Feedback
Table Of Contents
Configuring Network Address Translation
Network Address Translation Overview
Maximum Number of NAT Commands
Configuring an Idle Timeout for NAT
Configuring Dynamic NAT and PAT
Dynamic NAT and PAT Configuration Quick Start
Configuring Interfaces for Dynamic NAT and PAT
Creating a Global IP Address Pool for NAT
Configuring a Class Map for Passive FTP
Configuring Dynamic NAT and PAT as a Layer 3 and Layer 4 Policy-Map Action
Applying the Dynamic NAT and PAT Policy Map to an Interface Using a Service Policy
Configuring Server Farm-Based Dynamic NAT
Server Farm-Based Dynamic NAT Configuration Quick Start
Configuring an ACL for Server Farm-Based Dynamic NAT
Configuring Interfaces for Server Farm-Based Dynamic NAT
Creating a Global IP Address Pool for Dynamic NAT
Configuring Real Servers and a Server Farm
Configuring a Layer 7 Load-Balancing Class Map for Server Farm-Based Dynamic NAT
Configuring a Layer 7 Load-Balancing Policy Map for Server Farm-Based Dynamic NAT
Configuring Server Farm-Based Dynamic NAT as a Layer 7 Policy Action
Configuring a Layer 3 and Layer 4 Class Map for Server Farm-Based Dynamic NAT
Configuring a Layer 3 and Layer 4 Policy Map for Server Farm-Based Dynamic NAT
Applying the Layer 3 and Layer 4 Policy Map to an Interface Using a Service Policy
Configuring Static NAT and Static Port Redirection
Static NAT Configuration Quick Start
Configuring an ACL for Static NAT and Static Port Redirection
Configuring Interfaces for Static NAT and Static Port Redirection
Configuring Static NAT and Static Port Redirection as a Policy Action
Displaying NAT Configurations and Statistics
Displaying NAT and PAT Configurations
Displaying IP Address and Port Translations
Static Port Redirection (Static PAT) Example
Dynamic NAT and PAT (SNAT) Configuration Example
Server Farm-Based Dynamic NAT (SNAT) Configuration Example
Static Port Redirection (DNAT) Configuration Example
SNAT with Cookie Load Balancing Example
Configuring Network Address Translation
This chapter contains the following major sections which describe how to configure NAT on the Cisco 4700 Series Application Control Engine (ACE) appliance:
•
Network Address Translation Overview
•
•
•
•
•
Network Address Translation Overview
When a client attempts to access a server in a data center, the client incorporates its IP address in the IP header when it connects to the server. An ACE placed between the client and the server can either preserve the client IP address or translate that IP address to a routable address in the server network, based on a pool of reserved dynamic NAT addresses or a static NAT address mapping, and pass the request on to the server.
This IP address translation process is called Network Address Translation (NAT) or source NAT (SNAT). The ACE tracks all SNAT mappings to ensure that response packets from the server are routed back to the client. If your application requires that the client IP address be preserved for statistical or accounting purposes, do not implement SNAT.
Destination NAT (DNAT) translates the IP address and port of an inside host so that it appears with a publicly addressable destination IP address to the rest of the world. Typically, you configure DNAT using static NAT and port redirection. You can use port redirection to configure servers that host a service on a custom port (for example, servers hosting HTTP on port 8080).
To provide security for a server, you can map the server private IP address to a global routable IP address that a client can use to connect to the server. In this case, the ACE translates the global IP address to the server private IP address when sending data from the client to the server. Conversely, when a server responds to a client, the ACE translates the local server IP address to a global IP address for security reasons. This process is called DNAT.
You can also configure the ACE to translate TCP and UDP port numbers greater than 1024, and ICMP identifiers. This process is known as Port Address Translation (PAT). The ACE provides 64 K minus 1 K ports for each IP address for PAT. Ports 0 through 1024 are reserved and cannot be used for PAT.
By default, the ACE performs implicit PAT on flows except when:
•
•
•
•
Some of the benefits of NAT are as follows:
•
•
•
The ACE provides the following types of NAT and PAT:
•
•
•
•
•
This section contains the following topics:
•
•
Dynamic NAT
Dynamic NAT, which is typically used for SNAT, translates a group of local source addresses to a pool of global source addresses that are routable on the destination network. The global pool can include fewer addresses than the local group. When a local host accesses the destination network, the ACE assigns an IP address from the global pool to the host.
Because the translation times out after being idle for a user-configurable period of time, a given user does not keep the same IP address. For this reason, users on the destination network cannot reliably initiate a connection to a host that uses dynamic NAT (even if the connection is allowed by an access control list [ACL]). Not only can you not predict the global IP address of the host, but the ACE does not create a translation unless the local host is the initiator. See the "Configuring Static NAT and Static Port Redirection" section for details about reliable access to hosts.
Note
Dynamic NAT has these disadvantages:
•
Use dynamic PAT if this event occurs often, because dynamic PAT provides over 64,000 translations using multiple ports of a single IP address.
