Configuring Network Address Translation

This chapter contains the following sections:

About NAT

Network Address Translation (NAT) enables private IP internetworks that use non-registered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks, and translates the private (not globally unique) addresses in the internal network into legal addresses before packets are forwarded onto another network. NAT can be configured to advertise only one address for the entire network to the outside world. This ability provides additional security by effectively hiding the entire internal network behind that one address.

In Cisco UCS Director, you can configure NAT on the following Cisco network devices:

  • Cisco ASA 5500 Series firewall
  • Cisco Adaptive Security Virtual Appliance (ASAv)

Configuring NAT

Before You Begin

Ensure that the real source and destination IP addresses and mapped source and destination IP addresses are preconfigured on the device.

    Step 1   Choose Physical > Network.
    Step 2   On the Network page, choose the pod.
    Step 3   Select the network device to be configured.

    The summary of the device is displayed.

    Step 4   Click Configure NAT.
    Step 5   In the Configure NAT screen, complete the required fields, including the following:
    Name Description

    Real Source field

    Click Select and choose an object as real source address.

    Mapped Source field

    Click Select and choose an object as mapped source address.

    Real Destination field

    Click Select and choose an object as real destination address.

    Mapped Destination field

    Click Select and choose an object as mapped address.

    Step 6   Click Submit.

    Configuring Context NAT

      Step 1   Choose Physical > Network.
      Step 2   On the Network page, choose the pod.
      Step 3   Select the network device to be configured.

      The summary of the device is displayed.

      Step 4   Click Configure Context NAT.
      Step 5   In the Configure Context NAT screen, complete the required fields, including the following:
      Name Description

      Protocol drop-down

      Choose TCP or UDP from the list.

      Mapped Interface Name drop-down list

      Choose an interface name to be mapped for NAT.

      Mapped IP Address Destination field

      The IP address to be mapped for NAT.

      Mapped Port field

      The port to be mapped for NAT.

      Real Interface Name drop-down

      Choose a real interface name for NAT.

      Real IP Address field

      The real IP address for NAT.

      Real Port field

      The port for NAT.

      Step 6   Click Submit.

      Creating a Network Object

      All NAT rules that are configured as a parameter of a network object are considered as network object NAT rules. A network object NAT is a quick and easy way to configure NAT for a network object, which can be a single IP address, a range of addresses, or a subnet. After you configure the network object, you can then identify the mapped address for that object.

      You can create a network object using this procedure, or you can use the Create Network Object workflow task from the task library.

        Step 1   Choose Physical > Network.
        Step 2   On the Network page, choose the pod.
        Step 3   Select the device for which you want to create the network object.
        Step 4   Choose Network Objects.
        Step 5   Click Add.
        Step 6   In the Create Network Object screen, complete the required fields, including the following:

        Name

        Description

        Network Object Name field

        Enter a unique name for the network object.

        IP Address field

        Enter the IP address of the host, or an IP address range, or the subnet of the host. For example:

        Host IP address - 10.1.1.1

        IP address range - 10.1.1.1-10.1.1.20

        Subnet of the host - 10.1.1.0/255.255.255.0

        Description field

        Enter a description for the network object.

        Copy Running configuration to Startup configuration check box

        Check the check box if you want this configuration to be saved as the startup configuration.

        Step 7   Click Submit.

        The object is created and listed on the Network Object screen.

        What to Do Next

        You must create a network object group.

        Creating a Network Object Group

        By grouping similar NAT network objects together, you can use the object group in an Access Control entry (ACE) instead of specifying an ACE for each object separately. You can create the following types of object groups:

        • Protocol

        • Network

        • Service

        • ICMP type

        You can also nest object groups in other object groups.

        You can create a network object group using this procedure, or you can use the Create Network Object Group workflow task from the task library.

        Before You Begin

        You must create a network object prior to creating the network object group.

          Step 1   Choose Physical > Network.
          Step 2   On the Network page, choose the pod.
          Step 3   Select the device for which you want to create the network object group.
          Step 4   Choose Network Object Groups.
          Step 5   Click Create Network Object Group.
          Step 6   In the Create Network Object Group screen, complete the required fields, including the following:

          Field

          Description

          Network Object Group Name field

          Enter a name for the network object group.

          Description field

          Enter a description for the network object group.

          Host field

          Enter the IP address of the host for this network object group.

          Network Address field

          Enter the network address for this object group. The format should be the IP address followed by the subnet address.

          Network Object list

          Expand the list to select an object.

          Copy Running configuration to Startup configuration check box

          Check the check box if you want this configuration to be saved as the startup configuration.

          Step 7   Click Submit.
          What to Do Next

          You must create a service object.

          Creating a Service Object

          You can create a service object using this procedure, or you can use the Create Service Object workflow task from the task library.

          Before You Begin

          You should have created a network object, and a network object group before you create a service object.

            Step 1   Choose Physical > Network.
            Step 2   On the Network page, choose the pod.
            Step 3   Select the device for which you want to create the service object.
            Step 4   Choose Service Objects.
            Step 5   Click Add.
            Step 6   In the Create Service Object screen, complete the following fields:

            Name

            Description

            Context Name drop-down list

            Expand the list to select a context.

            Service Object Name field

            Enter a name for the service object.

