow external hosts to access the internal FTP server by using a public IP address, configure NAT
Server on the interface connected to the external network.
To allow internal hosts to access the internal FTP server by using a public IP address, perform the
following tasks:
•
Enable NAT hairpin on the interface connected to the internal network.
•
Configure outbound NAT on the interface where NAT Server is configured. The destination
address is translated by matching the NAT Server. The source address is translated by
matching the outbound NAT.
Configuration procedure
# Specify IP addresses for the interfaces on the router. (Details not shown.)
# Configure ACL 2000, and create a rule to permit packets only from subnet 192.168.1.0/24 to be
translated.
<Router> system-view
[Router] acl basic 2000
[Router-acl-ipv4-basic-2000] rule permit source 192.168.1.0 0.0.0.255
[Router-acl-ipv4-basic-2000] quit
# Configure NAT Server on interface GigabitEthernet 2/0/2 to map the IP address of the FTP server
to a public address, allowing external users to access the internal FTP server.
[Router] interface gigabitethernet 2/0/2
[Router-GigabitEthernet2/0/2] nat server protocol tcp global 202.38.1.2 inside
192.168.1.4 ftp
# Enable outbound NAT with Easy IP on interface GigabitEthernet 2/0/2 so that NAT translates the
source addresses of the packets from internal hosts into the IP address of interface GigabitEthernet
2/0/2.
[Router-GigabitEthernet2/0/2] nat outbound 2000
[Router-GigabitEthernet2/0/2] quit
# Enable NAT hairpin on interface GigabitEthernet 2/0/1.
[Router] interface gigabitethernet 2/0/1
[Router-GigabitEthernet2/0/1] nat hairpin enable
[Router-GigabitEthernet2/0/1] quit
Verifying the configuration
# Verify that both internal and external hosts can access the internal FTP server through the public
address. (Details not shown.)
GE2/0/1
192.168.1.1/24
FTP server
192.168.1.4/24
GE2/0/2
202.38.1.1/24
Router
157
Internet