•
Note
The advantage of dynamic NAT is that some protocols cannot use dynamic PAT. Dynamic PAT does not work with some applications that have a data stream on one port and the control path on another, such as some multimedia applications.
Dynamic PAT
Dynamic PAT, which is also used for Stateful Network Address Translation (SNAT), translates multiple local source addresses and ports to a single global IP address and port that are routable on the destination network from a pool of IP addresses and ports reserved for this purpose. The ACE translates the local address and local port for multiple connections and/or hosts to a single global address and a unique port starting with port numbers greater than 1024.
When a local host connects to the destination network on a given source port, the ACE assigns a global IP address to it and a unique port number. Each host receives the same IP address but, because the source port number is unique, the ACE sends the return traffic, which includes the IP address and port number as the destination, to the correct host.
The ACE supports over 64,000 ports for each unique local IP address. Because the translation is specific to the local address and local port, each connection, which generates a new source port, requires a separate translation. For example, 10.1.1.1:1025 requires a separate translation from 10.1.1.1:1026.
The translation is valid only for the duration of the connection, so a user does not keep the same global IP address and port number. For this reason, users on the destination network cannot reliably initiate a connection to a host that uses dynamic PAT (even if the connection is allowed by an ACL). Not only can you not predict the local or global port number of the host, but the ACE does not create a translation unless the local host is the initiator. See the "Configuring Static NAT and Static Port Redirection" section for details about reliable access to hosts.
Dynamic PAT allows you to use a single global address, which helps to conserve routable addresses. Dynamic PAT does not work with some multimedia applications that have a data stream on a port that is different from the control path port.
Server Farm-Based Dynamic NAT
In addition to the interface-level dynamic NAT, the ACE supports dynamic NAT at the server farm level. Server farm-based dynamic NAT, which is also used for SNAT, is useful in situations where you want to perform NAT on only the IP addresses of the real servers in the primary and/or the backup server farm. Like interface-based dynamic NAT, server farm-based dynamic NAT uses a pool of IP addresses to translate a source address. Unlike interface-based NAT, server farm-based NAT translates the primary server farm IP addresses, the backup server farm IP addresses, or both.
Use this feature in the following cases:
•
•
•
For details about configuring server farm-based dynamic NAT, see the "Configuring Server Farm-Based Dynamic NAT" section.
Static NAT
Static NAT, which is typically used for Destination NAT (DNAT), translates each local address to a fixed global address. With dynamic NAT and PAT, each host uses a different address or port after the translation times out. Because the global address is the same for each consecutive connection with static NAT, and a persistent translation rule exists, static NAT allows hosts on the global network to initiate traffic to a local host (if there is an ACL that allows it).
The main differences between dynamic NAT and static NAT are as follows:
•
•
Static Port Redirection
Static port redirection, also used for DNAT, performs the same function as static NAT and additionally translates TCP or UDP ports or ICMP identifiers for the local and global addresses. With static port redirection, you can use the same global address in multiple static NAT statements, provided that, along with the address, you use different port numbers.
For example, if you want to provide a single address for global users to access FTP, HTTP, and SMTP, but there are different servers for each protocol on the local network, you can specify static port redirection statements for each server that use the same global IP address with different ports.
Maximum Number of NAT Commands
The ACE supports the following maximum numbers of nat, nat-pool, and nat static commands divided among all contexts:
•
•
•
Global Address Guidelines
When you translate the local address to a global address, you can use the following global addresses:
•
Note
•
You cannot configure global IP address ranges across subnets. For example, the following command is not allowed and will generate an Invalid IP address error: nat-pool 2 10.0.6.1 10.0.7.20 netmask 255.255.255.0.
You must configure a netmask when configuring a NAT pool. A netmask of 255.255.255.255 instructs the ACE to use all the IP addresses in the range.
Configuring an Idle Timeout for NAT
You can configure an idle timeout for NAT by using the timeout xlate command in configuration mode. The syntax of this command is as follows:
timeout xlate seconds
The seconds argument is an integer from 60 to 2147483. The default is 10800 seconds (3 hours). The seconds value determines how long the ACE waits to free the Xlate slot after it becomes idle.
For example, to specify an idle timeout of 120 seconds (2 minutes), enter:
host1/Admin(config)# timeout xlate 120To reset the NAT idle timeout to the default value of 10800 seconds, enter:
host1/Admin(config)# no timeout xlate 120Configuring Dynamic NAT and PAT
This section describes how to configure dynamic NAT and PAT on an ACE for SNAT. For overview information about dynamic NAT and dynamic PAT, see the "Network Address Translation Overview" section. This section contains the following topics:
•
•
•
•
•
Dynamic NAT and PAT Configuration Quick Start
Table 5-1 provides a quick overview of the steps required to configure dynamic NAT and PAT. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI commands, see the sections following Table 5-1.
Configuring an ACL
You can use a security access control list (ACL) to permit the traffic that requires NAT. For details about configuring an ACL, see Chapter 1, Configuring Security Access Control Lists.
