Network Router User Manual

Chapter 16: Network Address Translation Configuration Guide
220 SmartSwitch Router User Reference Manual
The SSR allows you to create the following NAT address bindings:
• Static, one-to-one binding of inside, local address or address pool to outside, global
address or address pool. A static address binding does not expire until the command
that defines the binding is negated. IP addresses defined for static bindings cannot be
reassigned. For static address bindings, PAT allows TCP or UDP port numbers to be
translated along with the IP addresses.
• Dynamic binding between an address from a pool of local addresses to an address from
a pool of outside addresses. With dynamic address binding, you define local and global
address pools from which the addresses bindings can be made. IP addresses defined
for dynamic binding are reassigned whenever they become free. For dynamic address
bindings, PAT allows port address translation if no addresses are available from the
global address pool. PAT allows port address translation for each address in the global
pool. The ports are dynamically assigned between the range of 1024 to 4999. Hence,
you have about 4,000 ports per global IP address.
Dynamic bindings are removed automatically when the flow count goes to zero. At
this point, the corresponding port (if PAT enabled) or the global IP address is freed and
can be reused the next time. Although there are special cases like FTP where the flows
are not installed for the control path, the binding will be removed only by the dynamic
binding timeout interval.
Configuring NAT
The following are the steps in configuring NAT on the SSR:
1. Setting the NAT interfaces to be “inside” or “outside.”
2. Setting the NAT rules (static or dynamic).
Setting Inside and Outside Interfaces
When NAT is enabled, address translation is only applied to those interfaces which are
defined to NAT as “inside” or “outside” interfaces. NAT only translates packets that
arrive on a defined inside or outside interface.
To specify an interface as inside (local) or outside (global), enter the following command
in Configure mode.
Define an interface as inside or
outside for NAT.
nat set interface <InterfaceName>
inside|outside