This command displays the timeout interval of sessions on the firewall session table or NAT session table.

You can check the configuration and application of the NAT address pool.

None

None

None

None

None

You can use this command to check whether the NAT server is configured correctly.

This command displays information about the NAT mapping table. You can view information about all entries or display information by specifying keywords. The entries in a NAT mapping table are triggered by service packets. If the device does not receive any service packet, no entry is generated.

After static NAT is configured, you can use the display nat static command to view the configuration of static NAT.

None

After NAT mapping is configured, you can view the NAT mapping information. For example, you can view:

• Endpoint-independent mapping information about TCP packets.
• Endpoint-independent mapping information about UDP packets.
• Endpoint-independent mapping about TCP and UDP packets.

The display nat mapping table command displays information about all entries in a NAT table or the number of entries in the NAT table. You can also enter keywords to view a specified entry.

Usage Scenario

The firewall-nat session aging-time command sets the timeout interval for sessions of each protocol or port. If an entry in a session table is not used within the specified period, the entry expires. For example, the user with IP address 10.110.10.10 initiates a TCP connection through port 2000. If the TCP connection is not used within the timeout interval, the system deletes the TCP connection.

The default session timeout interval of a port is the same as that of the corresponding protocol. The following table lists the default session timeout interval of each protocol.

When configuring the timeout interval for all sessions with a user-defined port as the destination port, you cannot set the port number to a default port number of the preceding protocols.

Precautions

For some services such as voice service, increase the TCP/UDP timeout interval to prevent service interruption.

You can set the session timeout interval for a maximum of 24 ports on the device.

Usage Scenario

The address pool is a set of consecutive IP addresses. When a packet from the private network reaches the public network through address translation, the source address of the packet will be translated to another address by the address pool.

Precautions

The start IP address of the address pool must be smaller than or equal to the end IP address of the address pool and up to 255 IP addresses can be configured in the address pool.

After the NAT ALG function is enabled for an application protocol, packets of the application protocol can traverse the public network through NAT. Otherwise, the application protocol cannot work normally.

When a SIP server is deployed on the public network and SIP phones in public and private networks are interconnected, the call quality is affected if the bandwidth on the NAT device is insufficient. You can enable call admission control (CAC) and set the total bandwidth on the NAT device to limit the bandwidth of SIP calls. If the bandwidth of a SIP exceeds the specified value, the SIP call is rejected.

Usage Scenario

You can use this command to configure the mapping from the domain name to the public IP address, port number, and protocol type for internal hosts. In this manner, internal hosts can differentiate and access corresponding internal servers according to domain names when no DNS server is deployed on the private network.

By default, DNS mapping is not configured. In this case, after the external DNS server resolves public IP addresses from domain name requests of internal hosts, the internal hosts can be mapped to only one internal server. In addition, internal hosts cannot differentiate and access corresponding internal servers according to domain names.

Follow-up Procedure

Run the nat alg dns enable command to enable the DNS NAT ALG function. The NAT ALG function allows hosts on a private network to access servers on the private network through the external DNS server.

NAT filtering allows applications using the STUN and TURN technologies to traverse the NAT server.

NAT is performed on the traffic from the external network to the internal network:

• If the NAT filtering mode is set to endpoint-independent, the system uses "destination IP address+destination port number+protocol number" as the key to search the mapping table. If a corresponding entry is found, the system generates a reverse mapping entry. The destination address and port in the entry are the IP address and port number on the internal network.
• If the NAT filtering mode is set to endpoint-dependent, the system uses "source IP address+destination IP address+destination port number+protocol number" as the key to search the mapping table. If a corresponding entry is found, the system generates a reverse mapping entry. The behavior in the reverse mapping entry is the same as the behavior in the mapping table entry.
• If the NAT filtering mode is set to endpoint-and-port-dependent, the system uses "source IP address+source port number+destination IP address+destination port number+protocol number" as the key to search the mapping table. If a corresponding entry is found, the system generates a reverse mapping entry. The behavior in the reverse mapping entry is the same as the behavior in the mapping table entry.

You can change the NAT filtering mode only when no traffic is transmitted between the external network and internal network.