To configure an ACL for dynamic NAT, use the access-list command in configuration mode. The syntax of this command is as follows:
access-list name [line number] extended {deny | permit}
{protocol} {src_ip_address netmask | any | host src_ip_address} [operator port1 [port2]] {dest_ip_address netmask | any | host dest_ip_address} [operator port3 [port4]]For example, enter:
host1/C1(config)# access-list NAT_ACCESS extended permit tcp 192.168.12.0 255.255.255.0 172.27.16.0 255.255.255.0 eq 80To delete the ACL from the configuration, enter:
host1/C1(config)# no access-list NAT_ACCESSConfiguring Interfaces for Dynamic NAT and PAT
Configure an interface for clients and an interface for the real servers. If you are operating the ACE in one-arm mode, do not configure an interface for clients. For details, see the Cisco 4700 Series Application Control Engine Appliance Routing and Bridging Configuration Guide.
Creating a Global IP Address Pool for NAT
Dynamic NAT uses a pool of global IP addresses that you specify. You can define either a single global IP address for a group of servers with PAT to differentiate between them, or a range of global IP addresses when using dynamic NAT only. To use a single IP address or a range of addresses, you assign an identifier to the address pool. You configure the NAT pool on the server VLAN interface.
Note
To create a pool of IP addresses for dynamic NAT, use the nat-pool command in interface configuration mode. The syntax of this command is as follows:
nat-pool pool_id ip_address1 [ip_address2] netmask mask [pat]
The keywords, arguments, and options are as follows:
•
Note
•
•
If you specify PAT, you can configure a maximum of 32 IP addresses in a NAT pool range. You cannot configure an IP address range across subnets. For example, the following command is not allowed and will generate an Invalid IP address error: nat-pool 2 10.0.6.1 10.0.7.20 netmask 255.255.255.0.
Note
•
•
If the ACE runs out of IP addresses in a NAT pool, it can switch over to a PAT rule, if configured. For example, you can configure the following:
host1/Admin(config-if)# nat-pool 1 10.1.100.10 10.1.100.99 netmask 255.255.255.255host1/Admin(config-if)# nat-pool 1 10.1.100.100 10.1.100.100 netmask 255.255.255.255 patIf your network configuration has the following conditions, you should configure multiple PAT pools with a single IP address in each pool:
•
•
•
•
So instead of configuring:
host1/Admin(config-if)# nat-pool 1 3.3.3.3 3.3.3.5 netmask 255.255.255.255 patconfigure:
host1/Admin(config-if)# nat-pool 1 192.161.12.3 netmask 255.255.255.255 pathost1/Admin(config-if)# nat-pool 1 192.161.12.4 netmask 255.255.255.255 pathost1/Admin(config-if)# nat-pool 1 192.161.12.5 netmask 255.255.255.255 patTo configure a NAT pool consisting of a range of 32 (the maximum number of IP addresses per PAT pool) global IP addresses with PAT, enter:
host1/C1(config)# interface vlan 200host1/C1(config-if)# nat-pool 1 172.27.16.10 172.27.16.41 netmask 255.255.255.255 pat
Note
To remove a NAT pool from the configuration, enter:
host1/C1(config-if)# no nat-pool 1Configuring a Class Map
You can configure a traffic class for dynamic NAT and PAT by using the class-map command in configuration mode. For more information about class maps, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
The syntax of this command is as follows:
class-map match-any name
The name argument is a unique identifier for the class map, specified as an unquoted text string with a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# class-map match-any NAT_CLASShost1/C1(config-cmap)#To remove a class-map from the configuration, enter:
host1/C1(config)# no class-map match-any NAT_CLASSEnter match criteria for the ACL or the client source address using the match command in class-map configuration mode. For example, enter:
host1/C1(config-cmap)# match access-list NAT_ACCESSor
host1/C1(config-cmap)# match source-address 192.168.12.15 255.255.255.0To remove a match statement from a class map, enter:
host1/C1(config-cmap)# no match access-list NAT_ACCESSConfiguring a Class Map for Passive FTP
If you are using passive FTP with source NAT, you must configure an additional class map to source NAT the passive data connection. You then associate this class map with the Layer 4 multimatch policy and configure the nat dynamic command as an action in the policy map under this class map. To configure a class map for passive FTP, enter the following commands:
host1/C1(config)# class-map match-any FTP_NAT_CLASShost1/C1(config-cmap)# match virtual address 172.16.35.37 anyConfiguring a Policy Map
You can configure a traffic policy for dynamic NAT and PAT by using the policy-map command in configuration mode. For more information about policy maps, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
The syntax of this command is as follows:
policy-map multi-match name
The name argument is the name assigned to the policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# policy-map multi-match NAT_POLICYhost1/C1(config-pmap)#To remove a policy map from the configuration, enter:
host1/C1(config)# no policy-map multi-match NAT_POLICYAssociate the previously created class map with the policy map. For example, enter:
host1/C1(config-pmap)# class NAT_CLASShost1/C1(config-pmap-c)#To dissociate a class map from a policy map, enter:
host1/C1(config-pmap)# no class NAT_CLASSConfigure policy-map actions as required. For example, configure:
host1/C1(config-pmap-c)# loadbalance policy L7_POLICYhost1/C1(config-pmap-c)# loadbalance VIP inserviceFor passive FTP, associate the FTP_NAT_CLASS class map (see the Configuring a Class Map for Passive FTP section) with the Layer 4 policy map. For example, enter the following commands in policy map configuration mode:
host1/C1(config)# policy-map multi-match NAT_POLICYhost1/C1(config-pmap)# class FTP_NAT_CLASSProceed with the following section and configure the nat dynamic command as a policy action under the FTP class map if you are using passive FTP. Otherwise, configure the nat dynamic command as a policy action under the NAT_CLASS class map.
Configuring Dynamic NAT and PAT as a Layer 3 and Layer 4 Policy-Map Action
You can configure dynamic NAT and PAT (SNAT) as an action in a Layer 3 and Layer 4 policy map by using the nat dynamic command in policy-map class configuration mode. The ACE applies dynamic NAT from the interface to which the traffic policy is attached (through the service-policy interface configuration command) to the interface specified in the nat command. If you are operating in one-arm mode, there is only one VLAN interface.
The syntax of this command is as follows:
nat dynamic pool_id vlan number
The keywords, arguments, and options are as follows:
•
•
Note
The following example specifies the nat command as an action for a dynamic NAT Layer 3 and Layer 4 policy map:
host1/C1(config)# policy-map multi-action NAT_POLICYhost1/C1(config-pmap)# class NAT_CLASShost1/C1(config-pmap-c)# nat dynamic 1 vlan 200To remove a dynamic NAT action from a policy map, enter:
host1/C1(config-pmap-c)# no nat dynamic 1 vlan 200Applying the Dynamic NAT and PAT Policy Map to an Interface Using a Service Policy
Activate the dynamic NAT and PAT policy map and associate it with an interface by using the service-policy command in interface configuration mode. For details about the service-policy command, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
Note
The syntax of this command is as follows:
service-policy input policy_name
The keywords and arguments are as follows:
•
•
For example, to apply a service policy to a specific interface, enter:
host1/C1(config)# interface vlan 100host1/C1(config-if)# mtu 1700host1/C1(config-if)# ip address 192.168.1.100 255.255.255.0host1/C1(config-if)# service-policy input NAT_POLICYTo apply a service policy globally to all interfaces in a context, enter:
host1/C1(config)# service-policy input NAT_POLICYTo remove a service policy from an interface, enter:
host1/C1(config-if)# no service-policy input NAT_POLICYTo remove a service policy globally from all interfaces in a context, enter:
host1/C1(config)# no service-policy input NAT_POLICY
Note
Configuring Server Farm-Based Dynamic NAT
This section describes how to configure server farm-based dynamic NAT on an ACE for SNAT. For overview information about server farm-based dynamic NAT, see the "Network Address Translation Overview" section. This section contains the following topics:
•
•
•
•
•
•
•
•
•
•
•
Server Farm-Based Dynamic NAT Configuration Quick Start
Table 5-2 provides a quick overview of the steps required to configure server farm-based dynamic NAT. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI commands, see the sections following Table 5-2.
Configuring an ACL for Server Farm-Based Dynamic NAT
Use an access control list (ACL) to permit the traffic that requires NAT. For details about configuring an ACL, see Chapter 1, Configuring Security Access Control Lists.
To configure an ACL for dynamic NAT, use the access-list command in configuration mode. The syntax of this command is as follows:
access-list name [line number] extended {deny | permit}
{protocol} {src_ip_address netmask | any | host src_ip_address} [operator port1 [port2]] {dest_ip_address netmask | any | host dest_ip_address} [operator port3 [port4]]For example, enter:
host1/C1(config)# access-list NAT_ACCESS extended permit tcp 192.168.12.0 255.255.255.0 172.27.16.0 255.255.255.0 eq 80To delete the ACL from the configuration, enter:
host1/C1(config)# no access-list nat_accessConfiguring Interfaces for Server Farm-Based Dynamic NAT
Configure an interface for clients and an interface for the real servers. If you are operating the ACE in one-arm mode, omit the client interface. For details about configuring interfaces, see the Cisco 4700 Series Application Control Engine Appliance Routing and Bridging Configuration Guide.
Creating a Global IP Address Pool for Dynamic NAT
Dynamic NAT uses a pool of global IP addresses that you specify. You can define a range of global IP addresses when using dynamic NAT. To use a range of addresses, you assign an identifier to the address pool. You then associate the NAT pool with the server VLAN interface.
Note
To create a pool of IP addresses for dynamic NAT, use the nat-pool command in interface configuration mode. The syntax of this command is as follows:
nat-pool pool_id ip_address1 ip_address2 netmask mask
The keywords, arguments, and options are as follows:
•
Note
•
•
You cannot configure an IP address range across subnets. For example, the following command is not allowed and will generate an Invalid IP address error: nat-pool 2 10.0.6.1 10.0.7.20 netmask 255.255.255.0.
Note
•
To configure a NAT pool consisting of a range of 32 global IP addresses, enter:
host1/C1(config)# interface vlan 200host1/C1(config-if)# nat-pool 1 172.27.16.10 172.27.16.41 netmask 255.255.255.255
Note
To remove a NAT pool from the configuration, enter:
host1/C1(config-if)# no nat-pool 1Configuring Real Servers and a Server Farm
For details about configuring real servers and server farms, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide.
Configuring a Layer 7 Load-Balancing Class Map for Server Farm-Based Dynamic NAT
Configure a Layer 7 traffic class for server farm-based dynamic NAT by using the class-map command in configuration mode. The syntax of this command is as follows:
class-map type http loadbalance match-any name
The name argument is a unique identifier for the class map, specified as an unquoted text string with a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# class-map type http loadbalance match-any L7_CLASShost1/C1(config-cmap-http-lb)#To remove a class-map from the configuration, enter:
host1/C1(config)# no class-map type http loadbalance match-any L7_CLASSEnter match criteria as required using the match command in class-map load balancing configuration mode. For example, enter:
host1/C1(config-cmap-http-lb)# match http content .*cisco.comTo remove a match statement from a class map, enter:
host1/C1(config-cmap-http-lb)# no match http content .*cisco.comConfiguring a Layer 7 Load-Balancing Policy Map for Server Farm-Based Dynamic NAT
Configure a Layer 7 load-balancing policy map by using the policy-map command in configuration mode. The syntax of this command is:
policy-map type loadbalance http first-match name
The name argument is a unique identifier for the policy map, specified as an unquoted text string with a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# policy-map type loadbalance http first-match L7_POLICYhost1/C1(config-pmap-lb)#To remove a policy map from the configuration, enter:
host1/C1(config)# no policy-map multi-match NAT_POLICYTo associate the previously created class map with the policy map. For example, enter:
host1/C1(config-pmap-lb)# class L7_CLASShost1/C1(config-pmap-lb-c)#To disassociate a class map from a policy map, enter:
host1/C1(config-pmap-lb)# no class L7_CLASSConfiguring Server Farm-Based Dynamic NAT as a Layer 7 Policy Action
Configure server farm-based dynamic NAT as an action in a Layer 7 load-balancing policy map by using the nat command in policy-map load-balancing class configuration mode. Typically, you use dynamic NAT for SNAT. Dynamic NAT allows you to identify local traffic for address translation by specifying the source and destination addresses in an extended ACL, which is referenced as part of the class map traffic classification. The ACE applies dynamic NAT from the interface to which the traffic policy is attached (through the service-policy interface configuration command) to the interface specified in the nat dynamic command.
The syntax of this command is as follows:
nat dynamic pool_id vlan number serverfarm {primary | backup}
The keywords and arguments are as follows:
•
Note
•
•
•
Note
The following SNAT server farm-based dynamic NAT example specifies the nat command as an action for a Layer 7 policy map:
host1/C1(config)# policy-map type loadbalance http first-match L7_POLICYhost1/C1(config-pmap-lb)# class L7_CLASShost1/C1(config-pmap-lb-c)# nat dynamic serverfarm primary 1 vlan 200To remove a server farm-based dynamic NAT action from a policy map, enter:
host1/C1(config-pmap-lb-c) no nat dynamic serverfarm primary 1 vlan 200Configuring a Layer 3 and Layer 4 Class Map for Server Farm-Based Dynamic NAT
Configure a Layer 3 and Layer 4 traffic class for server farm-based dynamic NAT by using the class-map command in configuration mode. For more information about class maps, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
The syntax of this command is as follows:
class-map match-any name
The name argument is a unique identifier for the class map, specified as an unquoted text string with a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# class-map match-any NAT_CLASShost1/C1(config-cmap)#To remove a class map from the configuration, enter:
host1/C1(config)# no class-map match-any NAT_CLASSEnter match criteria as required using the match command in class-map configuration mode. For example, enter:
host1/C1(config-cmap)# match access-list NAT_ACCESSor
host1/C1(config-cmap)# match source address 192.168.12.15To remove a match statement from a class map, enter:
host1/C1(config-cmap)# no match access-list NAT_ACCESSConfiguring a Layer 3 and Layer 4 Policy Map for Server Farm-Based Dynamic NAT
Configure a Layer 3 and Layer 4 traffic policy for NAT by using the policy-map command in configuration mode. For more information about policy maps, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
The syntax of this command is as follows:
policy-map multi-match name
The name argument is the name assigned to the policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# policy-map multi-match NAT_POLICYhost1/C1(config-pmap)#To remove a policy map from the configuration, enter:
host1/C1(config)# no policy-map multi-match NAT_POLICYTo associate the previously created class map with the policy map. For example, enter:
host1/C1(config-pmap)# class NAT_CLASShost1/C1(config-pmap-c)#To dissociate a class map from a policy map, enter:
host1/C1(config-pmap)# no class NAT_CLASSConfigure policy-map actions as required. For example, configure:
host1/C1(config-pmap-c)# loadbalance policy L7_POLICYhost1/C1(config-pmap-c)# loadbalance VIP inserviceApplying the Layer 3 and Layer 4 Policy Map to an Interface Using a Service Policy
You can activate the server farm-based dynamic NAT policy and assign it to an interface by using the service-policy command in interface configuration mode. For details about the service-policy command, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
Note
The syntax of this command is as follows:
service-policy input policy_name
The keywords and arguments are as follows:
•
•
For example, enter:
host1/C1(config)# interface vlan 100host1/C1(config-if)# mtu 1700host1/C1(config-if)# ip address 192.168.12.100 255.255.255.0host1/C1(config-if)# service-policy input NAT_POLICYTo remove a service policy from an interface, enter:
host1/C1(config-if)# no service-policy input NAT_POLICY
Note
Configuring Static NAT and Static Port Redirection
This section describes how to configure static NAT and static port redirection on an ACE for DNAT. For overview information about static NAT and static port redirection, see the "Network Address Translation Overview" section. This section contains the following topics:
•
•
•
Static NAT Configuration Quick Start
Table 5-3 provides a quick overview of the steps required to configure static NAT and static port redirection. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI commands, see the sections following Table 5-3.
