Extreme Networks ExtremeWare 7.7, Command Reference Manual

Page: 476 / 2620

476 ExtremeWare 7.7 Command Reference Guide
NAT Commands
Usage Guidelines
Four different modes are used to determine how the outside IP addresses and layer 4 ports are
assigned:
• Static mapping
• Dynamic mapping
• Port mapping
• Auto-constraining
Static and Dynamic Mapping. When static mapping is used, each inside IP address uses a single
outside IP address. The layer 4 ports are not changed, and only the IP address is rewritten.
With dynamic mapping, the number of inside hosts can be greater than the number of outside hosts.
The outside IP addresses are allocated on a first-come, first-serve basis to the inside IP addresses. The
layer 4 ports are not changed. When the last session for a specific inside IP address closes, that outside
IP address can be used by other hosts.
The
source
IP address specifies private side IP addresses and the
to
IP address (the NAT address)
specifies the public side IP address. The addition of the
destination
optional keyword after the source
IP address and mask species that the NAT rule to be applied to only packets with a specific destination
IP address.
If the netmask for both the source and NAT addresses is /32, the switch uses static NAT translation. If
the netmasks for the source and NAT addresses are not both /32, the switch uses dynamic NAT
translation.
With static or dynamic translation rules, which do not rely on layer 4 ports, ICMP traffic is translated
and allowed to pass.
Port Mapping. The addition of a layer 4 protocol name and the
portmap
keyword tells the switch to
use port mapping mode. As each new connection is initiated from the inside, the NAT device picks the
next available source layer 4 port on the first available outside IP address. When all ports on a given IP
address are in use, the NAT device uses ports from the next outside IP address.
Optionally, you may specify the range of layer 4 ports the switch chooses on the translated IP addresses.
The default setting for
min
is 1024. The default setting for
max
is 65535. There is a performance penalty
associated with specifying a specific port range other than the default.
ICMP traffic is not translated in port mapping mode. You must add a dynamic NAT rule for the same
IP address range to allow for ICMP traffic.
Auto-constraining. The auto-constraining algorithm for port-mapping limits the number of outside
layer 4 ports a single inside host can use simultaneously. The limitation is based on the ratio of inside to
outside IP addresses. The outside IP address and layer 4 port space is evenly distributed to all possible
inside hosts. This guarantees that no single inside host can prevent other traffic from flowing through
the NAT device. Because of the large number of simultaneous requests that can be made from a web
browser, it is not recommended that this mode be used when a large number of inside hosts are being
translated to a small number of outside IP addresses.
ICMP traffic is not translated in auto-constrain mode. You must add a dynamic NAT rule for the same
IP address range to allow for ICMP traffic.