Application Scenario

You can run this command to specify whether the NAT service or routing service has a higher priority. If the NAT service has a higher priority, NAT is performed for traffic entering the device before routing. If the routing service has a higher priority, traffic is routed before NAT. This function is applicable to multi-uplink scenarios. For example, in a dual-uplink scenario, when you run the nat static command in the interface view or nat static in the system view on the master device to configure a static mapping between a public IP address and a private IP address, a user network route (UNR) is generated. When you run the ip route-static command in the system view, a static route from the public IP address to the private IP address is configured. By running the preceding two commands, you expect that NAT can be performed on traffic entering the device and a backup route is available. A static route has a higher priority than that of the UNR. Therefore, the static route that is configured later overwrites the UNR, and NAT and route backup cannot be implemented on the device at the same time. To resolve this problem, run the nat inside priority enable command to enable the NAT service to take precedence over the routing service so that the device performs NAT on traffic before routing it.

Prerequisites

In the scenario where connection between the device and eLog server is required, the device must send log packets in the specified format to the eLog server to establish the connection. You can run the nat log-format elog or undo nat log-format elog command to set the log format to eLog or a common format.

After an ACL is associated with an NAT address pool, the device translates the source address of a data packet matching the ACL into an IP address in the NAT address pool. You can run the nat miss forward deny command to enable the function of discarding the packets that do not match the ACL rules bound to NAT.

After this command is run, packets are discarded if the number of session entries exceeds the upper limit.

After an ACL is associated with a NAT address pool, NAT translates the source IP address of a data packet matching the ACL to an IP address in the NAT address pool.

On the same interface, different IP addresses can be translated and associated. This interface usually connects to an ISP network and is the egress of the internal network.

This command can only be used on Layer 3 interfaces, except the Loopback, Tunnel-Template, and NULL interfaces.

On the Layer 2 interface card of the AR2220, AR2240, AR2240C, AR3200 series, 3600 series, NAT needs to be configured on the VLANIF interface. In this case, run the set workmode lan-card l3centralize command in the system view to enable centralized forwarding.

Easy IP indicates that the IP address of the interface is used as the translated IP address.

This command can only be used on Layer 3 interfaces, except the Loopback, Tunnel-Template, and NULL interfaces.

Only one command can be configured on an interface.

When IP addresses of internal hosts and external hosts are overlapped, you need to configure the mapping between the overlapped address pool and the temporary address pool. After the mapping is configured, the overlapped address is translated into a unique temporary address. The packets can be forwarded correctly. In addition, you need to configure outbound NAT to implement twice NAT.

Usage Scenario

You can configure an internal server so that the external network can access the server in an active manner. When a host on the public network sends a connection request to the public address (global-address) of the internal NAT server, the NAT server translates the destination address of the request into a private address (inside-address). The request is then forwarded to the server on the private network.

• This command can only be used on Layer 3 interfaces, except the Loopback, Tunnel-Template, and NULL interfaces.

• When configuring an internal NAT server, ensure that global-address and host-address are different from IP addresses of ports and IP addresses in the user address pool.
• You can use the IP address of current-interface or loopback as the internal server's IP address.
• The undo nat server command does not delete mapping entries immediately. You can run the reset nat session command to delete mapping entries.
• Compared with static NAT, NAT Server translates only the IP address, but not the port number, when the private network initiatively accesses the public network.
• When you configure one-to-one NAT Server that borrows an interface IP address (no interface number is specified and the IP address is mapped to a private network address), other services enabled on the interface may become unavailable. Confirm your action before performing the configuration. If you want to enable other applications on the interface, add an ACL rule after the configuration to filter out the number of the interface on which the applications are enabled.

Precautions

The specified global-port or host-port cannot be used by other applications. Otherwise, the configuration does not take effect.

When specifying global-port2 to configure multiple public ports, you must also specify host-address2 to configure multiple private addresses and ensure that the number of ports is the same as that of private addresses.

If you need to map the private address of an internal server into the IP address of the public network interface when configuring this command on the public network interface, you must set the current-interface parameter to specify a global address as the current interface address.

If you specify vrrp vrrpid when configuring the nat server command on an interface, the interface must support the VRRP function.

The vpn-instance-name parameter in the command specifies a private network-side VPN instance and does not take effect on the global-address parameter. The ip binding vpn-instance vpn-instance-name command can be run in the interface view to bind a public network-side VPN instance to the interface.

Application Usage Scenario

Since terminals are vulnerable to network attacks on a complex network, the terminals under network attacks will occupy a large number of NAT mapping entries on the devices they connected to. Once the NAT mapping entries on the devices are exhausted, other terminals cannot access the Internet because no NAT mapping entry can be allocated to them. In this case, you can run the nat session limit command to set the maximum number of NAT mapping entries that can be used by users. When the number of NAT mapping entries created for a user exceeds the configured limit, the device does not generate new NAT mapping entries. As a result, denying the user's Internet access is restricted.