            Description field

            Enter a description for the service object.

            Protocol drop-down list

            Choose a protocol from the drop-down list. It can be one of the following:

            • TCP

            • UDP

            Source Operator drop-down list

            Choose a source operator from the drop-down list.

            Source Port field

            Enter the name or the number of the source port.

            Destination Operator drop-down list

            Choose a destination operator from the drop-down list.

            Destination Port field

            Enter the name or the number of the destination port.

            Copy Running configuration to Startup configuration check box

            Check the check box if you want this configuration to be saved as the startup configuration.

            Step 7   Click Submit.
            What to Do Next

            You must create an object-based NAT.

            Creating Object-Based NAT

            When a packet enters the ASA, the source and destination IP addresses are checked against the network object NAT rules.

            You can create an object-based NAT using this procedure, or you can use the Configure Network Object NAT workflow task from the task library.

              Step 1   Choose Physical > Network.
              Step 2   On the Network page, choose the pod.
              Step 3   Select the device for which you want to create the object-based NAT.
              Step 4   Choose NAT.
              Step 5   Click Configure Network Object NAT.
              Step 6   In the Configure Network Object NAT screen, complete the following fields:

              Name

              Description

              Real Interface list

              Expand the list to select an interface.

              Mapped Interface list

              Expand the list to select an interface

              Mode drop-down list

              Select a mode for the object. It can be one of the following:

              • Static

              • Dynamic

              Network Object Name field

              Specify a name for the network object.

              Real IP Address field

              Enter the IP address of the host, or an IP address range, or the subnet of the host.

              Type drop-down list

              Choose a type of mapped IP address from the drop-down list. It can be one of the following options:

              • Network object

              • Network object group

              • Host

              Based on the selection you make in this drop-down list, you will have to expand a list and select an entry.

              Interface check box

              Check this check box to include interface-specific settings.

              PAT check box

              Check this check box to include Port Address Translation (PAT) specific settings.

              Protocol drop-down list

              Choose a protocol from the drop-down list. It can be one of the following options:

              • TCP

              • UDP

              This field is displayed only when you check the PAT check box.

              Mapped Port field

              Enter the mapped port number.

              This field is displayed only when you check the PAT check box.

              Real Port field

              Enter the real port number.

              This field is displayed only when you check the PAT check box.

              Copy Running configuration to Startup configuration check box

              Check this check box if you want this configuration to be saved as the startup configuration.

              Step 7   Click Submit.

              Configuring Twice NAT

              You can configure twice NAT using this procedure, or you can use the Configure Twice NAT workflow task from the task library.

                Step 1   Choose Physical > Network.
                Step 2   On the Network page, choose the pod.
                Step 3   Select the device for which you want to create the twice NAT.
                Step 4   Click Configure Twice NAT.
                Step 5   In the Configure Twice NAT screen, complete the required fields, including the following:

                Name

                Description

                Real Interface list

                Expand the list to select an interface.

                Mapped Interface list

                Expand the list to select an interface

                Source Mode drop-down list

                Select a mode from the drop-down list.

                It can either be Static or Dynamic.

                Source Real Object Type drop-down list

                Select a source object type from the drop-down list.

                It can either be Network Object or Network Object Group. By default, Network Object is selected.

                Source Real Object Network Object list

                Expand the list to check the check boxes of the network object. After you select an object, click Validate.

                This field is displayed only if you selected Network Object in the Source Real Object Type drop-down list.

                Source Real Network Object Group list

                Expand the list to check the check boxes of the network object groups.

                This field is displayed only if you selected Network Object Group in the Source Real Object Type drop-down list.

                Source Mapped Object Type drop-down list

                Select a mapped object type from the drop-down list.

                It can either be Network Object or Network Object Group. By default, Network Object is selected.

                Source Mapped Network Object list

                Expand the list to check the check boxes of the network object.

                This field is displayed only if you selected Network Object in the Source Mapped Object Type drop-down list.

                Source Mapped Network Object Group list

                Expand the list to check the check boxes of the network object groups.

                This field is displayed only if you selected Network Object Group in the Source Mapped Object Type drop-down list.

                Source Mapped Interface check box

                Check the check box to source the mapped interface for Twice NAT.

                Destination Mode drop-down list

                This field displayed the destination mode. You cannot edit this field.

                Destination Real Object Type drop-down list

                Select either Network Object or Network Object Group.

                Based on the selection you make in this field, you must expand the list, and select either network objects or network object groups.

                Destination Mapped Object Type drop-down list

                Select either Network Object or Network Object Group.

                Based on the selection you make in this field, you must expand the list, and select either network objects or network object groups.

                Destination Mapped Interface check box

                Check the check box to include a destination mapped interface.

                Is PAT check box

                Check this check box to enable PAT.

                After you check this check box, you must expand the Real Service Object and Mapped Service Object lists and select the devices.

                Real Service Object list

                Expand the list to select a real service object. After selecting an object, click Validate.

                Mapped Service Object list

                Expand the list to select a mapped service object. After selecting an object, click Validate.

                Description field

                Enter a description for the configuration.

                Copy Running configuration to Startup configuration check box

                Check this check box if you want this configuration to be saved as the startup configuration.

                Step 6   Click Submit.