Many-To-Many Nat And Nat Control - H3C SecPath F1800-A Operation Manual

Operation Manual - Security Defence
H3C SecPath F1800-A Firewall

3.2.2 Many-to-Many NAT and NAT Control

I. Overview
As shown in
address of the intranet. The public address of the outbound interface on the NAT
server is chosen in
extranet IP address when they access the external network. In other words, only one
host can access the external network at a time when several hosts intend to access
the external network at the same time, which is called "one-to-one NAT".
An extended NAT implements the concurrent access, that is, multiple public IP
addresses are assigned to a NAT server. When one internal host accesses the
external network, the NAT server assigns a public address IP1 to a requesting host,
appends a record in the NAT list and forwards the data packet. When another internal
host accesses the external network, the NAT server assigns another public address
IP2 to another request host and so on. This is called "many-to-many NAT".
Note:
The number of public IP addresses on the NAT server is far less than the number of
hosts in the intranet because not all hosts will access the extranet at a time. The
public IP address number is determined based on the maximum number of intranet
hosts that access the external network at the rush hour of the network.
In practice, it may be required that only some intranet hosts can access the Internet
(external network). In other words, the NAT server will not translate source IP
addresses of those unauthorized hosts, which is called NAT control.
The SecPath F1800-A fulfills many-to-many NAT through defining address pool and
controls NAT through ACL.
Address pool: is a set of public IP addresses for NAT. You should configure a
proper address pool based on valid IP address number, internal host number as
well as the actual condition. An address will be selected from the pool as the
source address during the NAT.
ACL-based NAT: indicates that only the data packet meeting the requirement of
ACL rule can be translated. In this way, the NAT range can be controlled
effectively and some hosts are entitled to access the Internet.
Figure 3-1, NAT chooses a proper extranet address to replace the source
Figure 3-1. In this way, all the hosts in the intranet share one
6-69
Chapter 3 NAT