Using Nat With Network Monitoring; Overview - HP 7102dl - ProCurve Secure Router Configuration Manual

Probe destination Command
destination
www.mycompany.com (ICMP
echo probe)
destination 10.8.4.1 port 25 (TCP
connect probe)
destination 172.16.12.15 port 53
(TCP connect probe)
destination
www.mycompany.com (HTTP
request probe)
Table 9-5. Examples of Commands to Configure PBR for Probe Traffic
Monitored Route
DHCP route on Ethernet
interface
ip route 10.8.0.0 /12 ppp 1 permit tcp any host 10.8.4.1
ip route 0.0.0.0 /0 atm 1.1
ip route 192.168.0.0 /20
192.168.0.1
PBR is discussed in more detail in Chapter 15: IP Routing—Configuring RIP,
OSPF, BGP, and PBR.

Using NAT with Network Monitoring

You must use the policy option with NAT commands when combining NAT
with network monitoring. In this way, the ProCurve Secure Router will always
translate source addresses to the current correct public address.

Overview

Typically, your ProCurve Secure Router performs NAT on traffic destined to
the Internet, translating the source address of all traffic from the LAN to an
address recognized by your ISP. Consider the problem that network monitor-
ing can introduce:
1. You configure your router to NAT the source of address of all local traffic
to the address on the primary WAN interface.
2. Network monitoring detects a failure and removes the route that forwards
traffic through the primary interface.
3. A backup route appears, and the router begins to forward traffic through
a secondary interface.
4. NAT continues to translate source addresses to the primary interface's
address.
5. The secondary ISP router does not know how to reach the primary
interface's address, so return traffic is dropped.
6. Users can no longer connect to the Internet.
ACL permit Command
permit icmp any hostname
www.mycompany.com
eq 25
permit tcp any host
172.16.12.15 eq 53
permit tcp any hostname
www.mycompany.com eq
www
Network Monitoring
Configuring Network Monitoring
Route Map set Command
set interface eth 0/1 null 0
set interface ppp 1 null 0
set interface atm 1.1 null 0
set ip next-hop 192.168.0.1
set interface null 0
9-37