Scribd Logo
Upload

Welcome to Scribd!

  • 353 views

    Labnario Com

    Uploaded by

    Hussein Dhafan
    eNSP lab

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Labnario Com

    Uploaded by

    Hussein Dhafan
    353 views6 pages
    eNSP lab

    Original Title

    Labnario Com(1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    eNSP lab

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    353 views6 pages

    Labnario Com

    Uploaded by

    Hussein Dhafan
    eNSP lab

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 6

    15 Apr

    2015

    outbound NAT on Huawei USG5500


    Posted in Security

    What does it mean outbound NAT?


    Outbound NAT translates the source IP addresses of packets sent from a high-priority security zone to a low-priority one.
    I allowed myself to post a flowchart of configuring intranet users to access extranet through NAT (from Huawei documentation):

    It easily lets us to choose a suitable way of configuring outbound NAT. In this lab I will try to do a review of these methods.
    Let's look at the topology:

    Just forget about FTP server and focus on the bottom of the topology. We will use the FTP server in one of the next articles.
    The main requirement in this lab is to configure the firewall , to provide access to the Internet for intranet users, on network segment 10.0.0.0/24.
    The configuration of NAT for all above methods is the same. The difference lies in the configuration of NAT address group.
    Let's start!
    Set IP addresses of interfaces and add the interfaces to proper security zones:

    converted by Web2PDFConvert.com

    [SRG]display current-configuration interface GigabitEthernet


    #
    interface GigabitEthernet0/0/2
    ip address 1.1.1.1 255.255.255.0
    #
    interface GigabitEthernet0/0/3
    #
    interface GigabitEthernet0/0/3.100
    vlan-type dot1q 100
    alias GigabitEthernet0/0/3.100
    ip address 10.0.0.1 255.255.255.0
    #
    [SRG]display current-configuration | begin firewall zone
    #
    firewall zone trust
    set priority 85
    add interface GigabitEthernet0/0/3.100
    #
    firewall zone untrust
    set priority 5
    add interface GigabitEthernet0/0/2

    Configure L2 communication on the LAN switch:


    #
    vlan batch 100
    #
    interface Ethernet0/0/2
    port link-type access
    port default vlan 100
    #
    interface Ethernet0/0/3
    port link-type access
    port default vlan 100
    #
    interface GigabitEthernet0/0/1
    port link-type trunk
    port trunk allow-pass vlan 100

    Ensure that the users on network segment 10.0.0.0/24 can access the Untrust zone:
    [SRG]policy interzone trust untrust outbound
    [SRG-policy-interzone-trust-untrust-outbound]policy 1
    [SRG-policy-interzone-trust-untrust-outbound-1]policy source 10.0.0.0 mask 24
    [SRG-policy-interzone-trust-untrust-outbound-1]action permit

    And now the promised con guration of NAT . In this case one private IP address will correspond to one public IP address. To achive it, I will create NAT
    address group with No-PAT option. NAT No-PAT is also called one-to-one address translation. During the translation, the source IP address of a packet is
    translated from a private IP address into a public IP address, while the port number is not translated. It means that, when a private network host adopts
    one public IP address, this address cannot be used by another host because all the ports of public IP address are occupied.
    Create NAT address group:
    [SRG]nat address-group 1 1.1.1.20 1.1.1.25

    Con gure NAT policy for the TRUST-UNTRUST interzone, de ne the range of source IP addresses for NAT and bind the NAT policy to the previousely
    created NAT address pool:
    [SRG]nat-policy interzone trust untrust outbound
    [SRG-nat-policy-interzone-trust-untrust-outbound]policy 1
    [SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat
    [SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 10.0.0.0 mask 24
    [SRG-nat-policy-interzone-trust-untrust-outbound-1]address-group 1 no-pat

    Let's verify if it is working correctly. Just try to ping interface loopback of Internet router (5.5.5.5/32) from the both hosts:

    converted by Web2PDFConvert.com

    User_1>ping 5.5.5.5
    Ping 5.5.5.5: 32 data bytes, Press Ctrl_C to break
    From 5.5.5.5: bytes=32 seq=1 ttl=254 time=47 ms
    From 5.5.5.5: bytes=32 seq=2 ttl=254 time=46 ms
    From 5.5.5.5: bytes=32 seq=3 ttl=254 time=63 ms
    From 5.5.5.5: bytes=32 seq=4 ttl=254 time=63 ms
    From 5.5.5.5: bytes=32 seq=5 ttl=254 time=47 ms
    --- 5.5.5.5 ping statistics --5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 46/53/63 ms
    User_2>ping 5.5.5.5
    Ping 5.5.5.5: 32 data bytes, Press Ctrl_C to break
    From 5.5.5.5: bytes=32 seq=1 ttl=254 time=47 ms
    From 5.5.5.5: bytes=32 seq=2 ttl=254 time=46 ms
    From 5.5.5.5: bytes=32 seq=3 ttl=254 time=62 ms
    From 5.5.5.5: bytes=32 seq=4 ttl=254 time=46 ms
    From 5.5.5.5: bytes=32 seq=5 ttl=254 time=47 ms
    --- 5.5.5.5 ping statistics --5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 46/49/62 ms

