IP Addressing: NAT Configuration Guide - Cisco Systems

406 Pages·2016·5.97 MB·English

IP Addressing: NAT Configuration Guide
AmericasHeadquarters
CiscoSystems,Inc.
170WestTasmanDrive
SanJose,CA95134-1706
USA
http://www.cisco.com
Tel:[phone]
800553-NETS(6387)
Fax:[phone]
©2022CiscoSystems,Inc.Allrightsreserved.
CONTEN TS
CHAPTER 1 ReadMeFirst 1
ShortDescription 2
CHAPTER 2 ConfiguringNATforIPAddressConservation 3
PrerequisitesforConfiguringNATforIPAddressConservation 3
AccessLists 3
NATRequirements 4
RestrictionsforConfiguringNATforIPAddressConservation 4
InformationAboutConfiguringNATforIPAddressConservation 6
BenefitsofConfiguringNATforIPAddressConservation 6
HowNATWorks 7
UsesofNAT 7
TypesofNAT 7
NATInsideandOutsideAddresses 8
InsideSourceAddressTranslation 8
OverloadingofInsideGlobalAddresses 10
AddressTranslationofOverlappingNetworks 11
TCPLoadDistributionforNAT 12
StaticIPAddressSupport 13
RADIUS 13
Denial-of-ServiceAttacks 13
VirusesandWormsThatTargetNAT 13
HowtoConfigureNATforIPAddressConservation 14
ConfiguringInsideSourceAddresses 14
ConfiguringStaticTranslationofInsideSourceAddresses 14
ConfiguringDynamicTranslationofInsideSourceAddresses 16
IPAddressing:NATConfigurationGuide
iii
Contents
ConfiguringtheSameGlobalAddressforStaticNATandPAT 18
UsingNATtoAllowInternalUsersAccesstotheInternet 19
ConfiguringAddressTranslationTimeouts 20
ChangingtheTranslationTimeout 21
ChangingtheTimeoutsWhenOverloadingIsConfigured 21
AllowingOverlappingNetworkstoCommunicateUsingNAT 23
ConfiguringStaticTranslationofOverlappingNetworks 23
WhattoDoNext 25
ConfiguringServerTCPLoadBalancing 25
EnablingRouteMapsonInsideInterfaces 27
EnablingNATRouteMapsOutside-to-InsideSupport 28
ConfiguringNATofExternalIPAddressesOnly 29
ConfiguringtheNATDefaultInsideServerFeature 31
ReenablingRTSPonaNATRouter 32
ConfiguringSupportforUserswithStaticIPAddresses 32
ConfiguringtheRateLimitingNATTranslationFeature 34
ConfiguringBypassNATFunctionality 36
ConfigurationExamplesforConfiguringNATforIPAddressConservation 37
Example:ConfiguringStaticTranslationofInsideSourceAddresses 37
Example:ConfiguringDynamicTranslationofInsideSourceAddresses 38
Example:UsingNATtoAllowInternalUsersAccesstotheInternet 38
Example:AllowingOverlappingNetworkstoCommunicateUsingNAT 39
Example:ConfiguringStaticTranslationofOverlappingNetworks 39
Example:ConfiguringDynamicTranslationofOverlappingNetworks 39
Example:ConfiguringServerTCPLoadBalancing 39
Example:EnablingRouteMapsonInsideInterfaces 40
Example:EnablingNATRouteMapsOutside-to-InsideSupport 40
Example:ConfiguringNATofExternalIPAddressesOnly 40
Example:ConfiguringSupportforUserswithStaticIPAddresses 40
Example:ConfiguringNATStaticIPSupport 40
Example:CreatingaRADIUSProfileforNATStaticIPSupport 40
Example:ConfiguringtheRateLimitingNATTranslationFeature 41
Example:SettingaGlobalNATRateLimit 41
Example:SettingNATRateLimitsforaSpecificVRFInstance 41
IPAddressing:NATConfigurationGuide
iv
Contents
Example:SettingNATRateLimitsforAllVRFInstances 41
Example:SettingNATRateLimitsforAccessControlLists 42
Example:SettingNATRateLimitsforanIPAddress 42
WheretoGoNext 42
