You can check the configuration and application of the NAT address pool.

None

None

None

None

None

You can use this command to check whether the NAT server is configured correctly.

This command displays information about the NAT mapping table. You can view information about all entries or display information by specifying keywords. The entries in a NAT mapping table are triggered by service packets. If the device does not receive any service packet, no entry is generated.

After static NAT is configured, you can use the display nat static command to view the configuration of static NAT.

None

After NAT mapping is configured, you can view the NAT mapping information. For example, you can view:

• Endpoint-independent mapping information about TCP packets.
• Endpoint-independent mapping information about UDP packets.
• Endpoint-independent mapping about TCP and UDP packets.

The display nat mapping table command displays information about all entries in a NAT table or the number of entries in the NAT table. You can also enter keywords to view a specified entry.

You can run the display stun configuration command to view STUN server configuration, including the IP address, UDP port number, and VPN instance on which a STUN server listens.

You can run the display stun statistics packet command to view received and sent STUN packet statistics for STUN fault location and maintenance.

Usage Scenario

The address pool is a set of consecutive IP addresses. When a packet from the private network reaches the public network through address translation, the source address of the packet will be translated to another address by the address pool.

Precautions

The start IP address of the address pool must be smaller than or equal to the end IP address of the address pool and up to 255 IP addresses can be configured in the address pool.

After the NAT ALG function is enabled for an application protocol, packets of the application protocol can traverse the public network through NAT. Otherwise, the application protocol cannot work normally.

You can run this command to disable the magic number check function for NAT services.

When a NAT address pool is configured, the device delivers UNRs. In this case, users can access addresses in the NAT address pool. After the function of denying access to addresses in the NAT address pool is enabled, users cannot access addresses in the NAT address pool, ensuring route security.

When a SIP server is deployed on the public network and SIP phones in public and private networks are interconnected, the call quality is affected if the bandwidth on the NAT device is insufficient. You can enable call admission control (CAC) and set the total bandwidth on the NAT device to limit the bandwidth of SIP calls. If the bandwidth of a SIP exceeds the specified value, the SIP call is rejected.

Usage Scenario

You can use this command to configure the mapping from the domain name to the public IP address, port number, and protocol type for internal hosts. In this manner, internal hosts can differentiate and access corresponding internal servers according to domain names when no DNS server is deployed on the private network.

By default, DNS mapping is not configured. In this case, after the external DNS server resolves public IP addresses from domain name requests of internal hosts, the internal hosts can be mapped to only one internal server. In addition, internal hosts cannot differentiate and access corresponding internal servers according to domain names.

Follow-up Procedure

Run the nat alg dns enable command to enable the DNS NAT ALG function. The NAT ALG function allows hosts on a private network to access servers on the private network through the external DNS server.

NAT filtering allows applications using the STUN and TURN technologies to traverse the NAT server.

NAT is performed on the traffic from the external network to the internal network:

• If the NAT filtering mode is set to endpoint-independent, the system uses "destination IP address+destination port number+protocol number" as the key to search the mapping table. If a corresponding entry is found, the system generates a reverse mapping entry. The destination address and port in the entry are the IP address and port number on the internal network.
• If the NAT filtering mode is set to endpoint-dependent, the system uses "source IP address+destination IP address+destination port number+protocol number" as the key to search the mapping table. If a corresponding entry is found, the system generates a reverse mapping entry. The behavior in the reverse mapping entry is the same as the behavior in the mapping table entry.
• If the NAT filtering mode is set to endpoint-and-port-dependent, the system uses "source IP address+source port number+destination IP address+destination port number+protocol number" as the key to search the mapping table. If a corresponding entry is found, the system generates a reverse mapping entry. The behavior in the reverse mapping entry is the same as the behavior in the mapping table entry.

You can change the NAT filtering mode only when no traffic is transmitted between the external network and internal network.

In the scenario where connection between the device and eLog server is required, the device must send log packets in the specified format to the eLog server to establish the connection. You can run the nat log-format elog or undo nat log-format elog command to set the log format to eLog or a common format.

After an ACL is associated with an NAT address pool, the device translates the source address of a data packet matching the ACL into an IP address in the NAT address pool. You can run the nat miss forward deny command to enable the function of discarding the packets that do not match the ACL rules bound to NAT.

After the nat miss forward deny command is run, packets will be discarded if NAT fails because the number of session entries exceeds the upper limit or a flow table conflict occurs.

Use Scenario

After an ACL is associated with a NAT address pool, NAT translates the source IP address of a data packet matching the ACL into an IP address in the NAT address pool.

Multiple ACL-to-address pool associations can be configured on the same interface. This interface usually connects to an ISP network and is the egress of the internal network.