    Check if the session entry of firewall has been created succesfully:


    [SRG]display firewall session table
    Current Total Sessions : 15
    icmp VPN:public --> public 10.0.0.11:41543[1.1.1.21:41543]-->5.5.5.5:2048
    icmp VPN:public --> public 10.0.0.10:41031[1.1.1.20:41031]-->5.5.5.5:2048
    [SRG]display firewall session table verbose
    Current Total Sessions : 50
    icmp VPN:public --> public
    Zone: trust--> untrust TTL: 00:00:20 Left: 00:00:00
    Interface: GigabitEthernet0/0/2 NextHop: 1.1.1.2 MAC: 54-89-98-5c-36-fb
    <--packets:1 bytes:60 -->packets:1 bytes:60
    10.0.0.10:50247[1.1.1.20:50247]-->5.5.5.5:2048
    icmp VPN:public --> public
    Zone: trust--> untrust TTL: 00:00:20 Left: 00:00:00
    Interface: GigabitEthernet0/0/2 NextHop: 1.1.1.2 MAC: 54-89-98-5c-36-fb
    <--packets:1 bytes:60 -->packets:1 bytes:60
    10.0.0.11:50247[1.1.1.21:50247]-->5.5.5.5:2048

    Check whether the server-map entry is successfully created:

    converted by Web2PDFConvert.com

    <SRG>display firewall server-map


    server-map item(s)
    -----------------------------------------------------------------------------No-Pat, 10.0.0.10[1.1.1.20] -> any, Zone: --Protocol: any(Appro: ---), Left-Time: 00:11:59, Addr-Pool: 1
    VPN: public -> public
    No-Pat Reverse, any -> 1.1.1.20[10.0.0.10], Zone: untrust
    Protocol: any(Appro: ---), Left-Time: --:--:--, Addr-Pool: --VPN: public -> public
    No-Pat, 10.0.0.11[1.1.1.21] -> any, Zone: --Protocol: any(Appro: ---), Left-Time: 00:11:59, Addr-Pool: 1
    VPN: public -> public
    No-Pat Reverse, any -> 1.1.1.21[10.0.0.11], Zone: untrust
    Protocol: any(Appro: ---), Left-Time: --:--:--, Addr-Pool: --VPN: public -> public

    Now we can create another NAT address group with only one address available to check NAPT :
    #
    nat address-group 2 1.1.1.30 1.1.1.30
    #
    nat-policy interzone trust untrust outbound
    policy 1
    action source-nat
    policy source 10.0.0.0 mask 24
    address-group 2
    [SRG]display firewall session table
    Current Total Sessions : 53
    icmp VPN:public --> public 10.0.0.10:54605[1.1.1.30:2067]-->5.5.5.5:2048
    icmp VPN:public --> public 10.0.0.11:55117[1.1.1.30:2070]-->5.5.5.5:2048

    And finally NAT easy IP:


    #
    nat-policy interzone trust untrust outbound
    policy 1
    action source-nat
    policy source 10.0.0.0 mask 24
    easy-ip GigabitEthernet0/0/2
    #
    [SRG]display firewall session table
    Current Total Sessions : 50
    icmp VPN:public --> public 10.0.0.10:34127[1.1.1.1:17133]-->5.5.5.5:2048
    icmp VPN:public --> public 10.0.0.11:34383[1.1.1.1:17134]-->5.5.5.5:2048

    If the interface IP address is adopted as the public IP address directly, no NAT address pool is required.
    Tags: Huawei CLI, easy IP, NAT, Huawei firewall, Huawei USG5500, NAPT

    converted by Web2PDFConvert.com

    COMMENTS

    Sort by Oldest First

    Sort by Latest First

    No comments found

    LEAVE YOUR COMMENTS

    Login to post a comment


    Username

    Register

    Password

    Remember me

    Forgot password

    Login

    Post comment as a guest


    Name (Required):

    Email:

    Website:

    Your comments are subjected to administrator's moderation.


    Agree to terms and condition.

    Submit Comment

    Powered by Komento

    Categories
    Basic Con guration
    Cheat Sheets
    Command Line
    Ethernet
    FAQ
    General
    How To
    IP Routing
    IP Services
    Multicast
    converted by Web2PDFConvert.com

    QoS
    Reliability
    Security
    System Management
    VPN
    WAN

    Latest Posts
    NAT server on Huawei USG5500
    outbound NAT on Huawei USG5500
    https--->webUI--->Huawei Secospace USG6300
    VTY access to Secospace USG6300
    CPU usage alarm threshold

    Built with HTML5 and CSS3


    - Copyright 2014 Labnario
    Powered by Warp Theme Framework

    converted by Web2PDFConvert.com

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy