Configuring Intranet Hosts to Access Public Networks
Context
Internal hosts can access the public network through dynamic NAT. Basically, dynamic NAT is configured on the NAT device's outbound interface connected to the public network to translate private IP addresses into public IP addresses. Dynamic NAT can be implemented in either address pool mode or Easy IP mode. You can choose one of the NAT modes as needed.
- If there are still available public IP addresses after the outbound interface IP address of the NAT device and other applications are configured, configure dynamic NAT in address pool mode.
- If there are no more available public IP addresses after the outbound interface IP address of the NAT device and other applications are configured, configure dynamic NAT in Easy IP mode. This mode can use the outbound interface IP address of the NAT device to implement NAT.
Procedure
- Run system-view
The system view is displayed.
- Run acl [ number ] acl-number [ match-order { auto | config } ]
An ACL with the specified number is created and the ACL view is displayed.
- Run quit
Exit the ACL view.
- Configure dynamic NAT for the outbound interface on the NAT device. Choose one of the following methods based on your site scenario:
- Configure dynamic NAT in address pool mode.
- Run nat address-group group-index start-address end-address
A NAT address pool is configured.
- Run interface interface-type interface-number[.subnumber ]
The interface view or sub-interface view is displayed.
- Run nat outbound acl-number address-group group-index [ no-pat ]
Dynamic NAT that references the address pool is configured.
- Run nat address-group group-index start-address end-address
- Configure dynamic NAT in Easy IP mode.
- Run interface interface-type interface-number[.subnumber ]
The interface view or sub-interface view is displayed.
- Run nat outbound acl-number [ interface interface-type interface-number[.subnumber ] ]
Dynamic NAT in Easy IP mode is configured.
- Run interface interface-type interface-number[.subnumber ]
Only basic ACLs (2000 to 2999) and advanced ACLs (3000 to 3999) can be used to configure the NAT function. Configure basic or advanced ACLs as required.
When the action in an ACL rule is permit, the NAT policy referencing the ACL rule takes effect. When the action in an ACL rule is not permit, the NAT policy referencing the ACL rule does not take effect. That is, the device searches the routing table for routes corresponding to the destination address, but does not translate addresses.
After the ACL rule referenced by the NAT policy is modified, the modification does not take effect immediately. To make the modification take effect immediately, run the reset nat session command to clear the NAT mapping table. You are advised not to modify the ACL rules in use.
- Configure dynamic NAT in address pool mode.
