Brocade Virtual ADX Security Guide (Supporting ADX v03.1.00) - Manual (Page 78)

66 Brocade Virtual ADX Security Guide
53-1003250-01
PAT
4
Configured for outside to inside translation
To configure the network shown in
Figure 5 for Outside to Inside translation the only requirement is
that the Interface configured as an Outside interface must be configured with an additional IP
address in the 192.168.15.0/24 network as shown in the following.
Virtual ADX(config)#interface ethernet 2
Virtual ADX(config-if-e10000-2)#ip address 192.168.0.1 255.255.0.0
Virtual ADX(config-if-e10000-2)#ip address 192.168.15.100 255.255.0.0
Virtual ADX(config-if-e10000-2)#ip nat outside
NOTE
IP NAT is not supported if “route-only” command is globally configured on the Brocade Virtual ADX.
PAT
Dynamic NAT uses Port Address Translation (PAT). Since there is no one-to-one mapping between
private addresses and global addresses, PAT maps a client's IP address and TCP/UDP port to both
a global IP address and a TCP/UDP port. In this way, the Brocade Virtual ADX can map many private
addresses to the same public address and use TCP/UDP ports to uniquely identify the private
hosts.
PAT maps a client’s IP address and TCP or UDP port number to both an IP address and a TCP or
UDP port number. In this way, the Brocade Virtual ADX can map many private addresses to the
same public address and use TCP or UDP port numbers to uniquely identify the private hosts.
NOTE
PAT is also called overloading an inside global address.
Example
NAT is mapping the same global IP address to three different private addresses along with their
TCP or UDP ports, but uses a different TCP or UDP port number for each private address to
distinguish them. Notice that the PAT feature does not attempt to use the same TCP or UDP port
number as in the client’s packet.
Forwarding packets without NAT translation
When Brocade Virtual ADX receives a non-SYN packet for a TCP flow from an internal NAT client and
no sessions are found, then by default Brocade Virtual ADX drops that packet. Optionally, you can
forward that packets without NAT translation by entering the following command.
Virtual ADX(config)#nat-forward-no-session
Syntax: [no] nat-forward-no-session
Inside address Outside address
10.10.10.2:6000 192.168.1.2:1024
10.10.10.3:6000 192.168.1.2:1025
10.10.10.4:6000 192.168.1.2:1026