AdditionalReferencesforConfiguringNATforIPAddressConservation 42
CHAPTER 3 UsingApplication-LevelGatewayswithNAT 45
PrerequisitesforUsingApplicationLevelGatewayswithNAT 45
RestrictionsforUsingApplication-LevelGatewayswithNAT 46
InformationAboutUsingApplication-LevelGatewayswithNAT 46
IPsec 46
BenefitsofConfiguringNATIPsec 47
VoiceandMultimediaoverIPNetworks 47
NATSupportofH.323v2RAS 47
NATSupportforH.323v3andv4inv2CompatibilityMode 48
NATH.245TunnelingSupport 48
NATSupportofSkinnyClientControlProtocol 48
NATSupportofSCCPFragmentation 48
NATSegmentationwithLayer4Forwarding 49
HowtoConfigureApplication-LevelGatewayswithNAT 50
ConfiguringIPsecThroughNAT 50
ConfiguringIPsecESPThroughNAT 50
EnablingthePreservePort 51
EnablingSPIMatchingontheNATDevice 52
EnablingSPIMatchingonEndpoints 53
EnablingMultiPartSDPSupportforNAT 53
ConfiguringNATBetweenanIPPhoneandCiscoCallManager 54
ConfigurationExamplesforUsingApplication-LevelGatewayswithNAT 55
Example:SpecifyingaPortforNATTranslation 55
Example:EnablingthePreservePort 55
ExampleEnablingSPIMatching 55
Example:EnablingSPIMatchingonEndpoints 55
Example:EnablingMultiPartSDPSupportforNAT 56
Example:SpecifyingaPortforNATTranslation 56
IPAddressing:NATConfigurationGuide
v
Contents
WheretoGoNext 56
AdditionalReferencesforUsingApplication-LevelGatewayswithNAT 56
FeatureInformationforUsingApplication-LevelGatewayswithNAT 57
CHAPTER 4 CarrierGradeNetworkAddressTranslation 61
RestrictionsforCarrierGradeNetworkAddressTranslation 61
InformationAboutCarrierGradeNetworkAddressTranslation 62
CarrierGradeNATOverview 62
CarrierGradeNATSupportforBroadbandAccessAggregation 63
HowtoConfigureCarrierGradeNetworkAddressTranslation 63
ConfiguringStaticCarrierGradeNAT 63
ConfiguringDynamicCarrierGradeNAT 66
ConfiguringDynamicPortAddressCarrierGradeNAT 68
LoggingDestinationIPAddressandPortDetailsinCarrierGradeNAT(CGN)Mode 70
ConfigurationExamplesforCarrierGradeNetworkAddressTranslation 71
Example:ConfiguringStaticCarrierGradeNAT 71
Example:ConfiguringDynamicCarrierGradeNAT 71
Example:ConfiguringDynamicPortAddressCarrierGradeNAT 72
AdditionalReferencesforCarrierGradeNetworkAddressTranslation 72
FeatureInformationforCarrierGradeNetworkAddressTranslation 73
CHAPTER 5 StaticNATMappingwithHSRP 75
PrerequisitesforStaticNATMappingwithHSRP 75
RestrictionsforStaticNATMappingwithHSRP 75
InformationAboutStaticNATMappingwithHSRP 76
StaticMappingSupportwithHSRPforHighAvailabilityFeatureOverview 76
AddressResolutionwithARP 76
HowtoConfigureStaticNATMappingwithHSRP 77
ConfiguringNATStaticMappingSupportforHSRP 77
EnablingHSRPontheNATInterface 77
EnablingStaticNATforHSRP 79
ConfigurationExampleforStaticNATMappingwithHSRP 80
Example:ConfiguringStaticNATinanHSRPEnvironment 80
AdditionalReferencesforStaticNATMappingwithHSRP 81
IPAddressing:NATConfigurationGuide
vi
Contents
FeatureInformationforStaticNATMappingwithHSRP 82
CHAPTER 6 VRF-AwareDynamicNATMappingwithHSRP 83
PrerequisitesforVRF-AwareDynamicNATMappingwithHSRP 83
RestrictionsforVRF-AwareDynamicNATMappingwithHSRP 83
InformationAboutVRF-AwareDynamicNATMappingwithHSRP 84
VRF-AwareDynamicNATMappingwithHSRPOverview 84
AddressResolutionwithARP 84
