Extreme Networks ExtremeWare 7.7, Command Reference Manual

Page: 473 / 2620

ExtremeWare 7.7 Command Reference Guide 473
8
NAT Commands
This chapter describes commands for:
• Configuring VLANs for Network Address Translation (NAT)
• Configuring NAT translation rules
• Displaying NAT settings
Network address translation (NAT) is a feature that allows one set of IP addresses, typically private IP
addresses, to be converted to another set of IP addresses, typically public Internet IP addresses. This
conversion is done transparently by having a NAT device (for example, any Extreme Networks switch)
rewrite the source IP address and layer 4 port of the packets.
You can configure NAT to conserve IP address space by mapping a large number of inside (private)
addresses to a much smaller number of outside (public) addresses.
In implementing NAT, you must configure at least two separate VLANs involved. One VLAN is
configured as inside, and corresponds to the private IP addresses you would like to translate into other
IP addresses. The other type of VLAN is configured as outside, which corresponds to the public
(probably Internet) IP addresses you want the inside addresses translated to. The mappings between
inside and outside IP addresses are done using rules that specify the IP subnets involved and the
algorithms used to translate the addresses.
NOTE
The NAT modes in ExtremeWare only support translating only traffic that initiates from inside addresses.
NAT rules are associated with a single outside VLAN. Multiple rules per outside VLAN are allowed.
The rules take effect in the order they are displayed using the
show
command. Any number of inside
VLANs can use a single outside VLAN, assuming that you have created proper rules. Similarly, a single
inside VLAN can use any number of different outside VLANs, assuming that the rules and routing are
set up properly.
TCP and UDP layer 4 ports, in combination with the IP addresses, form a unique identifier which
allows hosts (as well as the NAT switch) to distinguish between separate conversations. NAT operates
by replacing the inside IP packet’s source IP address and layer 4 port with an outside IP address and
layer 4 port. The NAT switch maintains a connection table to map the return packets on the outside
VLAN back into their corresponding inside sessions.