Filter
Top Products
ServerIron ADX Security Guide 103
53-1002440-03
PAT
4
ServerIronADX(config)# interface ethernet 1/1
ServerIronADX(config-if-e1000-1/5) ip address 30.30.0.1 255.255.0.0
ServerIronADX(config-if-e1000-1/5) ip nat outside
The following command configures the ServerIron ADX to translate IP packets with a local IP
address of 20.20.5.6 to the global IP address 15.15.15.15.
ServerIronADX(config)# ip nat inside source static 20.20.5.6 15.15.15.15
Configured for outside to inside translation
To configure the network shown in Figure 8 for Outside to Inside translation the only requirement is
that the Interface configured as an Outside interface must be configured with an additional IP
address in the 15.15.15.0/24 network as shown in the following.
ServerIronADX(config)# interface ethernet 1/1
ServerIronADX(config-if-e1000-1/5) ip address 30.30.0.1 255.255.0.0
ServerIronADX(config-if-e1000-1/5) ip address 15.15.15.100 255.255.0.0
ServerIronADX(config-if-e1000-1/5) ip nat outside
PAT
Dynamic NAT uses Port Address Translation (PAT). Since there is no one-to-one mapping between
private addresses and global addresses, PAT maps a client's IP address and TCP/UDP port to both
a global IP address and a TCP/UDP port. In this way, the ServerIron ADX can map many private
addresses to the same public address and use TCP/UDP ports to uniquely identify the private
hosts.
PAT maps a client’s IP address and TCP or UDP port number to both an IP address and a TCP or
UDP port number. In this way, the ServerIron ADX can map many private addresses to the same
public address and use TCP or UDP port numbers to uniquely identify the private hosts.
NOTE
PAT is also called overloading an inside global address.
Example
NAT is mapping the same global IP address to three different private addresses along with their
TCP or UDP ports, but uses a different TCP or UDP port number for each private address to
distinguish them. Notice that the PAT feature does not attempt to use the same TCP or UDP port
number as in the client’s packet.
Forwarding packets without NAT translation
When ServerIron ADX receives a non-SYN packet for a TCP flow from an internal NAT client and no
sessions are found, then by default ServerIron drops that packet. Optionally, you can forward that
packets without NAT translation by entering the following command.
Inside address Outside address
10.10.10.2:6000 209.157.1.2:1024
10.10.10.3:6000 209.157.1.2:1025
10.10.10.4:6000 209.157.1.2:1026