Precautions

• This command cannot be used together with other functions for creating flow tables, such as the firewall, IPS, and SAC. Otherwise, this command may not take effect.
• If an ACL is configured, ACL rule updates do not affect the maximum number of NAT mapping entries that can be used by a user.
• If an ACL is configured and the ACL rule defines deny, the number of NAT mapping entries that can be used by a user is not limited.
• The NAT session table created on the device before this command is run is not included in the statistics of NAT mapping entries.
• After an active/standby device switchover is performed, the devices clear the statistics of NAT mapping entries that have been collected before the switchover and re-collects the statistics.

Usage Scenario

If devices on a private network allow access from devices on a public network through a fixed IP address, for example, a private server provides services to public network devices, the public network devices can access the server through a fixed public IP address. You can configure static NAT to translate the private IP address of the private server into the specified public IP address.

If a private server provides services to multiple public network segments, the private IP address of the server needs to be translated into multiple public IP addresses to ensure security. Generally, bidirectional translation between private and public IP addresses is implemented in static NAT. When a private server accesses a public network, the private IP address of the server cannot be translated into multiple public IP addresses. You can configure unidirectional static NAT to solve this problem. When a public network device accesses the private server, multiple public IP addresses are translated into the private IP address of the server using static NAT. When the private server accesses the public network, IP addresses are translated using outbound NAT.

Static NAT also supports IP address translation between network segments, that is, private IP addresses within a specified range and public IP addresses within a specified range can be translated into each other.

Precautions

After the undo nat static command is run on the device, static mapping entries on the device will not be cleared immediately. To clear static mapping entries immediately, run the reset nat session command.

When the global-port, global-port2, host-port, and host-port2 parameters are specified to configure mappings between public and private port numbers, the number of public port numbers must be the same as the number of private port numbers and the port numbers must be mapped in sequence. For example, when nat static protocol tcp global 1.1.1.1 11 20 inside 10.10.10.1 21 30 is configured, the public IP address 1.1.1.1 maps the private IP address 10.10.10.1, and public port numbers 11 to 20 map private port numbers 21 to 30 in sequence.

When host-address2 is specified, global-port2 and host-port must also be specified. The number of private addresses must be the same as the number of public port numbers. That is, the same public address maps different private addresses, and different public port numbers map the same private port number. For example, when nat static protocol tcp global 1.1.1.1 11 12 inside 10.10.10.1 10.10.10.2 30 is configured, 1.1.1.1 and public port 11 map 10.10.10.1 and private port 30, and 1.1.1.1 and public port 12 map 10.10.10.2 and private port 30.

If you specify vrrp vrrpid when configuring the nat static command on an interface, the interface must support the VRRP function.

The vpn-instance-name parameter in the command specifies a private network-side VPN instance and does not take effect on the global-address parameter. The ip binding vpn-instance vpn-instance-name command can be run in the interface view to bind a public network-side VPN instance to the interface.

If you specify acl-number when configuring multiple nat static commands on an interface, the ACL number specified in the commands must be the same. Otherwise, the configuration fails.

Static NAT indicates that a private address is statically bound to a public address when NAT is performed. The public IP address in static NAT is only used for translation of the unique and fixed private IP address of a host.

Static PAT indicates that a combination of the private address of a host, TCP/UDP protocol number, and internal port number is statically bound to a combination of the public address, TCP/UDP protocol number, and external port number. The public IP address in static PAT can be used for translation of multiple private addresses.

Using static NAT or PAT, hosts on the private network and hosts on the public network can access each other.

• If you run the undo nat static command, static mapping entries are not immediately deleted. To clear static mapping entries, run the reset nat session command.

• When the global-port, global-port2, host-port, and host-port2 parameters are specified to configure mappings between public and private port numbers, the number of public port numbers must be the same as the number of private port numbers and the port numbers must be mapped in sequence. For example, when nat static protocol tcp global 1.1.1.1 11 20 inside 10.10.10.1 21 30 is configured, the public IP address 1.1.1.1 maps the private IP address 10.10.10.1, and public port numbers 11 to 20 map private port numbers 21 to 30 in sequence.