HowtoConfigureVRF-AwareDynamicNATMappingwithHSRP 85
EnablingHSRPforVRF-AwareDynamicNAT 85
ConfigurationExamplesforVRF-AwareDynamicNATMappingwithHSRP 88
Example:EnablingHSRPforVRF-AwareDynamicNAT 88
VerifyingHSRPforVRF-AwareDynamicNAT 89
AdditionalReferencesVRF-AwareDynamicNATMappingwithHSRP 91
FeatureInformationforVRF-AwareDynamicNATMappingwithHSRP 91
CHAPTER 7 ConfiguringStatefulInterchassisRedundancy 93
PrerequisitesforStatefulInterchassisRedundancy 93
RestrictionsforStatefulInterchassisRedundancy 93
InformationAboutStatefulInterchassisRedundancy 94
StatefulInterchassisRedundancyOverview 94
StatefulInterchassisRedundancyOperation 95
AssociationswithFirewallsandNAT 96
LAN-LANTopology 96
HowtoConfigureStatefulInterchassisRedundancy 97
ConfiguringtheControlInterfaceProtocol 97
ConfiguringaRedundancyGroup 99
ConfiguringaRedundantTrafficInterface 102
ConfiguringNATwithStatefulInterchassisRedundancy 103
ManagingandMonitoringStatefulInterchassisRedundancy 104
ConfigurationExamplesforStatefulInterchassisRedundancy 106
Example:ConfiguringtheControlInterfaceProtocol 106
Example:ConfiguringaRedundancyGroup 106
Example:ConfiguringaRedundantTrafficInterface 106
IPAddressing:NATConfigurationGuide
vii
Contents
Example:ConfiguringNATwithStatefulInterchassisRedundancy 107
AdditionalReferencesforStatefulInterchassisRedundancy 107
CHAPTER 8 InterchassisAsymmetricRoutingSupportforZone-BasedFirewallandNAT 109
RestrictionsforInterchassisAsymmetricRoutingSupportforZone-BasedFirewallandNAT 109
InformationAboutInterchassisAsymmetricRoutingSupportforZone-BasedFirewallandNAT 110
AsymmetricRoutingOverview 110
AsymmetricRoutingSupportinFirewalls 112
AsymmetricRoutinginNAT 112
AsymmetricRoutinginaWAN-LANTopology 113
VRF-AwareAsymmetricRoutinginZone-BasedFirewalls 113
VRF-AwareAsymmetricRoutinginNAT 114
HowtoConfigureInterchassisAsymmetricRoutingSupportforZone-BasedFirewallandNAT 114
ConfiguringaRedundancyApplicationGroupandaRedundancyGroupProtocol 114
ConfiguringData,Control,andAsymmetricRoutingInterfaces 116
ConfiguringaRedundantInterfaceIdentifierandAsymmetricRoutingonanInterface 118
ConfiguringDynamicInsideSourceTranslationwithAsymmetricRouting 119
ConfigurationExamplesforInterchassisAsymmetricRoutingSupportforZone-BasedFirewalland
NAT 122
Example:ConfiguringaRedundancyApplicationGroupandaRedundancyGroupProtocol 122
Example:ConfiguringData,Control,andAsymmetricRoutingInterfaces 122
Example:ConfiguringaRedundantInterfaceIdentifierandAsymmetricRoutingonanInterface 123
Example:ConfiguringDynamicInsideSourceTranslationwithAsymmetricRouting 123
Example:ConfiguringVRF-AwareNATforWAN-WANTopologywithSymmetricRouting
Box-to-BoxRedundancy 123
Example:ConfiguringAsymmetricRoutingwithVRF 126
AdditionalReferencesforInterchassisAsymmetricRoutingSupportforZone-BasedFirewalland
NAT 126
FeatureInformationforInterchassisAsymmetricRoutingSupportforZone-BasedFirewallandNAT 127
CHAPTER 9 VRF-AwareNATforWAN-WANTopologywithSymmetricRoutingBox-to-BoxRedundancy 129
FindingFeatureInformation 129
RestrictionsforVRF-AwareNATforWAN-WANTopologywithSymmetricRoutingBox-to-Box
Redundancy 130
IPAddressing:NATConfigurationGuide
