NAT Configuration Guide

NAT (Network Address Translation) is a technology that maps one IP address space to another and is primarily used to allow multiple internal network devices to share fewer public IP addresses to communicate with external networks when existing IP address resources are limited.

Basic Concepts and Principles

A Network Address Translation (NAT) device, often a router or firewall, has an internal interface to the internal network and an external interface to an external network, such as the Internet. When a device on the internal network sends a packet out, the NAT device replaces the internal source IP address in the packet with one of its own external IP addresses, and records this translation relationship in the NAT table. When an external network device receives a packet and returns a response, the NAT device restores the destination IP address to the IP address of the internal device that originally initiated the request according to the records in the NAT table, thus forwarding the response packet to the internal device.

Static NAT: This type maps an internal IP address to a fixed external IP address at all times. It is typically used in scenarios where you need to provide fixed accessibility for an internal server on an external network. For example, a company with an internal web server can use static NAT to make it accessible from the outside with a fixed public IP address on the Internet.
Dynamic NAT: Dynamic NAT maintains a pool of available external IP addresses from which internal devices are dynamically assigned an external IP address for address translation when they need to access the external network. When used, the external IP address is released back into the address pool for use by other internal devices.
Port Address Translation (PAT): Also known as NAPT (Network Address Port Translation), PAT is the most commonly used NAT technology. It translates not only IP addresses, but also port numbers (TCP or UDP ports). Multiple internal devices can share one or a few external IP addresses, distinguished by different port numbers on the NAT device. For example, if there are multiple devices on an internal network that need to access the Internet, PAT can use a single public IP address to establish a communication link for each device through a different port number, enabling “many-to-one” IP address translation.

NAT Configuration

Configure Port Domains

Operation	Command	Description
Enter the system configuration view	configure terminal	-
Enter the interface configuration view	interface type interface-number	Type has ethernat, vlan, lag, loopback,sub-ethernet
Enable port nat output	nat-zone 1
Disable port nat output	no nat-zone

Configure the nat function

Operation	Command	Description
Enter the system configuration view	configure terminal	-
Enable nat function	nat enable
Disable nat function	no nat enable
Configure static nat	nat static basic global_ip local_ip type	Global_ip is public network address, local_ip is private network address, and the type has snat and dnat.
Delete static nat	no nat static basic global_ip local_ip type
Configure static napt	nat static {tcp\|udp} global_ip global_port local_ip local_port type	Global_port is public network port, local_port is private network port.
Delete static napt	no nat static {tcp\|udp} global_ip global_port local_ip local_port
Configure a dynamic nat address pool	nat pool pool_name start_ip [end_ip]	Pool_name is the name of nat address pool, start_ip is the start ip of nat address pool, end_ip is the end ip of nat address pool, Configuring only start_ip means using a single address.
Delete a dynamic nat address pool	no nat pool pool_name
Configure a binding dynamic address pool	nat binding binding_name pool_name [acl_name]	Binding_name is the name of bind operation, pool_name if the name of nat address pool, acl_name is the name of acl name.
Delete a binding dynamic address pool	no nat binding binding_name

Display and Maintenance

Operation	Command	Description
Display nat config infomation	show nat config	-
Display nat translations	show nat translations
Display nat translations count	show nat translations_count
Display nat statistics	show nat statistics

Static nat Typical Scenario Configuration Example

Network requirements

The IP address of the router’s outgoing interface 2 is 2.2.2.2/24 and the gateway address on the LAN side is 192.168.0.1/24. The address at the opposite end on the carrier side is 2.2.2.1/24. The host’s intranet address is 192.168.0.2/24 and a static address of 2.2.2.3/24 must be used. The company must be able to convert the private address internally to a public address for connection to the WAN.

Procedure

1.Router configuration

# Configure the port ip address and set port 2 as the nat conversion output port

sonic(config)# interface ethernet 1
sonic(config-if-1)# ip address 192.168.0.1/24
sonic(config-if-1)# exit
sonic(config)# interface ethernet 2
sonic(config-if-2)# ip address 2.2.2.2/24
sonic(config-if-2)# nat-zone 1

# Configure static routes

sonic(config)# ip route 0.0.0.0/0 2.2.2.1

# Configure static nat

sonic(config)# nat enable
sonic(config)# nat static basic 2.2.2.3 192.168.0.1 snat

Verify configuration

sonic(config)# do show nat config
Global Values
Admin Mode : enabled
Global Timeout : 600 secs
TCP Timeout : 86400 secs
UDP Timeout : 300 secs
Static Entries
Nat Type IP Protocol Global IP Global Port Local IP Local Port Twice-NAT Id
---------- ------------- ----------- ------------- ----------- ------------ ---------------
snat all 2.2.2.3 --- 192.168.0.1 --- ---
Pool Entries
Pool Name Global IP Range Global Port Range
----------- ----------------- -------------------
NAT Bindings
Binding Name Pool Name Access-List Nat Type Twice-NAT Id
-------------- ----------- ------------- ---------- --------------
NAT Zones
Port Zone
---------- ------
Ethernet1 0
Ethernet2 1
sonic(config)# do show nat translations
Static NAT Entries ..................... 2
Static NAPT Entries ..................... 0
Dynamic NAT Entries ..................... 0
Dynamic NAPT Entries ..................... 0
Static Twice NAT Entries ..................... 0
Static Twice NAPT Entries ..................... 0
Dynamic Twice NAT Entries ..................... 0
Dynamic Twice NAPT Entries ..................... 0
Total SNAT/SNAPT Entries ..................... 1
Total DNAT/DNAPT Entries ..................... 1
Total Entries ..................... 2
Protocol Source Destination Translated Source Translated Destination
---------- ----------- ------------- ------------------- ------------------------
all --- 2.2.2.3 --- 192.168.0.1
all 192.168.0.1 --- 2.2.2.3 ---
sonic(config)# do show nat statistics
Protocol Source Destination Packets Bytes
---------- ----------- ------------- --------- -------
all --- 2.2.2.3 0 0
all 192.168.0.1 --- 0 0

Dynamic nat Typical Scenario Configuration Example