Rockwell ArmorStratix 5700 series, Инструкция по эксплуатации

Страница: 261 / 548

Rockwell Automation Publication 1783-UM007F-EN-P - September 2016 261
Configure Switch Features Chapter 7
Management Interface and VLANs
The management interface can be associated with a VLAN that is or is not
assigned to a NAT instance:
• If its associated VLAN is assigned to a NAT instance, the management
interface resides on the private subnet by default. To manage the switch
from the private subnet, no additional configuration is required. To
manage the switch from the public subnet, you must configure a private-
to-public translation.
• If its associated VLAN is not assigned to a NAT instance, the traffic of
the management interface remains untranslated and is always permitted
to pass through the port.
Configuration Considerations
Consider these guidelines and limitations when configuring NAT:
• All switches can translate only IPv4 addresses.
• All switches can have a maximum of 128 NAT instances.
• Switch-specific features are shown in the following table.
Ports that are configured for NAT do
not
support the following across the
NAT boundary due to embedded IP addresses that are not fixed up, encrypted
IP addresses, or reliance on multicast traffic:
• Traffic encryption and integrity checking protocols incompatible with
NAT, including IPsec Transport mode (1756-EN2TSC module)
• Applications that use dynamic session initiations, such as NetMeeting
• File transfer protocol (FTP)
• Microsoft Distributed Component Object Model (DCOM), which is
used in Open Platform Communications (OPC)
• Multicast traffic, including applications that use multicast, such as
CIP Sync (IEEE1588) and ControlLogix redundancy
Feature Stratix 5700 Switch Stratix 5400 Switch Stratix 5410 Switch
Uplink Ports 2 4 4
(2)
(2) Both uplink and downlink ports can be configured for as many as 8 NAT ports.
Downlink Ports 0 0 8
(2)
Translation Entries
(1)
(1) A subnet translation counts as only one translation entry, but includes translations for many devices
128 128 256
(3)
(3) 128 entries across ports 1…6 and 13…18, plus 128 entries across ports 7…12, 19…24, and 25…28 for a total of 256 entries.
IMPORTANT Some NAT configurations can result in greater-than-expected traffic loads on
both private and public subnets. Also, unintended traffic can be visible.
NAT is not a substitute for a firewall. Make sure that your configuration is
performance qualified before use in a production environment.