This command can be run only on NAT-capable Layer 3 interfaces.

Easy IP uses the IP address of an interface as the post-NAT IP address.

This command can be run only on NAT-capable Layer 3 interfaces.

When IP addresses of internal hosts and external hosts are overlapped, you need to configure the mapping between the overlapped address pool and the temporary address pool. After the mapping is configured, the overlapped address is translated into a unique temporary address. The packets can be forwarded correctly. In addition, you need to configure outbound NAT to implement twice NAT.

Usage Scenario

You can configure an internal server so that the external network can access the server in an active manner. When a host on the public network sends a connection request to the public address (global-address) of the internal NAT server, the NAT server translates the destination address of the request into a private address (inside-address). The request is then forwarded to the server on the private network.

You can configure ACL rules to allow specified users to access an internal server.

• This command can be run only on NAT-capable Layer 3 interfaces.

• When configuring an internal NAT server, ensure that global-address and host-address are different from IP addresses of ports and IP addresses in the user address pool.
• You can use the IP address of current-interface or loopback as the internal server's IP address.
• The undo nat server command does not delete mapping entries immediately. You can run the reset nat session command to delete mapping entries.
• Compared with static NAT, NAT Server translates only the IP address, but not the port number, when the private network initiatively accesses the public network.
• When you configure one-to-one NAT Server that borrows an interface IP address (no interface number is specified and the IP address is mapped to a private network address), other services enabled on the interface may become unavailable. Confirm your action before performing the configuration. If you want to enable other applications on the interface, add an ACL rule after the configuration to filter out the number of the interface on which the applications are enabled.

Precautions

The specified global-port or host-port cannot be used by other applications. Otherwise, the configuration does not take effect.

When specifying global-port2 to configure multiple public ports, you must also specify host-address2 to configure multiple private addresses and ensure that the number of ports is the same as that of private addresses.

If you need to map the private address of an internal server into the IP address of the public network interface when configuring this command on the public network interface, you must set the current-interface parameter to specify a global address as the current interface address.

If you specify vrrp vrrpid when configuring the nat server command on an interface, the interface must support the VRRP function.

The vpn-instance-name parameter in the command specifies a private network-side VPN instance and does not take effect on the global-address parameter. The ip binding vpn-instance vpn-instance-name command can be run in the interface view to bind a public network-side VPN instance to the interface.

Application Usage Scenario

Since terminals are vulnerable to network attacks on a complex network, the terminals under network attacks will occupy a large number of NAT mapping entries on the devices they connected to. Once the NAT mapping entries on the devices are exhausted, other terminals cannot access the Internet because no NAT mapping entry can be allocated to them. In this case, you can run the nat session limit command to set the maximum number of NAT mapping entries that can be used by users. When the number of NAT mapping entries created for a user exceeds the configured limit, the device does not generate new NAT mapping entries. As a result, denying the user's Internet access is restricted.

Precautions

• This command cannot be used together with other functions for creating flow tables, such as the firewall, IPS, and SAC. Otherwise, this command may not take effect.
• If an ACL is configured, ACL rule updates do not affect the maximum number of NAT mapping entries that can be used by a user.
• If an ACL is configured and the ACL rule defines deny, the number of NAT mapping entries that can be used by a user is not limited.
• The NAT session table created on the device before this command is run is not included in the statistics of NAT mapping entries.
• After an active/standby device switchover is performed, the devices clear the statistics of NAT mapping entries that have been collected before the switchover and re-collects the statistics.

Usage Scenario

If devices on a private network allow access from devices on a public network through a fixed IP address, for example, a private server provides services to public network devices, the public network devices can access the server through a fixed public IP address. You can configure static NAT to translate the private IP address of the private server into the specified public IP address.

If a private server provides services to multiple public network segments, the private IP address of the server needs to be translated into multiple public IP addresses to ensure security. Generally, bidirectional translation between private and public IP addresses is implemented in static NAT. When a private server accesses a public network, the private IP address of the server cannot be translated into multiple public IP addresses. You can configure unidirectional static NAT to solve this problem. When a public network device accesses the private server, multiple public IP addresses are translated into the private IP address of the server using static NAT. When the private server accesses the public network, IP addresses are translated using outbound NAT.

Static NAT also supports IP address translation between network segments, that is, private IP addresses within a specified range and public IP addresses within a specified range can be translated into each other.

Precautions

After the undo nat static command is run on the device, static mapping entries on the device will not be cleared immediately. To clear static mapping entries immediately, run the reset nat session command.

