Nat444 - HPE FlexNetwork MSR Series Comware 7 Layer 3 - Ip Services Configuration Manuals

Figure 59 NAT Server operation
Server
192.168.1.3
Figure 59 displays how NAT Server works:
1. Upon receiving a request from the host, NAT translates the public destination IP address and
port number to the private IP address and port number of the internal server.
2. Upon receiving a response from the server, NAT translates the private source IP address and
port number to the public IP address and port number.

NAT444

NAT444 provides carrier-grade NAT. It is a preferred solution for carriers to mitigate IPv4 address
exhaustion. It introduces a second layer of NAT on the carrier side, with few changes on the
customer side and the application server side.
NAT444 provides port block-based PAT translation. It maps multiple private IP addresses to one
public IP address and uses a different port block for each private IP address. For example, the
private IP address 10.1.1.1 of an internal host is mapped to the public IP address 202.1.1.1 and port
block 10001 to 10256. When the internal host accesses public hosts, the source IP address 10.1.1.1
is translated to 202.1.1.1, and the source ports are translated to ports in the port block 10001 to
10256.
NAT444 includes static NAT444 and dynamic NAT444.
As shown in
•
CPE—Provides NAT services on the customer side.
•
BRAS—Provides Internet access services.
•
NAT444 gateway—Provides carrier-grade NAT services.
•
AAA server—Cooperates with BRAS to provide user authentication, authorization, and
accounting services.
•
Log server—Records user access logs and responds to queries for user access information.
The AAA server authenticates the internal users and starts accounting after users pass the
authentication. The BRAS device assigns private IP addresses to authenticated users. When a user
accesses the external network, the NAT444 gateway assigns the user a public IP address and port
block, and sends the mapping to the log server. The next time the user accesses the external
network, the NAT444 gateway assigns a new mapping if the former mapping ages out and sends the
new mapping to the log server. The log server uses the mappings for user tracing.
Direction Before NAT
Inbound 20.1.1.1:8080
Dst : 192.168.1.3:8080
NAT
192.168.1.1
Intranet
Src : 192.168.1.3:8080
Figure 60, the NAT444 architecture includes the following entities:
After NAT
192.168.1.3:8080
Dst : 20.1.1.1:8080
20.1.1.1
Internet
Src : 20.1.1.1:8080
136
Host
20.1.1.2