Table of Contents
Advertisement
Chapter 11: Network Address Translation Configuration Guide
The IA allows you to create the following NAT address bindings:
•
Static, one-to-one binding of inside, local address or address pool to outside, global
address or address pool. A static address binding does not expire until the command
that defines the binding is negated. IP addresses defined for static bindings cannot be
reassigned. For static address bindings, PAT allows TCP or UDP port numbers to be
translated along with the IP addresses.
•
Dynamic binding between an address from a pool of local addresses to an address from
a pool of outside addresses. With dynamic address binding, you define local and global
address pools from which the addresses bindings can be made. IP addresses defined
for dynamic binding are reassigned whenever they become free. For dynamic address
bindings, PAT allows port address translation if no addresses are available from the
global address pool. PAT allows port address translation for each address in the global
pool. The ports are dynamically assigned between the range of 1024 to 4999. Hence,
you have about 4,000 ports per global IP address.
Dynamic bindings are removed automatically when the flow count goes to zero. At
this point, the corresponding port (if PAT enabled) or the global IP address is freed and
can be reused the next time. Although there are special cases like FTP where the flows
are not installed for the control path, the binding will be removed only by the dynamic
binding timeout interval.
Configuring NAT
The following are the steps in configuring NAT on the IA:
1.
Setting the NAT interfaces to be inside or outside.
2.
Setting the NAT rules (static or dynamic).
Setting Inside and Outside Interfaces
When NAT is enabled, address translation is only applied to those interfaces which are
defined to NAT as inside or outside interfaces. NAT only translates packets that arrive on a
defined inside or outside interface.
To specify an interface as inside (local) or outside (global), enter the following command
in Configure mode:
Define an interface as inside or
outside for NAT.
186
<InterfaceName>
nat set interface
inside|outside
Internet Appliance User Reference Manual
Advertisement
Table of Contents
