HP 7102dl - ProCurve Secure Router Configuration Manual page 302

Configuring Network Address Translation
NAT Services on the ProCurve Secure Router
Private IP Address
192.168.1.10
192.168.1.11
192.168.1.12
192.168.1.13
192.168.1.14
Users
192.168.1.10
6-4
Table 6-1. Information Recorded in a Port-Mapping Table for a Sample Network
Translated Public
IP Address
10.1.1.1
10.1.1.1
10.1.1.1
10.1.1.1
10.1.1.1
When the destination device sends a reply packet back through the router, it
sends it to the public IP address on the translated port. The Secure Router OS
firewall uses the port-mapping table to identify the original, private IP address.
It translates the destination IP address to the private IP address and sends the
reply back to the appropriate device on the trusted network.
For example, if the 192.168.1.10 device listed in Table 6-1 sends a packet to a
device with the destination IP address of 10.20.1.1, the Secure Router OS
receives the packet and records the source IP address. It then changes the IP
source address to 10.1.1.1 with the port 4000 and sends the packet to the
destination IP address 10.20.1.1.
When the 10.20.1.1 device replies, the Secure Router OS translates the desti-
nation IP address from 10.1.1.1 with the port 4000 to 192.168.1.10 and then
forwards the packet to that device. (See Figure 6-2.)
Source address:
Edge switch
192.168.1.10
Core switch
Destination address:
Edge switch
192.168.1.10
Figure 6-2. Secure Router OS NAT Replies
Translated Port Destination IP Address
4000 10.20.1.1
4001 172.16.1.10
4002 172.16.10.5
4003 10.45.16.1
4004 172.16.11.1
NAT source
address to
10.1.1.1 on
port 4000
Router
NAT destination
address on
return traffic to
192.168.1.10
Destination Port
80
80
80
80
80
Internet
Web
server
Sends reply
to 10.1.1.1 on
port 4000
10.20.1.1