Table of Contents
Advertisement
JunosE 11.3.x IP Services Configuration Guide
Bidirectional NAT Example
78
host1:blue(config)#interface serial 1/1
host1:blue(config-interface)#ip nat inside
host1:blue(config-interface)#exit
host1:blue(config)#interface serial 1/2
host1:blue(config-interface)#ip nat inside
host1:blue(config-interface)#exit
Mark the outside interface.
3.
host1:blue(config)#interface gigabitEthernet 3/0.1
host1:blue(config-interface)#ip nat outside
host1:blue(config-interface)#exit
Create a static nil-translation for the FTP server on the corporate network.
4.
host1:blue(config)#ip nat inside source static tcp 190.22.8.18 21 190.22.8.18 21
Create the address pool for dynamic translations.
5.
host1:blue(config)#ip nat pool corpxyz 192.32.6.4 192.32.6.7 prefix-length 24
Create the access list for addresses eligible for dynamic translation.
6.
host1:blue(config)#access-list justcorp permit 10.10.1.0 0.0.0.255
host1:blue(config)#access-list justcorp permit 10.10.2.0 0.0.0.255
Create the NAPT dynamic translation rule.
7.
host1:blue(config)#ip nat inside source list justcorp pool corpxyz overload
Configure a default route to the outside interface.
8.
host1:blue(config)#ip route 0.0.0.0 0.0.0.0 gigabitEthernet 3/0.1
Configure a null route for the inside global addresses to prevent routing loops when
9.
no matching translation exists.
host1:blue(config)#ip route 192.32.6.0 255.255.255.248 null 0
NOTE: Null route applies to 192.32.6.0–192.32.6.3, which do not exist in
the address pool
All hosts that use private addresses in both the field office and the corporate office must
have their addresses translated to one of the three addresses in the pool. Because this
example uses NAPT, the interface can use only one pool address, depending on the
number of inside hosts attempting to access the outside at any given time.
Figure 7 on page 79 illustrates how outside hosts can initiate conversations with inside
hosts through the use of a DNS server that resides on the inside network.
The inside realm uses basic NAT. The inside network uses a mix of private subnetwork
address space (192.168.22/24) and registered public addresses.
Copyright © 2010, Juniper Networks, Inc.
Advertisement
Table of Contents