Configuring an ACL for Static NAT and Static Port Redirection
Use an access control list (ACL) to permit the traffic that requires static NAT and port redirection. For details about configuring an ACL, see Chapter 1, Configuring Security Access Control Lists.
To configure an ACL for static NAT, use the access-list command in configuration mode. The syntax of this command is as follows:
access-list name [line number] extended {deny | permit}
{protocol} {src_ip_address netmask | any | host src_ip_address} [operator port1 [port2]] {dest_ip_address netmask | any | host dest_ip_address} [operator port3 [port4]]For example, enter:
host1/C1(config)# access-list acl1 line 10 extended permit tcp 10.0.0.0 255.0.0.0 eq 8080 anyTo delete the ACL from the configuration, enter:
host1/C1(config)# no access-list nat_accessConfiguring Interfaces for Static NAT and Static Port Redirection
Configure an interface for clients and an interface for the real servers. For details, see the Cisco 4700 Series Application Control Engine Appliance Routing and Bridging Configuration Guide.
Configuring a Class Map
You can configure a traffic class for static NAT and port redirection by using the class-map command in configuration mode. For more information about class maps, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
The syntax of this command is as follows:
class-map match-any name
The name argument is a unique identifier for the class map, specified as an unquoted text string with a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# class-map match-any NAT_CLASShost1/C1(config-cmap)#To remove a class-map from the configuration, enter:
host1/C1(config)# no class-map match-any NAT_CLASSEnter match criteria as required using the match command in class-map configuration mode. For example, enter:
host1/C1(config-cmap)# match access-list NAT_ACCESSor
host1/C1(config-cmap)# match source address 192.168.12.15To remove a match statement from a class map, enter:
host1/C1(config-cmap)# no match access-list NAT_ACCESSConfiguring a Policy Map
You can configure a traffic policy for NAT by using the policy-map command in configuration mode. For more information about policy maps, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
The syntax of this command is as follows:
policy-map multi-match name
The name argument is the name assigned to the policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, enter:
host1/C1(config)# policy-map multi-match NAT_POLICYhost1/C1(config-pmap)#To remove a policy map from the configuration, enter:
host1/C1(config)# no policy-map multi-match NAT_POLICYTo associate the previously created class map with the policy map. For example, enter:
host1/C1(config-pmap)# class NAT_CLASShost1/C1(config-pmap-c)#To dissociate a class map from a policy map, enter:
host1/C1(config-pmap)# no class NAT_CLASSConfiguring Static NAT and Static Port Redirection as a Policy Action
You can configure static NAT and static port redirection as an action in a policy map by using the nat static command in policy-map class configuration mode. Typically, you use static NAT and port redirection for DNAT. Static NAT allows you to identify local traffic for address translation by specifying the source and destination addresses in an extended ACL, which is referenced as part of the class map traffic classification. The ACE applies static NAT from the interface to which the traffic policy is attached (through the service-policy interface configuration command) to the interface specified in the nat static command.