When the global-port, global-port2, host-port, and host-port2 parameters are specified to configure mappings between public and private port numbers, the number of public port numbers must be the same as the number of private port numbers, and the port numbers must be mapped in sequence, meaning there are multiple static NAT mappings. For example, when nat static protocol tcp global 1.1.1.0 11 20 inside 10.10.10.0 21 30 netmask 24 is configured, the public IP address 1.1.1.0-1.1.1.255 maps the private IP address 10.10.10.0-10.10.10.255, and public port numbers 11 to 20 map private port numbers 21 to 30 in sequence.

When host-address2 is specified, global-port2 and host-port must also be specified. The number of private addresses must be the same as the number of public port numbers. That is, the same public address maps different private addresses, and different public port numbers map the same private port number. For example, when nat static protocol tcp global 1.1.1.1 11 12 inside 10.10.10.1 10.10.10.2 30 is configured, 1.1.1.1 and public port 11 map 10.10.10.1 and private port 30, and 1.1.1.1 and public port 12 map 10.10.10.2 and private port 30.

If you specify vrrp vrrpid when configuring the nat static command on an interface, the interface must support the VRRP function.

The vpn-instance-name parameter in the command specifies a private network-side VPN instance and does not take effect on the global-address parameter. The ip binding vpn-instance vpn-instance-name command can be run in the interface view to bind a public network-side VPN instance to the interface.

If you specify acl-number when configuring multiple nat static commands on an interface, the ACL number specified in the commands must be the same. Otherwise, the configuration fails.

Static NAT indicates that a private address is statically bound to a public address when NAT is performed. The public IP address in static NAT is only used for translation of the unique and fixed private IP address of a host.

Static PAT indicates that a combination of the private address of a host, TCP/UDP protocol number, and internal port number is statically bound to a combination of the public address, TCP/UDP protocol number, and external port number. The public IP address in static PAT can be used for translation of multiple private addresses.

Using static NAT or PAT, hosts on the private network and hosts on the public network can access each other.

• If you run the undo nat static command, static mapping entries are not immediately deleted. To clear static mapping entries, run the reset nat session command.

• When the global-port, global-port2, host-port, and host-port2 parameters are specified to configure mappings between public and private port numbers, the number of public port numbers must be the same as the number of private port numbers and the port numbers must be mapped in sequence. For example, when nat static protocol tcp global 1.1.1.1 11 20 inside 10.10.10.1 21 30 is configured, the public IP address 1.1.1.1 maps the private IP address 10.10.10.1, and public port numbers 11 to 20 map private port numbers 21 to 30 in sequence.

  When host-address2 is specified, global-port2 and host-port must also be specified. The number of private addresses must be the same as the number of public port numbers. That is, the same public address maps different private addresses, and different public port numbers map the same private port number. For example, when nat static protocol tcp global 1.1.1.1 11 12 inside 10.10.10.1 10.10.10.2 30 is configured, 1.1.1.1 and public port 11 map 10.10.10.1 and private port 30, and 1.1.1.1 and public port 12 map 10.10.10.2 and private port 30.

• nat static protocol { tcp | udp } global interface loopback interface-number global-port [ global-port2 ] inside host-address [ host-address2 ] [ host-port ] [ vpn-instance vpn-instance-name ] [ netmask mask ] [ description description ]

  In the command, the first vpn-instance-name parameter specifies the VPN instance bound to the loopback interface, and the second vpn-instance-name parameter specifies a private network-side VPN instance.

• If the ip binding vpn-instance vpn-instance-name command is run in the interface view to bind a public network-side VPN instance to the interface, the nat static command in the system view does not take effect. In this case, you need to run the nat static or nat server command in the interface view.

Using the nat static enable command, you can enable static NAT on an interface.

• This command can only be used on Layer 3 interfaces, except loopback and NULL interfaces.
• When enabling static NAT on a sub-interface, you must also enable the function on the main interface. Otherwise, the function does not take effect on the sub-interface.

The NAT function resolves the problem of IPv4 address shortage and improves network security. NAT implementation of different vendors may be different, so the applications using the STUN, TURN, and ICE technologies may fail to traverse the NAT devices of these vendors. These technologies are mainly used on the SIP proxy. NAT mapping enables these applications to traverse the NAT devices.

NAT mapping has the following modes:

• Endpoint-independent mapping: The NAT reuses the port mapping for subsequent packets sent from the same internal IP address and port to any external IP address and port.
• Address and port-dependent mapping: The NAT reuses the port mapping for subsequent packets sent from the same internal IP address and port to the same external IP address and port while the mapping is still active.

