This chapter describes how to configure the Network Address Translation (NAT) in-line service feature.
IMPORTANT: In StarOS 8.x, NAT for CDMA and early UMTS releases used rulebase-based configurations, whereas in later UMTS releases NAT used policy-based configurations. In StarOS 9.0, NAT for UMTS and CDMA releases both use policy-based configurations. For more information, please contact your local service representative.|
1
|
Configure the required core network service on the system as described in the System Administration Guide.
|
|
3
|
|
1
|
|
2
|
Optional: Configure port maps as described in the Configuring Port Maps section.
|
|
3
|
Optional: Configure host pools as described in the Configuring Host Pools section.
|
|
4
|
Optional: Configure IMSI pools as described in the Configuring IMSI Pools section.
|
|
7
|
|
8
|
|
9
|
|
10
|
|
11
|
|
12
|
|
14
|
Enable NAT support for APN/subscribers as described in the Enabling NAT for APN/Subscribers section.
|
|
15
|
Optional: Configure the default Firewall-and-NAT policy as described in the Configuring the Default Firewall-and-NAT Policy section.
|
|
20
|
|
22
|
Optional: Configure a secondary IP pool, which is not overwritten by the RADIUS supplied list, as described in the Backing Out of NAT section.
|
IMPORTANT: Commands used in the configuration examples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands.To enable the ECS subsystem and create the enhanced charging service on the system, use the following configuration:
This is an optional configuration. To create and configure an application-port map for TCP and UDP protocols, use the following configuration:
|
l
|
A maximum of 256 host pools, IMSI pools, and port maps each, and a combined maximum of 4096 rules (host pools + IMSI pools + port maps + charging ruledefs + access ruledefs + routing ruledefs) can be created in a system.
|
|
l
|
Port maps, host pools, IMSI pools, and charging, access, and routing ruledefs must each have unique names.
|
This is an optional configuration. To create and configure a host pool, use the following configuration:
This is an optional configuration. To create and configure an IMSI pool, use the following configuration:
ip { { { any-match | downlink | uplink } <operator> <condition> } | { { dst-address | src-address } { { <operator> { <ip_address> | <ip_address/mask> } } | { !range | range } host-pool <host_pool_name> } | protocol { { <operator> { <protocol> | <protocol_assignment> } } | { <operator> <protocol_assignment> } }
tcp { any-match <operator> <condition> | { { dst-port | either-port | src-port } { { <operator> <port_number> } | { !range | range } { <from_range> to <end_range> | port-map <port_map_name> } } }
udp { any-match <operator> <condition> | { dst-port | either-port | src-port } { <operator> <port_number> | { !range | range } { <from_range> to <end_range> | port-map <port_map_name> } } }
|
l
|
If both uplink and downlink fields are not configured, then the rule will be treated as either direction, i.e. packets from any direction will match that rule.
|
|
l
|
Access ruledefs are different from enhanced charging service ruledefs. A combined maximum of 4096 rules (host pools, IMSI pools, port maps, and access, charging, and routing ruledefs) can be created in a system. A combined maximum of 2048 access and charging ruledefs can be created in a system.
|
|
l
|
Configuring access ruledefs involves the creation of several ruledefs with different sets of rules and parameters. For more information, see the Firewall Ruledef Configuration Mode Commands chapter of the Command Line Interface Reference.
|
ip pool <nat_realm_name> { <ip_address> <subnet_mask> | <ip_address/mask> | range <start_ip_address> <end_ip_address> } nat-one-to-one [ alert-threshold [ { pool-free | pool-hold | pool-release | pool-used } <low_thresh> [ clear <high_thresh> ] + ] [ nat-binding-timer <binding_timer> ] [ nexthop-forwarding-address <ip_address> ] [ on-demand ] [ send-nat-binding-update ] [ srp-activate ] + ]
ip pool <pool_name> { <ip_address> <subnet_mask> | <ip_address/mask> | range <start_ip_address> <end_ip_address> } public <priority>
|
l
|
The IP addresses configured in the NAT realms within a context must not overlap. At any time, within a context, a NAT IP address must be configured in any one NAT realm.
|
|
l
|
The IP addresses in a NAT realm may be contiguous, and must be assignable as a subnet or a range that constitutes less than an entire subnet.
|
|
l
|
For many-to-one NAT realms, the default NAT binding timer value is 60 seconds. For one-to-one NAT realms, by default the feature is disabled—the IP addresses/ port-chunks once allocated will never be freed.
|
|
l
|
Thresholds configured using the alert-threshold keyword are specific to the pool that they are configured in. Thresholds configured using the threshold ip-pool-* commands in the Context Configuration Mode apply to all IP pools in the context, and override the threshold configurations set within individual pools.
