Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 122)

110 ServerIron ADX NAT64 Configuration Guide

53-1002444-02

Configuring NAT

DRAFT: BROCADE CONFIDENTIAL

Configuring NAT

The following types of NAT are supported with ServerIron ADX:

• Static NAT: Maps a specific public IP address (Internet IP address) with a specific private

address. Static translation ensures that ServerIron ADX always maps the same public address

to a given private address. For example, you can map a specific host (IP address 10.1.1.1) in

the private network to always use the same Internet address (150.1.1.1) when communicating

outside the private network. The ServerIron ADX supports both inside-to-outside static NAT and

outside-to-inside static NAT.

• Dynamic NAT: Maps a group of private addresses with a pool of global IP addresses that you

configure. For example, in Figure 18 a global pool within the IP address range of

209.157.1.3/24 through 209.157.1.30/24 is mapped with a private IP subnet 10.10.1.0/24.

With dynamic NAT, ServerIron ADX uses a round robin technique to select a global IP address to

map to a private IP address for every new connection. However, the address selection can get

randomized depending on the number of free ports available for the translation.

In order to reliably de-multiplex return traffic to the internal clients, dynamic NAT uses port

address translation (PAT), whereby the ServerIron ADX translates the client’s source port into

any free port available with the public IP address.

NOTE

You can configure both dynamic and static NAT on the same device. When you configure both types

of NAT, static NAT takes precedence over dynamic NAT. Thus, if both static and dynamic NAT entries

exist for a private address, the ServerIron ADX will always use the static translation instead of

creating a dynamic one.

PAT

Dynamic NAT uses port address translation (PAT). Because there is no one-to-one mapping

between private addresses and global addresses, PAT maps a client's IP address and TCP/UDP

port to both a global IP address and a TCP/UDP port. In this way, the ServerIron ADX can map many

private addresses to the same public address and use TCP/UDP ports to uniquely identify the

private hosts.

NOTE

PAT is also called overloading an inside global address.

in the following example, using PAT (or overloading) three different private IP addresses with same

source ports are mapped to the same global IP address (209.157.1.2), but with different source

ports. Thus, the translated source ports help to uniquely identify the reverse session for each

dynamic NAT translation.

Inside address Outside address

10.10.10.2:6000 209.157.1.2:1024

10.10.10.3:6000 209.157.1.2:1025

10.10.10.4:6000 209.157.1.2:1026

1 2 ... 117 118 119 120 121 122 123 124 125 126 127 ... 148 149

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 122