NAT technology application of Huawei 3COM vro

NAT is set on the Huawei 3COM router, which improves network security and solves the problem of insufficient public network IP addresses, so that the router can act as a NAT when routing data packets. Today, we will teach you detailed configuration instructions.

1. Network Environment:

The IP address of a vro 3COM on the PC is 10.83.91.0/255.255.254.0. That is to say, the IP address is two class C addresses, ranging from 10.83.91.0 to 10.83.92.255. The vro uses the 2621 product produced by Huawei, which has two ethernet statements for use. Port 1 connects to the Internet and the IP address is a public IP address. Port 2 connects to the Intranet and the IP address is a private IP address.

2. configuration process:

The company wants to configure the NAT Function on the vro to allow users in the Intranet to access the Internet through NAT. 2621 the Internet interface IP address is 61.51.3.103 (Public IP address) and the Intranet interface IP address is 10.83.91.254. The NAT configuration command is as follows. I will describe it in detail one by one.

"Acl 1"
Command explanation: Set an access control list with the list number 1.

"Rule normal permit source 10.83.91.254 0.0.1.255"
Command explanation: Add Rules for the access control list to allow all IP addresses in the 10.83.91.254/255.255.254.0 CIDR block to pass. Note that the reverse mask format 0.0.1.255 is used in the command. In fact, it indicates that the subnet mask is 255.255.254.0.

"Nat outbound 1 interface"
Command Description: Set the NAT egress interface, that is, the Internet interface, to enable the NAT Function. The host that allows NAT is the address specified in Access Control List 1.

Tip: When the NAT feature is enabled on a Huawei router, an EASYIP technology is used to map Intranet IP addresses to the IP addresses of the router's Internet interface, so that multiple Intranet IP addresses correspond to one public IP address, this technology can save one public IP address in quantity.

3. ancillary functions:

Some companies may have specialized WWW servers or MAIL servers. For these servers, NAT cannot be used for ing, because after NAT, if you do not use other methods such as port ing, the Internet users cannot access the WWW and MAIL servers normally. In this case, you can use the nat server command on the vro to solve this problem and declare the host. For example, if the ip address of the above company's WWW server is 10.83.91.2 in the Intranet and the public address is 61.51.3.104, you can use the following command to declare: "nat server global 61.51.3.104 any inside 10.83.91.2 any ip ".

Summary:
After configuring NAT on Huawei 3COM, the network runs very stably. However, pay attention to the following points during configuration. First, you must set the relevant rules when setting the access control list, if the ACL is null or the rule uses permit any, the NAT becomes invalid because the router does not know which interface is a NAT Internet interface and which is an intranet interface.