RadiSys SEG-100, Administration Manual

Page: 83 / 198

4
Address Translation
83
1. Create an address object for the public IP addresses:
Device:/> add Address IPAddress wwwsrv_pub Address=195.55.66.77 ‐ 195.55.66.81
2. Create another object for the base of the web server IP addresses:
Device:/> add Address IPAddress wwwsrv_priv Address=10.10.10.5
3. Publish the public IP addresses on the wan interface using ARP publish. A CLI command
like the following is needed for each IP address:
Device:/> add ARPEntry Interface=wan IP=195.55.66.77 mode=Publish
Alternatively, you could assign all five addresses to the Ethernet interface since the SEG
supports multiple interface IP addresses.
4. Change the current CLI context to be the main IP rule set:
Device:/> cc IPRuleSet main
5. Create a SAT rule for the translation:
Device:/IPRuleSet/main> add IPRule Action=Allow Service=http

SourceInterface=wan

SourceNetwork=all ‐ nets ‐ ip4

DestinationInterface=dmz

DestinationNetwork=wwwsrv_pub

DestinationTranslation=SAT

SetDestinationAddress=AllToOne

NewDestinationIP4=wwwsrv_priv
6. Return to the default CLI context with the command:
Device:/IPRuleSet/main> cc
In the above example, the option NewDestinationIP6= could be used with or instead of
NewDestinationIP4= to perform the same function with IPv6 addresses.
Note: When all ‐ nets , all ‐ nets ‐ ip4 , or all ‐ nets ‐ ip6 is the destination in a SAT rule, an All ‐ to ‐ One
mapping is always done.
Port translation with SAT
Port Translation (also known as Port Address Translation ‐ PAT) can be defined in a SAT IP rule
to modify either the source or destination port. This is similar to the 1:1 translation specified
above but the additional option NewSourcePort= is used.
Port translation is dependent on the range of port numbers specified in the Service filter
parameter used in the IP rule. If the Service object specifies only port 1000, this port is always
translated to the NewSourcePort= value. If the Service object specifies a port range, the new
port number is the NewSourcePort= plus the offset within the range.
For example, suppose NewSourcePort=80 is specified in the SAT IP rule and the Service object
used for the rule has a port range of 1000 to 1050. If the traffic allowed by the IP rule has a
port number of 1003, this will be translated to port 83 (1003 ‐ 1000 + 80).
Note: Both predefined or custom service objects can be used with SEG SAT IP rules.