SmartEdge: Simple NAPT configuration

Rules – how to apply NAT

NAT policy should be apply to incoming traffic

IP outgoing interface cannot be used in the NAT pool

NAT pool must be on separate subnet (not part of interface subnet)

In dynamic nat, NAT type of route is automatically created (no need extra route configuration)

In static nat, extra route must by added (ip route 6.6.6.0/24 1.1.2.2) to point nat interface for coming back packet

If we do “clear ip route * ” dynamic nat is stop working and nat policy must be recreated on interface level (SEOS 6.2)

On “multibind” interface, combination with static and dynamic nat is not working (only dynamic is operational), pool should be configured as multibind

ip nat pool my-pool napt multibind

NAT policy could be applied on the subscriber level

subscriber default ip address pool nat policy my-nat

Static NAT:

The ping from “LAN” context will be NAT-ed in “local” context in LAN interface. Source address 5.5.5.5 will be replace to 6.6.6.6 (static mapping) address and routed to context WAN.

Example configuration:

! context local ! ip nat pool POOL-1 napt address 2.2.2.0/24 ! nat policy POL-NAT ! Default class pool POOL-1 local ! Static rules ip static in source 5.5.5.5 6.6.6.6 ! interface LAN ip address 1.1.2.1/24 ip nat POL-NAT acl-counters ! interface WAN ip address 192.168.1.1/24 ! ip route 0.0.0.0/0 192.168.1.2 ip route 5.5.5.0/24 1.1.2.2 ip route 6.6.6.0/24 1.1.2.2 ip route 159.107.0.0/16 159.107.90.1 ! context WAN ! interface to-local ip address 192.168.1.2/24 no logging console ! ip route 1.1.2.0/24 192.168.1.1 ip route 1.1.3.0/24 192.168.1.1 ip route 2.2.2.0/24 192.168.1.1 ip route 6.6.6.0/24 192.168.1.1 ! context LAN ! interface Static loopback ip address 5.5.5.5/24 ! interface to-local ip address 1.1.2.2/24 no logging console ! ip route 0.0.0.0/0 1.1.2.1 ! ! ** End Context ** ! card carrier 2 mic 1 fe-12-port ! port ethernet 2/1 no shutdown medium-type copper bind interface to-local LAN ! port ethernet 2/2 no shutdown medium-type copper bind interface LAN local ! port ethernet 2/3 no shutdown bind interface WAN local ! port ethernet 2/4 no shutdown bind interface to-local WAN ! end

Checking nat translation:

[LAN]Redback# ping 192.168.1.2 PING 192.168.1.2 (192.168.1.2): source 1.1.2.2, 36 data bytes, timeout is 1 second !!!!! [LAN]Redback# ping 192.168.1.2 source 5.5.5.5 PING 192.168.1.2 (192.168.1.2): source 5.5.5.5, 36 data bytes, timeout is 1 second !!!!! [local]Redback# show nat policy POL-NAT detail Policy name : POL-NAT Policy grid : 0x1 Number of rules : 1 Slot mask : 0xc Number of binds : 1 Circuit : 2/2 Reference counters (in circuits * classes): Slot 2 1 Static NAT Rules: In/Out Protocol Src-Addr Port NAT-Src-Addr Port NAT-Ctx-Id in ip 5.5.5.5 0 6.6.6.6 0 0x40080001 Class-Name Action/ Pool-Grid/ Dest-IP-Addr/ Timeout(sec) Admit-Ctrl P2MP Context-Id Context-Id default na[p]t 0x1 tcp 86400 Off 0x40080001 udp 120 finrst 240 icmp 60 syn 128 basic 3600

** Note: This is not official command and should be use with extra attention.**

The syntax could be changed in new release:

Checking dynamic translations

[local]Redback# show card 2 nat ? circuit Display circuit nat information counters Display NAT counters (without drop counters) drop-counters Display NAT drop counters log NAT Message Log policy Display policy information pool Display pool information translation Display translation information [local]Redback# show context Context Name Context ID VPN-RD Description ------------------------------------------------------------------------------ local 0x40080001 [local]Redback# show card 2 nat translation context 0x40080001 source any Slot 2 Ingress: Type IP From IP To Ports Flag Pointer Ctx Flag Flag: D-Dynamic, R-remote, Z-dmz, A-admission, I-ignore translation, d-dest NAT, U - p2mp UDP NAPT 1.1.2.2 2.2.2.0 1990/0009 0x0014 0x50024440 1/1 D NAPT 1.1.2.2 2.2.2.0 1991/0010 0x0014 0x500244a0 1/1 D NAPT 1.1.2.2 2.2.2.0 1989/0008 0x0014 0x500243e0 1/1 D

Checking static translation

[local]Redback# show card 2 nat circuit 2/2:1023:63/1/1/7 detail Circuit 2/2:1023:63/1/1/7 ingress Feature block pointer: 0x4ea8b4e0 Policy: grid=1 version=1 pointer=0xf0536ae0 Number src rules: 1 ptr 0xf05877c0 Number dst rules: 0 ptr 0x0 Number napt rules: 0 ptr 0x0 Out nat ptr 0xd053c2c0 napt ptr 0xf053eac0 class 0 ptr 0x4eaab500 Rule table: Type IP From IP To Ports Csum Idx Ctx Vrs src nat 5.5.5.5 6.6.6.6 0000/0000 0xfdfd 65 1 1 Circuit 2/2:1023:63/1/1/7 egress Feature block pointer: 0x4ae2c520 Policy: grid=1 version=1 pointer=0xd00eb240 Number src rules: 0 ptr 0x0 Number dst rules: 1 ptr 0xd09cf0e0 Number napt rules: 0 ptr 0x0 Rule table: Type IP From IP To Ports Csum Idx Ctx Vrs dst nat 6.6.6.6 5.5.5.5 0000/0000 0x0202 129 1 1

Checking translation by using “access-list”

! ip access-list dyn seq 10 permit ip 2.2.2.0 0.0.0.255 any seq 15 permit ip host 6.6.6.6 any seq 20 permit ip any any ! ! interface to-local ip address 192.168.1.2/24 ip access-group dyn in count log no logging console ! [WAN]Redback# clear access-group ip-filter interface to-local in all [WAN]Redback# show access-group ip-filter interface to-local in counters Circuit 2/4, slot 2, IPv4 access-list dyn, in, 3 rules Hit Count: 0 No Match (Default) Hit Count: 0 seq 10 permit ip 2.2.2.0 0.0.0.255 any Hit Count: 0 seq 15 permit ip host 6.6.6.6 any Hit Count: 0 seq 20 permit ip any any [LAN]Redback# ping 192.168.1.2 source 5.5.5.5 PING 192.168.1.2 (192.168.1.2): source 5.5.5.5, 36 data bytes, timeout is 1 second !!!!! [LAN]Redback# ping 192.168.1.2 PING 192.168.1.2 (192.168.1.2): source 1.1.2.2, 36 data bytes, timeout is 1 second !!!!! [WAN]Redback# show access-group ip-filter interface to-local in counters Circuit 2/4, slot 2, IPv4 access-list dyn, in, 3 rules Hit Count: 0 No Match (Default) Hit Count: 5 seq 10 permit ip 2.2.2.0 0.0.0.255 any Hit Count: 5 seq 15 permit ip host 6.6.6.6 any Hit Count: 0 seq 20 permit ip any any

SmartEdge: Simple NAPT configuration

Rules – how to apply NAT

Dynamic NAT

Static NAT: