Extreme Networks ExtremeWare - Chapter 8 NAT Commands

ExtremeWare Software 7.3.0 Command Reference Guide 419
8 NAT Commands
This chapter covers the following topics:
• Configuring VLANs for Network Address Translation (NAT)
• Configuring NAT translation rules
• Displaying NAT settings
NAT is a feature that allows one set of IP addresses, typically private IP addresses, to be converted to
another set of IP addresses, typically public Internet IP addresses. This conversion is done transparently
by having a NAT device (any Extreme Networks switch using the “i” chipset) rewrite the source IP
address and layer 4 port of the packets.
You can configure NAT to conserve IP address space by mapping a large number of inside (private)
addresses to a much smaller number of outside (public) addresses.
In implementing NAT, you must configure at least two separate VLANs involved. One VLAN is
configured as inside, and corresponds to the private IP addresses you would like to translate into other
IP addresses. The other type of VLAN is configured as outside, which corresponds to the public
(probably Internet) IP addresses you want the inside addresses translated to. The mappings between
inside and outside IP addresses are done using rules that specify the IP subnets involved and the
algorithms used to translate the addresses.
NOTE
The NAT modes in ExtremeWare only support translating traffic that initiates from inside addresses.
NAT rules are associated with a single outside VLAN. Multiple rules per outside VLAN are allowed.
The rules take effect in the order they are displayed using the
show command. Any number of inside
VLANs can use a single outside VLAN, assuming that you have created proper rules. Similarly, a single
inside VLAN can use any number of different outside VLANs, assuming that the rules and routing are
set up properly.
TCP and UDP layer 4 ports, in combination with the IP addresses, form a unique identifier which
allows hosts (as well as the NAT switch) to distinguish between separate conversations. NAT operates
by replacing the inside IP packet’s source IP and layer 4 port with an outside IP and layer 4 port. The
NAT switch maintains a connection table to map the return packets on the outside VLAN back into
their corresponding inside sessions.