Usage Scenario

When the NAT service is configured on an interface of a device, the device generates flow entries for all packets arriving at the interface by default. If a large number of packets do not require the NAT service, numerous flow entry resources will be wasted, and even the number of generated flow entries exceeds the device specification. As a result, flow entries cannot be generated for the packets that require the NAT service, thereby causing NAT translation failures. If you only need to perform NAT for packets from a specific network segment, run the nat miss forward session disable command to disable the device from generating flow entries for packets that do not require NAT. This saves flow entry resources and improves service flow entry utilization.

Precautions

• This command takes effect only for new service traffic.
• After this command is run, NAT forwarding performance deteriorates (AR611, AR611-S, AR611W-S, AR611E-S, AR611-LTE4EA, AR611W-LTE6EA, AR611W, AR611W-LTE4CN, AR617VW, AR617VW-LTE4, AR617VW-LTE4EA: The maximum device performance deteriorates by about 15%. Other models: The maximum device performance deteriorates by less than 5%. The device performance is not affected if the current CPU usage of the data plane is less than 70%.) Therefore, exercise caution when running this command based on actual service scenarios.

Usage Scenario

If the configurations of nat alg, nat server, nat static, and nat outbound are changed, the packets are not forwarded based on new configurations. You can run the reset nat session command to make the new configurations take effect. This command deletes all NAT mapping entries, NAT mapping entries with a specified protocol type, source IP address, or destination IP address, or NAT mapping entries of traffic passing through a specified interface. When you run this command, the system prompts you to confirm the command execution.

Precautions

• After this command is executed, entries are deleted from the NAT mapping table and new NAT configurations take effect immediately.
• After this command is executed, wait at least 10 seconds if you need to run the command again; otherwise, an error message is displayed.
• If all entries are deleted, communication through certain sessions may be affected for a short period of time.

STUN packet statistics cannot be restored after being cleared. Therefore, exercise caution before clearing the statistics.

When locating STUN problems, you can collect STUN packet statistics only within a specified period for fault location. In this case, you need to run the reset stun statistics packet command to clear historical STUN packet statistics and run the display stun statistics packet command to view current STUN packet statistics.

Application Scenario

In the SD-WAN Solution, a branch CPE can access the campus network through the Internet, and NAT devices are often deployed on the Internet. After a packet sent from the branch CPE passes through a NAT device, the IP address changes. To obtain the real IP address of the packet passing through the NAT device, you can run the stun client enable command to enable the STUN client function. The STUN client communicates with the STUN server through STUN packets to detect whether there is a NAT device between CPEs. In addition, the STUN client sends IP addresses and port numbers before and after NAT traversal of the branch CPE to other CPEs through BGP. Subsequently, the CPE uses the IP address and port number before and after NAT traversal to send a STUN binding request packet to the peer respectively, and determines the real reachable IP address between the CPEs according to the response packet.

Prerequisites

Precautions

Currently, this command is supported on Ethernet interfaces, serial interfaces, dialer interfaces, VE interfaces, VT interfaces, ATM interfaces, IMA-Group interfaces, Eth-Trunk interfaces, and cellular interfaces only when they work in Layer 3 mode.

Follow-up Procedure

In the interface view, you can run the stun client destination-port port-number command to configure the destination port number for the STUN client to access the STUN server.

Application Scenario

In the SD-WAN Solution, to detect whether there is a NAT device between CPEs and obtain the real IP address of a packet passing through the NAT device, you need to enable the STUN client function and configure the destination port number for the STUN client to access the STUN server. By default, the destination port number for the STUN client to access the STUN server is 3478. If the port number is used by other services, you can run the stun client destination-port command to change the destination port number for the STUN client to access the STUN server.

Prerequisites

Precautions

Currently, this command is supported on Ethernet interfaces, serial interfaces, dialer interfaces, VE interfaces, VT interfaces, ATM interfaces, IMA-Group interfaces, Eth-Trunk interfaces, and cellular interfaces only when they work in Layer 3 mode.

To configure the device as a STUN server, run the stun server enable command to enable the STUN server function. After this function is enabled, the device will respond to binding requests sent from STUN clients, helping them determine the presence of a NAT device.

Usage Scenario

After you run the stun server enable command, the STUN server checks all IP addresses for STUN messages by default. To configure the STUN server to check a specific IP address, run the stun server listening-ip command to specify the IP address as needed.

Precautions

The IP address checked by a STUN server must be a local IP address.

Usage Scenario

After the stun server enable command is executed, the STUN server listens on the UDP port 3478 by default. If this UDP port number has been used by other services and causes STUN service to become unavailable, run the stun server listening-port command to change the UDP port number on which the STUN server listens.

Precautions

The configured UDP port number cannot be used by other services. Otherwise, the STUN server may fail to process STUN messages.