The syntax of this command is as follows:
nat static ip_address netmask mask {port1 | tcp eq port2 | udp eq port3} vlan number
The keywords and arguments are as follows:
•
•
•
•
•
•
Note
The following DNAT static port redirection example specifies the nat static command as an action for a static NAT policy map:
host1/C1(config)# policy-map multi-action NAT_POLICYhost1/C1(config-pmap)# class NAT_CLASShost1/C1(config-pmap-c)# nat static 192.168.12.0 255.255.255.0 80 vlan 101To remove a NAT action from a policy map, enter:
host1/C1(config-pmap-c) no nat static 192.168.12.15 255.255.255.0 vlan 200Applying the Static NAT and Static Port Redirection Policy Map to an Interface Using a Service Policy
You can activate the static NAT and port redirection policy and assign it to an interface by using the service-policy command in interface configuration mode. For details about the service-policy command, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
Note
The syntax of this command is as follows:
service-policy input policy_name
The keywords and arguments are as follows:
•
•
For example, enter:
host1/C1(config)# interface vlan 100host1/C1(config-if)# mtu 1700host1/C1(config-if)# ip address 192.168.1.100 255.255.255.0host1/C1(config-if)# service-policy input NAT_POLICYTo remove a service policy from an interface, enter:
host1/C1(config-if)# no service-policy input NAT_POLICY
Note
Displaying NAT Configurations and Statistics
The following sections describe the commands used to display dynamic and static NAT and PAT configurations and statistics:
•
•
Displaying NAT and PAT Configurations
You can display NAT and PAT configurations by using the show running-config class-map and show running-config policy-map commands in Exec mode.
For example, enter:
host1/C1# show running-config class-maphost1/C1# show running-config policy-mapDisplaying IP Address and Port Translations
You can display IP address and port translation (Xlate) information by using the show xlate command in Exec mode. The syntax of this command is as follows:
show xlate [global {ip_address1 [ip_address2 [netmask mask1]]}] [local {ip_address3 [ip_address4 [netmask mask2]]}] [gport port1 [port2]] [lport port1 [port2]]
The keywords, arguments, and options are as follows:
•
•
•
•
•
For example, enter:
host1/Admin# show xlate global 172.27.16.3 172.27.16.10 netmask 255.255.255.0 gport 100 200You can also use the show conn command to display NAT information. See the examples in the following sections.
This section contains the following topics:
•
Dynamic NAT Example
The following example output of the show xlate command shows dynamic NAT (SNAT in this example). When a user uses Telnet from 172.27.16.5 in VLAN 2020, the ACE translates it to 192.168.100.1 in VLAN 2021.
host1/Admin# show xlate global 192.168.100.1 192.168.100.10NAT from vlan2020:172.27.16.5 to vlan2021:192.168.100.1 count:1Dynamic PAT Example
The following example shows dynamic PAT. When a user uses Telnet from 172.27.16.5 in VLAN 2020, the ACE translates it to 192.168.201.1 in VLAN 2021.
host1/Admin# show xlateTCP PAT from vlan2020:172.27.16.5/38097 to vlan2021:192.168.201.1/1025Static NAT Example
The following example shows static NAT. The ACE maps a real IP address (172.27.16.5) to 192.168.210.1.
host1/Admin# show xlateNAT from vlan2020:172.27.16.5 to vlan2021:192.168.210.1 count:1host1/Admin# show conntotal current connections : 2conn-id dir prot vlan source destination state----------+---+----+----+----------------+----------------+----------+7 in TCP 2020 172.27.16.5 192.168.100.1 ESTAB6 out TCP 2021 192.168.100.1 192.168.210.1 ESTABStatic Port Redirection (Static PAT) Example
The following example shows static port redirection (DNAT in this example). A host at 192.168.0.10:37766 uses Telnet to connect to 192.168.211.1:3030 on VLAN 2021 on the ACE. The ACE maps 172.27.0.5:23 on VLAN 2020 to 192.168.211.1:3030 on VLAN 2021.
host1/Admin# show xlateTCP PAT from vlan2020:172.27.0.5/23 to vlan2021:192.168.211.1/3030Mar 24 2006 20:05:41 : %ACE-7-111009: User 'admin' executed cmd: show xlatehost1/Admin# show conntotal current connections : 2conn-id dir prot vlan source destination state----------+---+----+----+------------------+------------------+------+6 in TCP 2021 192.168.0.10:37766 192.168.211.1:3030 ESTAB7 out TCP 2020 172.27.0.5:23 192.168.0.10:1025 ESTABClearing Xlates
You can clear the global address-to-local address mapping information based on the global address, the global port, the local address, the local port, the interface address as the global address, and the NAT type by using the clear xlate command in Exec mode. When you enter this command, the ACE releases sessions that are using the translations (Xlates). The syntax of this command is as follows:
clear xlate [{global | local} start_ip [end_ip [netmask netmask]]] [{gport | lport} start_port [end_port]] [interface vlan number] [state static] [portmap]
The keyword, arguments, and options are as follows:
•
•
•
•
•
•
•
•
•
•
•
•
Note
For example, to clear all static translations, enter:
host1/Admin# clear xlate state staticNAT Configuration Examples
The following sections show typical scenarios that use dynamic and static NAT solutions:
•
•
•
•
Dynamic NAT and PAT (SNAT) Configuration Example
The following SNAT configuration example shows the commands that you use to configure dynamic NAT and PAT on your ACE. In this SNAT example, packets that ingress the ACE from the 192.168.12.0 network are translated to one of the IP addresses in the NAT pool defined on VLAN 200 by the nat-pool command. The pat keyword indicates that ports higher than 1024 are also translated.