viii
Contents
InformationAboutVRF-AwareNATforWAN-WANTopologywithSymmetricRoutingBox-to-Box
Redundancy 130
VRF-AwareBox-to-BoxHighAvailabilitySupport 130
StatefulInterchassisRedundancyOverview 131
StatefulInterchassisRedundancyOperationinNAT 131
HowtoConfigureVRF-AwareNATforWAN-WANTopologywithSymmetricRoutingBox-to-Box
Redundancy 132
ConfigurationExamplesforVRF-AwareNATforWAN-WANTopologywithSymmetricRouting
Box-to-BoxRedundancy 133
Example:ConfiguringVRF-AwareNATforWAN-WANTopologywithSymmetricRouting
Box-to-BoxRedundancy 133
AdditionalReferencesforVRF-AwareNATforWAN-WANTopologywithSymmetricRouting
Box-to-BoxRedundancy 135
FeatureInformationforVRF-AwareNATforWAN-WANTopologywithSymmetricRouting
Box-to-BoxRedundancy 136
CHAPTER 10 IntegratingNATwithMPLSVPNs 137
PrerequisitesforIntegratingNATwithMPLSVPNs 137
RestrictionsforIntegratingNATwithMPLSVPNs 137
InformationAboutIntegratingNATwithMPLSVPNs 138
BenefitsofNATIntegrationwithMPLSVPNs 138
ImplementationOptionsforIntegratingNatwithMPLSVPNs 138
ScenariosforImplementingNATonthePERouter 138
HowtoIntegrateNATwithMPLSVPNs 139
ConfiguringInsideDynamicNATwithMPLSVPNs 139
ConfiguringInsideStaticNATwithMPLSVPNs 141
ConfiguringOutsideDynamicNATwithMPLSVPNs 142
ConfiguringOutsideStaticNATwithMPLSVPNs 143
ConfigurationExamplesforIntegratingNATwithMPLSVPNs 145
ConfiguringInsideDynamicNATwithMPLSVPNsExample 145
ConfiguringInsideStaticNATwithMPLSVPNsExample 145
ConfiguringOutsideDynamicNATwithMPLSVPNsExample 146
ConfiguringOutsideStaticNATwithMPLSVPNsExample 146
WheretoGoNext 146
AdditionalReferencesforIntegratingNATwithMPLSVPNs 147
IPAddressing:NATConfigurationGuide
ix
Contents
FeatureInformationforIntegratingNATwithMPLSVPNs 147
CHAPTER 11 MonitoringandMaintainingNAT 149
PrerequisitesforMonitoringandMaintainingNAT 149
RestrictionsforMonitoringandMaintainingNAT 149
InformationAboutMonitoringandMaintainingNAT 149
NATDisplayContents 149
TranslationEntries 149
StatisticalInformation 150
NAT-ForcedClearofDynamicNATHalf-Entries 151
HowtoMonitorandMaintainNAT 151
DisplayingNATTranslationInformation 151
ClearingNATEntriesBeforetheTimeout 152
ExamplesforMonitoringandMaintainingNAT 154
Example:ClearingUDPNATTranslations 154
AdditionalReferencesforMonitoringandMaintainingNAT 154
FeatureInformationforMonitoringandMaintainingNAT 155
CHAPTER 12 EnablingNATHigh-SpeedLoggingperVRF 157
InformationAboutEnablingNATHigh-SpeedLoggingperVRF 157
High-SpeedLoggingforNAT 157
HowtoConfigureEnablingNATHigh-SpeedLoggingperVRF 158
EnablingHigh-SpeedLoggingofNATTranslations 158
ConfigurationExamplesforEnablingNATHigh-SpeedLoggingperVRF 160
Example:EnablingHigh-SpeedLoggingofNATTranslations 160
AdditionalReferencesforEnablingNATHigh-SpeedLoggingperVRF 160
FeatureInformationforEnablingNATHigh-SpeedLoggingperVRF 161
CHAPTER 13 StatelessNetworkAddressTranslation64 163
RestrictionsforStatelessNetworkAddressTranslation64 163
RestrictionsforStatelessNetworkAddressTranslation64 164
InformationAboutStatelessNetworkAddressTranslation64 164
FragmentationofIPDatagramsinIPv6andIPv4Networks 164
TranslationofICMPforStatelessNAT64Translation 164
IPAddressing:NATConfigurationGuide
x