Siemens SIMATIC NET SCALANCE S615 Configuration Manual page 145

Examples
Example 1
● Type: Source
● Source Interface: vlan1
● Destination Interface: vlan2
● Source IP Subnet: 192.168.1.0/24
● Translated Source IP Subnet: 10.100.1.0/24
● Destination IP Subnet: 10.10.10.0/24
● Translated Destination IP Subnet: -
The rule applies to packets sent from vlan1 (internal) to vlan2 (external). With the packets
that arrive at vlan1 there is a check to establish whether the rule applies.
If the source IP address in the subnet of the sender (Source IP Subnet) and the destination
IP address in the subnet of the recipient (Destination IP Subnet), the source IP address is
replaced by the suitable IP address from the "Translated Source IP Subnet". The subnet part
of the source IP address is changed and the host part remains unchanged. A packet, for
example with the source IP address 192.168.1.102 is changed to 10.100.1.102. For the
devices connected to vlan2 it appears as if the packets were sent from the IP subnet
10.100.1.0/24. This allows for example overlaps of IP subnets to be resolved. The rule is
only specified for the send direction. The retranslation is performed implicitly.
If the rule does not apply, the packets are forwarded without translation.
Example 2:
● Type: Destination
● Source Interface: vlan2
● Destination Interface: vlan1
● Source IP Subnet: 10.10.10.0/24
● Translated Source IP Subnet: -
● Destination IP Subnet: 10.100.1.0/24
● Translated Destination IP Subnet: 192.168.1.0/24
The rule applies to packets sent from vlan2 (external) to vlan1 (internal). With the packets
that arrive at vlan2 there is a check to establish whether the rule applies.
If the source IP address in the subnet of the sender (Source IP Subnet) and the destination
IP address in the subnet of the recipient (Destination IP Subnet), the source IP address is
replaced by the suitable IP address from the "Translated Destination IP Subnet". A packet,
for example with the source IP address 10.10.10.102 is changed to 192.168.1.102. The
devices connected to vlan1 can communicate with the devices connected to vlan2. This
assumes that the corresponding firewall rule is set. The devices connected to vlan2 must
address the devices connected to vlan1 with the virtual IP address from the subnet
10.100.1.0.
SCALANCE S615 Web Based Management
Configuration Manual, 05/2015, C79000-G8976-C388-02
Configuring with Web Based Management
4.7 "Layer 3" menu
145