H3C S9500 Series Operation Manual page 156

Operation Manual – NAT
H3C S9500 Series Routing Switches
[PE-Vlan-interface1000] ip binding vpn-instance VPN1
[PE-Vlan-interface1000] ip address 202.231.11.1 255.255.255.0
[PE-Vlan-interface1000] ip address 10.0.1.254 255.255.255.0 sub
[PE-Vlan-interface1000] quit
# Configure a routing protocol.
Select a routing protocol based on actual needs.
# Configure an ACL. To apply this ACL to VPN 1, you need to specify VPN 1 in the rule.
[PE] acl number 3000
[PE-acl-adv-3000] rule permit ip vpn-instance VPN1 source 10.0.0.0 0.0.0.255
[PE-acl-adv-3000] quit
# Configure NAT address pool 100 on VLAN-interface 100.
[PE] vlan 100
[PE-vlan100] quit
[PE] interface vlan-interface 100
[PE-Vlan-interface100] nat address-group 100 202.231.1.100 202.231.1.110
# Configure the NAT internal server mapping on VLAN-interface 100.
[PE-Vlan-interface100] nat server protocol tcp global 202.231.1.100 ftp inside
vpn1 10.0.1.2 ftp slot 6
[PE-Vlan-interface100] quit
# Configure the maximum numbers of users and connections allowed in VPN 1 (set the
values based on the actual number of hosts in VPN 1).
[PE] nat vpn limit vpn-instance VPN1 1000 100000
# Create an ACL, and apply it to the interface of VPN 1 to redirect packets that need
address translation to the NAT board. The ACL rule cannot contain VPN 1 but must
contain the corresponding VLAN ID.
[PE1] acl number 3001
[PE1-acl-adv-3001] rule permit ip source 10.0.0.1 0.0.0.255
[PE1-acl-adv-3001] quit
[PE1] interface GigabitEthernet 3/1/1
[PE1-GigabitEthernet3/1/1] traffic-redirect inbound ip-group 3001 slot 6
designated-vlan 1000
[PE1-GigabitEthernet3/1/1] quit
# Configurations on VPN 2 are similar to that on VPN 1 and thus omitted.
2) Configure CE
Configure a routing protocol on the CE. The configuration procedure is omitted.
1-35
Chapter 1 NAT Configuration