|
ip pool <nat_realm_name> { <ip_address> <subnet_mask> | <ip_address/mask> | range <start_ip_address> <end_ip_address> } napt-users-per-ip-address <users> [ alert-threshold [ { pool-free | pool-hold | pool-release | pool-used } <low_thresh> [ clear <high_thresh> ] + ] [ max-chunks-per-user <chunks> ] [ nat-binding-timer <binding_timer> ] [ nexthop-forwarding-address <ip_address> ] [ on-demand ] [ port-chunk-size <size> ] [ port-chunk-threshold <threshold> ] [ send-nat-binding-update ] [ srp-activate ] + ]
ip pool <pool_name> { <ip_address> <subnet_mask> | <ip_address/mask> | range <start_ip_address> <end_ip_address> } public <priority>
|
l
|
The IP addresses configured in the NAT realms within a context must not overlap. At any time, within a context, a NAT IP address must be configured in any one NAT realm.
|
|
l
|
The IP addresses in a NAT realm may be contiguous, and must be assignable as a subnet or a range that constitutes less than an entire subnet.
|
|
l
|
For many-to-one NAT realms, the default NAT binding timer value is 60 seconds. For one-to-one NAT realms, by default the feature is disabled—the IP addresses/ port-chunks once allocated will never be freed.
|
|
l
|
Thresholds configured using the alert-threshold keyword are specific to the pool that they are configured in. Thresholds configured using the threshold ip-pool-* commands in the Context Configuration Mode apply to all IP pools in the context, and override the threshold configurations set within individual pools.
|
access-rule priority <priority> { [ dynamic-only | static-and-dynamic ] access-ruledef <access_ruledef_name> { deny [ charging-action <charging_action_name> ] | permit [ nat-realm <nat_realm_name> | [ bypass-nat ] ] }
access-rule no-ruledef-matches { downlink | uplink } action { deny [ charging-action <charging_action_name> ] | permit [ bypass-nat | nat-realm <nat_realm_name> ] }
|
l
|
In StarOS 8.x, NAT for CDMA and early UMTS releases used rulebase-based configurations, whereas in later UMTS releases NAT used policy-based configurations. In StarOS 9.0, NAT for UMTS and CDMA releases both use policy-based configurations. For more information, please contact your local service representative.
|
|
l
|
The nat policy nat-required command enables NAT for all subscribers using the policy.
|
|
l
|
A maximum of three NAT realms can be configured within a Firewall-and-NAT policy. A subscriber can be allocated only one NAT IP address per realm. Hence, at anytime, there can be a maximum of three NAT IP addresses allocated to a subscriber.
|
|
l
|
Rule matching is done for the first packet for a flow. Only when no rules match, the no-ruledef-matches configuration is considered. The default settings for uplink direction is “permit”, and for downlink direction “deny”.
|
|
l
|
If there are no rules matching a packet, then the NAT realm to be used for the flow is taken from the following configuration:
|
access-rule no-ruledef-matches uplink action permit nat-realm <nat_realm_name>
|
l
|
If there is no NAT realm name configured in the matching access ruledef, NAT will be bypassed, i.e., NAT will not be applied to the flow.
|
To configure sending ICMP error messages in the event of NAT IP address/port allocation failure, use the following configuration:
To configure action to take on packets when NAT IP/NPU allocation is in progress, use the following configuration:
|
l
|
In On-demand NAT IP allocation (wherein a NAT IP address is allocated to the subscriber when a packet is being sent), if no free NAT IP address is available, a NAT-IP Alloc Request is sent to the VPNMgr to get a NAT IP. During that time packets are dropped. This command enables to either buffer or drop the packets received when IP Alloc Request is sent to VPNMgr.
|
To configure action to take on TCP idle timeout expiry for NAT flows, use the following configuration:
|
l
|
By default, for NAT-enabled calls the downlink private IP NPU flow will not be installed at call setup for a subscriber session. The flow will only be installed on demand. When there is no traffic on the private flow, the private IP flow will be removed after the configurable timeout period.
|
Enabling NAT for APN/Subscribers
This section describes how to enable NAT support for APN/subscribers.
|
l
|
<fw_nat_policy_name> must be a Firewall-and-NAT policy in which Firewall and NAT policy are enabled as described in the Configuring Firewall-and-NAT Policies section.
|
|
l
|
To specify that the default Firewall-and-NAT policy configured in the rulebase be used for subscribers who use this APN, in the APN Configuration Mode, apply the following command: default fw-and-nat policy
|
|
l
|
<fw_nat_policy_name> must be a Firewall-and-NAT policy in which Firewall and NAT policy are enabled as described in the Configuring Firewall-and-NAT Policies section.
|
|
l
|
To specify that the default Firewall-and-NAT policy configured in the rulebase be used for subscribers, in the Subscriber Configuration Mode, apply the following command: default fw-and-nat policy
|
This is an optional configuration to specify a default Firewall-and-NAT policy to use if in the APN/subscriber configurations the following command is configured:
To create a rulebase and configure a default Firewall-and-NAT policy in it, use the following configuration:
This section describes how to configure routing rules to open up dynamic pinholes for Application Level Gateways (ALG) functionality.
