WIFITECHBLOG: NAT

Showing posts with label NAT. Show all posts

Network Address Translation-Configuration

Admin Friday, February 14, 2014 7:34 AM 0 nhận xét

The following sections outline the configuration steps required to enable dynamic and static NAT on an RF Switch:

1) Dynamic NAT [Section 3.1]:

2) Static NAT [Section 3.2]:

3.1 Dynamic NAT:

Dynamic NAT provides a simple way to provide Internet access for private addressed hosts by dynamically translating private addresses to a single public IP address. This allows enterprises to provide Internet access to users without having to address internal hosts with publically routable IP addresses using valuable IPv4 address space and exposing the hosts to threats.

As shown in figure 3.1, wired and WLAN clients located on management, data and guest subnets are provided with Internet access through the RF Switch using Dynamic NAT. In this example the RF Switches internal interfaces vlan10 (management) and vlan70 (guest) have been designated as NAT

Inside interfaces and the public interface vlan4094 has been designated as a NAT Outside interface.

This configuration will allow the RF Switch to translate packets received on the management and guest Inside interfaces to the Outside public IP address.

In addition a standard IP list has been created with entries to only allow NAT translation for specific IP wired and WLAN subnets. In this example the standard IP list allows the following:

1) Packets received on the management interface from local hosts in the 192.168.10.0/24 management subnet and remote hosts in the 192.168.40.0/24 data subnet will be translated.

2) Packets received on the guest interface from local hosts in the 192.168.70.0/24 guest subnet will be translated.

3) Packets received on the management interface from remote hosts in the 192.168.90.0/24 voice subnet will not be translated.

Web UI Configuration Example:

The following configuration example will demonstrate how to enable dynamic NAT for internet access for specific IP subnets using the Web UI:

1. In the menu tree select Security > NAT. Select the Interface tab then click Add.

2. In the Security > NAT > Configuration window specify the interface Type for each virtual Interfacecreated on the RF Switch. In this example the management (vlan 10) and guest (vlan 70) virtual interfaces will be designated as Inside and the Internet (vlan 4094) virtual interface will be designated as Outside. Click OK.

3. In the menu tree select Security > Firewall. Select the Configuration tab then click Add to create an ACL to tell the RF Switch which source subnets to NAT for Internet access.

4. In the Security > Firewall > Configuration window set the ACL Type to Standard IP List. Enter a unique ACL ID then click OK

5. In the Add Rule window create a rule for each subnet you wish to provide Internet access to. For

each rule set the Operation to Permit and specify the Source Mask and Source Address. In this

example the management (192.168.10.0/24), WLAN data (192.168.40.0/24) and WLAN guest

(192.168.70.0/24) subnets will be permitted Internet access. Click OK after creating each rule.

6. In the menu tree select Security > NAT. Select the Dynamic Translation tab then click Add. This will create a dynamic NAT rule translating private addresses defined in the ACL received on inside interfaces to the public outside internet vlan4094.

7. In the Security > NAT > Configuration window set the Type to Inside. Set the Access List to the access-list ID created in step 4 and set the Interface to the public outside virtual interface vlan4094. Click OK.

8. Click Save to apply and save changes

Network Address Translation - Overview

Admin 7:18 AM 0 nhận xét

Network Address Translation (NAT) provides the translation of an Internet Protocol (IP) address within one network to a different known IP address within another network. NAT functions by designating one or more interfaces as Inside while others as Outside.

· Inside – A set of networks subject to translation.

· Outside – All other addresses (typically valid public Internet addresses)

In most deployments NAT is used in conjunction with IP masquerading that hides RFC1918 private IP address space behind a single public IP addresses. NAT uses a stateful translation table to dynamically map the Inside addresses to a single Outside address and then rewrites the IP headers so that thesource IP packets appear to originate from the RF Switches Outside IP address. In the reverse path, responses from hosts through the Outside address are forwarded to the originating Inside IP address using the state information for the session in the translation table. The translation table rules and state are established dynamically and are flushed when no new traffic refreshes their state.

NAT translation can occur in both directions. Most commonly translation will occur from the Insideinterfaces to Outside interfaces providing private addressed hosts with Internet access. However static address translation can also be configured to translate specific ports on the Outside interface to a specific host a port on the Inside interface. A typical application for static NAT would be to allow hosts on the public internet to communicate with a web server behind the RF Switch that is using private IP addresses which is not reachable from the public internet

Applications:

The most common application for NAT is to provide internet access by translating private addresses (RFC 1918) with one or more public internet addresses. This application often called dynamic or many-to-oneNAT allows multiple hosts on the inside network to communicate with hosts on the public internet without exhausting valuable IPv4 space.

Other common application includes providing communications between hosts on overlapping networks during mergers and acquisitions which is common in banking and healthcare verticals. Additional common NAT applications include providing access to specific hosts and services on the inside network from hosts on the outside network allowing HTTP and other services to be served to public hosts without having to locate the server on the internet.

Restrictions:

Network Address Translation (NAT) only provides IP address translation services and does not provide firewall or filtering. The RF Switch includes a fully stateful inspection firewall which can be used with NAT to restrict which IPv4 traffic can be received and routed by the individual IP interfaces on the RF Switch.

When deploying dynamic or static NAT it is recommended that a firewall rule be created and applied to the outside interface. For example when dynamic NAT is being used, a single firewall rule can be created and applied to the outside interface to deny all inbound traffic. As the integrated firewall is fully stateful, traffic originating from hosts on the inside network will pass freely through the firewall, however traffic originating from the outside network attempting to go inside will be blocked.

When static NAT is being deployed, the firewall rule can be modified to permit inbound traffic on the outside interface for the specific ports that are being translated. For example to allow HTTP a permit rule for destination TCP port 80 could be added before the deny all rule.

For examples of how to configure the stateful inspection firewall, please reference the Wireless Firewall How-To Guide.

WIFITECHBLOG

Ads 468x60px

Popular Posts

Network Address Translation-Configuration

Network Address Translation - Overview

Recent Posts

Blog Archive

Labels

Recent Posts

Popular Posts

WIFITECHBLOG

Ads 468x60px

Popular Posts

Network Address Translation-Configuration

Network Address Translation - Overview

Social Icons

Recent Posts

Blog Archive

Labels

Recent Posts

Popular Posts