A D D R E S S T R A N S L A T I O N
Destination NAT Configurations
10-6
Security Appliance User Guide
Version 3R2
1 0
•
Configuring Destination NAT: Many-to-One
•
Configuring Destination NAT: Many-to-One with Port Mapping
•
Configuring Destination NAT: Many-to-Many
CONFIGURING DESTINATION NAT: ONE-TO-ONE
In a one-to-one destination NAT configuration, a single destination
address translates to a different address that the security policy specifies
(refer to
Figure 10-4
). The most common use for one-to-one NAT is to
allow hosts on the Internet to access hosts on a Demilitarized Zone
(DMZ).
Figure 10-4: Destination Network Address Translation
Use the
set policy
command with the
nat dst ip
option to specify
destination NAT in the policy:
set policy from {zone} to {zone} {src_addr} (dst_addr}
{port} nat dst ip {nat_addr} permit
CONFIGURING DESTINATION NAT: ONE-TO-ONE WITH PORT MAPPING
Use the
set policy
command with the
nat dst ip
and
port
options to
specify destination NAT from a single address and port to a single
address and port:
set policy from {zone} to {zone} {src_addr} (dst_addr}
{port} nat dst ip {nat_addr} port {prt_nbr} permit
CONFIGURING DESTINATION NAT: MANY-TO-ONE
In a many-to-one destination NAT configuration, a group of destination
addresses translates to a single address that the policy specifies. Use the
set policy
command with the
nat dst ip
option to specify destination
NAT in the policy. In this configuration, the destination address dst_grp is
an address group consisting of a subnet, address range, or multiple
hosts.