|
l
|
For RTSP ALG to work, in the rulebase, the rtp dynamic-flow-detection command must be configured.
|
|
l
|
If enabled, a routing rule for the particular protocol must be configured in the rulebase. For example:
|
|
l
|
The NBR format name configured in the edr-format <nbr_format_name> and the nat binding-record edr-format <nbr_format_name> commands must be the same.
|
receiver <ip_address> primary mechanism { tftp | { ftp | sftp } login <login> encrypted password <password> }
nat-realm schema cumulativenatschema format "NAT-REALM Schema: cumulativenatschema\nVPN Name: %vpnname%\nRealm Name: %realmname%\n Total binding updates sent to AAA: %nat-bind-updates%\nTotal bytes transferred by realm: %nat-rlm-bytes-tx%\nTotal flows used by realm: %nat-rlm-flows%\nTotal flows denied IP: %nat-rlm-ip-denied%\nTotal flows denied ports: %nat-rlm-port-denied%\n-----------------------\n"
nat-realm schema snapshotnatschema format "NAT-REALM Schema: snapshotnatschema\nVPN Name: %vpnname%\nRealm Name: %realmname%\nTotal NAT public IP address: %nat-rlm-ttl-ips%\nCurrent NAT public IP address in use: %nat-rlm-ips-in-use%\nCurrent subscribers using realm: %nat-rlm-current-users%\nTotal port chunks: %nat-rlm-ttl-port-chunks%\nCurrent port chunks in use: %nat-rlm-chunks-in-use%\n-----------------------\n"
|
l
|
Thresholds configured using the threshold ip-pool-* commands in the Context Configuration Mode apply to all IP pools in the context.
|
|
l
|
The thresholds configured for an individual NAT pool using the alert-threshold keyword will take priority, i.e will override the above context-wide configuration.
|
snmp trap { enable | suppress } { ThreshIPPoolUsed | ThreshIPPoolFree | ThreshIPPoolRelease | ThreshIPPoolHold | ThreshClearIPPoolUsed }
IMPORTANT: This is a licensed feature requiring the [600-00-7871] NAT Bypass license. Please contact your local sales representative for more information.To configure a secondary IP pool that is not overwritten by the RADIUS supplied list, use the following configuration. The secondary pool configured will be appended to the RADIUS supplied IP pool list / APN provided IP pool list whichever is applicable during call setup.
|
l
|
|
l
|
The busyout ip pool name <private_pool_name> command must be configured in the destination context. This command makes addresses from the specified IP pool in the current context unavailable once they are free.
|
To configure a secondary IP pool that is not overwritten by the RADIUS supplied list, use the following configuration. The secondary pool configured will be appended to the RADIUS supplied IP pool list/subscriber template provided IP pool list whichever is applicable during call setup.
|
l
|
|
l
|
The busyout ip pool name <private_pool_name> command must be configured in the destination context. This command makes addresses from the specified IP pool in the current context unavailable once they are free.
|
update active-charging { switch-to-fw-and-nat-policy <fw_nat_policy_name> | switch-to-rulebase <rulebase_name> } { all | callid <call_id> | fw-and-nat-policy <fw_nat_policy_name> | imsi <imsi> | ip-address <ipv4_address> | msid <msid> | rulebase <rulebase_name> | username <user_name> } [ -noconfirm ]
|
l
|
To be able to change the Firewall-and-NAT policy in mid session, firewall-and-NAT must have been enabled for the subscriber in the APN/Subscriber template configuration, or in the rulebase (the default policy) during call setup.
|
|
l
|
The above command takes effect only for current calls. For new calls, the RADIUS returned/APN/Subscriber template/rulebase configured policy is used.
|
The output displays subscriber information. Verify the NAT pools associated a subscriber and the NAT IP addresses allocated from each pool.
The output displays active charging flow information. Verify the NAT IP address and NAT port used for the subscriber flow.
In the following table, the first column lists what statistics to gather and the second column lists the action to perform.
|
show active-charging fw-and-nat policy statistics all
|
|
|
Information on NAT bind records generated for port chunk allocation and release.
|
|
|
show active-charging edr-format statistics
|
|
|
show active-charging flows nat not-required
|
|
|
show active-charging flows nat required
|
|
|
Information for subscriber flows with NAT enabled, and using specific NAT IP address.
|
|
|
Information for subscriber flows with NAT enabled, and using specific NAT IP address and NAT port number.
|
|
|
show active-charging sessions nat { not-required | required }
|
|
|
Information for all current subscribers who have either active or dormant sessions. Check IP address associated with subscriber.
|
|
|
Information for subscribers with NAT processing not required.
|
|
|
Information for subscribers with NAT processing enabled and using the specified NAT IP address.
|
show subscribers nat required nat-ip <nat_ip_address>
|
|
Information for subscribers with NAT processing enabled and using the specified NAT realm.
|
|
To save changes made to the system configuration, see the Saving Your Configuration chapter.