  When host-address2 is specified, global-port2 and host-port must also be specified. The number of private addresses must be the same as the number of public port numbers. That is, the same public address maps different private addresses, and different public port numbers map the same private port number. For example, when nat static protocol tcp global 1.1.1.1 11 12 inside 10.10.10.1 10.10.10.2 30 is configured, 1.1.1.1 and public port 11 map 10.10.10.1 and private port 30, and 1.1.1.1 and public port 12 map 10.10.10.2 and private port 30.

• nat static protocol { tcp | udp } global interface loopback interface-number global-port [ global-port2 ] [ vpn-instance vpn-instance-name ] inside host-address [ host-address2 ] [ host-port ] [ vpn-instance vpn-instance-name ] [ netmask mask ] [ description description ]

  In the command, the first vpn-instance-name parameter specifies the VPN instance bound to the loopback interface, and the second vpn-instance-name parameter specifies a private network-side VPN instance.
• If the ip binding vpn-instance vpn-instance-name command is run in the interface view to bind a public network-side VPN instance to the interface, the nat static command in the system view does not take effect. In this case, you need to run the nat static or nat server command in the interface view.

Using the nat static enable command, you can enable static NAT on an interface.

This command can only be used on Layer 3 interfaces, except loopback and NULL interfaces.

When enabling static NAT on a sub-interface, you must also enable the function on the main interface. Otherwise, the function does not take effect on the sub-interface.

The NAT function resolves the problem of IPv4 address shortage and improves network security. NAT implementation of different vendors may be different, so the applications using the STUN, TURN, and ICE technologies may fail to traverse the NAT devices of these vendors. These technologies are mainly used on the SIP proxy. NAT mapping enables these applications to traverse the NAT devices.

NAT mapping has the following modes:

• Endpoint-independent mapping: The NAT reuses the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.
• Address and port-dependent mapping: The NAT reuses the port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port while the mapping is still active.

Port mapping enables a server to provide various application-layer services for external systems through non-well-known ports. For example, the well-known port of the HTTP service is port 80. After port mapping is configured on the firewall, the firewall can use a non-well-known port to provide the HTTP service.

Port mapping reduces attacks to a certain service on the server.

Usage Scenario

If the configurations of nat alg, nat server, nat static, and nat outbound are changed, the packets are not forwarded based on new configurations. You can run the reset nat session command to make the new configurations take effect. This command can be used to delete all entries or the entries for a specified protocol type or the entries of traffic passing a specified interface from the NAT mapping table.

Precautions

• After this command is used, entries are deleted from the NAT mapping table and the NAT configurations are modified immediately.
• After this command is executed, you must wait at least 10 seconds if you need to run the command again; otherwise, an error message is displayed.
• If all entries are deleted, communication among certain sessions may be affected for a short period.

If the running timer of a NAT module is faulty, the NAT service fails and the device cannot work properly. In this case, run the set nat-session self-healing enable command. After the self-healing function is enabled on the timer of a NAT module, the usage of the timer can be automatically detected. If the timer is faulty, you can reset the device to rectify the fault and ensure the proper running of the device.

Usage Scenario

In the SIP ALG scenario, if a SIP data packet sent by the SIP client is too large to be sent to the SIP server at a time, the client divides the oversized SIP data packet into multiple small data packets and sends them to the SIP server. In this case, you need to enable the TCP proxy function on the device so that the device reassembles the received small data packets into the original SIP packet, performs NAT, and then forwards the packet to the SIP server.

The device listens to packets based on the specified IP address and port number after the TCP proxy function is enabled, and then sets up a TCP connection with host A that initiates a TCP connection. After successfully setting up the TCP connection, the device proactively sets up a TCP connection with host B which is the destination device of host A, ensuring that hosts A and B can communicate properly.

Precautions

After the TCP proxy function is disabled, the device deletes TCP connections set up with all hosts and the session table saved on the device. Run the reset nat session all command to delete all flow table information.

In the SIP ALG scenario, if a SIP data packet sent by the SIP client is too large to be sent to the SIP server at a time, the client divides the oversized SIP data packet into multiple small data packets and sends them to the SIP server. In this case, you need to enable the TCP proxy function on the device so that the device reassembles the received small data packets into the original SIP packet, performs NAT, and then forwards the packet to the SIP server.

If the TCP proxy function is enabled, the device exchanges TCP keepalive packets with a host after it sets up a TCP connection with the host. If the device does not receive TCP keepalive packets from the host within the time three times the aging time, it automatically deletes the TCP connection and corresponding session entry.