If you are operating the ACE in one-arm mode, omit interface VLAN 100 and configure the service policy on interface VLAN 200.
access-list NAT_ACCESS line 10 extended permit tcp 192.168.12.0 255.255.255.0 1 72.27.16.0 255.255.255.0 eq httpclass-map match-any NAT_CLASSmatch access-list NAT_ACCESSpolicy-map multi-match NAT_POLICYclass NAT_CLASSnat dynamic 1 vlan 200interface vlan 100mtu 1500ip address 192.168.1.100 255.255.255.0service-policy input NAT_POLICYno shutdowninterface vlan 200mtu 1500ip address 172.27.16.2 255.255.255.0nat-pool 1 172.27.16.15 172.27.16.24 netmask 255.255.255.0 patno shutdownServer Farm-Based Dynamic NAT (SNAT) Configuration Example
The following SNAT configuration example shows the commands that you use to configure server farm-based dynamic NAT on your ACE. In this SNAT example, real servers addresses on the 172.27.16.0 network are translated to one of the IP addresses in the NAT pool defined on VLAN 200 by the nat-pool command.
If you are operating the ACE in one-arm mode, omit interface VLAN 100 and configure the service policy on interface VLAN 200.
access-list NAT_ACCESS line 10 extended permit tcp 192.168.12.0 255.255.255.0 1 72.27.16.0 255.255.255.0 eq httprserver SERVER1ip address 172.27.16.3inservicerserver SERVER2ip address 172.27.16.4inserviceserverfarm SFARM1rserver SERVER1inservicerserver SERVER2inserviceclass-map type http loadbalance match-any L7_CLASSmatch http content .*cisco.comclass-map match-any NAT_CLASSmatch access-list NAT_ACCESSpolicy-map type loadbalance http first-match L7_POLICYclass L7_CLASSserverfarm SFARM1nat dynamic 1 vlan 200 serverfarm primarypolicy-map multi-match NAT_POLICYclass NAT_CLASSloadbalance policy L7_POLICYloadbalance vip inserviceinterface vlan 100mtu 1500ip address 192.168.1.100 255.255.255.0service-policy input NAT_POLICYno shutdowninterface vlan 200mtu 1500ip address 172.27.16.2 255.255.255.0nat-pool 1 172.27.16.15 172.27.16.24 netmask 255.255.255.0no shutdownStatic Port Redirection (DNAT) Configuration Example
The following DNAT configuration example shows those sections of the running configuration related to the commands necessary to configure static port redirection on your ACE. Typically, this configuration is used for DNAT, where HTTP packets that are destined to 192.0.0.0/8 and ingressing the ACE on VLAN 101 are translated to 10.0.0.0/8 and port 8080. In this example, the servers are hosting HTTP on custom port 8080.
access-list acl1 line 10 extended permit tcp 10.0.0.0 255.0.0.0 eq 8080 anyclass-map match-any NAT_CLASSmatch access-list acl1policy-map multi-match NAT_POLICYclass NAT_CLASSnat static 192.0.0.0 255.0.0.0 80 vlan 101interface vlan 100mtu 1500ip address 192.168.1.100 255.255.255.0service-policy input NAT_POLICYno shutdowninterface vlan 101mtu 1500ip address 172.27.16.100 255.255.255.0no shutdownSNAT with Cookie Load Balancing Example
The following configuration example shows those sections of the running configuration related to the commands necessary to configure SNAT (dynamic NAT) with cookie load balancing. Any source host that sends traffic to the VIP 20.11.0.100 is translated to one of the free addresses in the NAT pool in the range 30.11.100.1 to 30.11.200.1, inclusive. If you want to use PAT instead of NAT, replace "nat dynamic 1 vlan 2021" with "nat dynamic 2 vlan 2021" in the L7SLBCookie policy map.
server host httpip address 30.11.0.10inserviceserverfarm host httpsfrserver httpinserviceclass-map match-any vip42 match virtual-address 20.11.0.100 tcp eq wwwclass-map type http loadbalance match-any L7SLB_Cookie3 match http cookie JG cookie-value ".*"policy-map type loadbalance first-match L7SLB_Cookieclass L7SLB_Cookieserverfarm httpsfpolicy-map multi-match L7SLBCookieclass vip4loadbalance vip inserviceloadbalance L7SLB_Cookienat dynamic 1 vlan 2021 <<<<<<<<<<interface vlan 2020ip address 20.11.0.2 255.255.0.0alias 20.11.0.1 255.255.0.0peer ip address 20.11.0.3 255.255.0.0service-policy input L7SLBCookie <<<<<<<<<<<<<<<<no shutdowninterface vlan 2021ip address 30.11.0.2 255.255.0.0alias 30.11.0.1 255.255.0.0peer ip address 30.11.0.3 255.255.0.0fragment min-mtu 68nat-pool 2 30.11.201.1 30.11.201.1 netmask 255.255.255.255 patnat-pool 3 30.11.202.1 30.11.202.3 netmask 255.255.255.255nat-pool 1 30.11.100.1 30.11.200.1 netmask 255.255.255.255 <<<<<<<<<no shutdown
