H3C S9500 Series Operation Manual page 152

Operation Manual – NAT
H3C S9500 Series Routing Switches
Configure the routing protocol on CE 2.
IV. Configuration procedure
1) Configure PE
# Create VPN 1, and configure VPN 1 to redistribute routes from VPN 2.
<PE> system-view
[PE] ip vpn-instance VPN1
[PE-vpn-VPN1] route-distinguisher 65000:1
[PE-vpn-VPN1] vpn-target 65000:2 import-extcommunity
[PE-vpn-VPN1] quit
# Configure an ACL to permit public network 202.0.0.0/8.
[PE] acl number 2013
[PE-acl-basic-2013] rule permit source 202.0.0.0 0.255.255.255
[PE-acl-basic-2013] quit
# Configure a routing policy to advertise only the network 202.0.0.0/8.
[PE] route-policy vpn1 permit node 0
[PE-route-policy] if-match acl 2013
[PE-route-policy] apply extcommunity rt 65000:1
[PE-route-policy] quit
[PE] ip vpn-instance VPN1
[PE-vpn-VPN1] export route-policy vpn1
# Create VLAN 1000, and bind VLAN-interface 1000 to VPN 1.
[PE] vlan 1000
[PE-vlan1000] port GigabitEthernet 3/1/1
[PE-vlan1000] quit
[PE] interface vlan-interface 1000
[PE-Vlan-interface1000] ip binding vpn-instance VPN1
[PE-Vlan-interface1000] ip address 202.231.11.1 255.255.255.0
[PE-Vlan-interface1000] ip address 10.0.1.254 255.255.255.0 sub
[PE-Vlan-interface1000] quit
Note: Configurations of VPN 2 are similar to that of VPN 1 and thus omitted.
# Configure a routing protocol.
Select a routing protocol based on actual needs.
# Configure an ACL. To apply this ACL to VPN 1, you need to specify VPN 1 in the rule.
[PE] acl number 3000
[PE-acl-adv-3000] rule permit ip vpn-instance VPN1 source 10.0.0.0 0.0.0.255
[PE-acl-adv-3000] quit
# Configure NAT address pool 100.
[PE] nat address-group 100 202.231.1.100 202.231.1.110
1-31
Chapter 1 NAT Configuration