Patton electronic 3086 manual Enabling NAT, 130

Page 130

7 • NAT (Network Address Translation)	Model 3086 G.SHDSL Integrated Access Device User Guide

Introduction

The basic steps for configuring NAT are:

1.Enable NAT between the internal and external interfaces of the firewall.

2.Create global addresses which will be added to the global pool of IP addresses on the WAN interface.

3.Create a reserved mapping between a global IP address and the IP address of an internal PC.

A Global Address Pool is a pool of addresses seen from the outside network. Each external interface creates a Global Address Pool with a single address—the address assigned to that interface. For outbound sessions, an address is picked from a pool by hashing the source IP address for a pool index and then hashing again for an address index. For inbound sessions, it is necessary to create a reserved mapping.

A reserved mapping is used so that NAT knows where to route packets on inbound sessions. The reserved map- ping will map a specific global address and port to an inside address and port. Reserved mappings can also be used so that different inside hosts can share a global address by mapping different ports to different hosts. For example, Host A is an FTP server and Host B is a web server. By mapping the FTP port to Host A and the HTTP port to Host B, both insides hosts can share the same global address. Setting the protocol number to 255 (0xFF) means that the mapping will apply to all protocols. Setting the port number to 65535 (0xFFFF) for TCP or UDP protocols means that the mapping will apply to all port numbers for that protocol.

Some applications embed address and/or port information in the payload of the packet. The most notorious of these is FTP. For most applications, it is sufficient to create a trigger with address replacement enabled. However there are three applications for which a specific ALF is provided: FTP, NetBIOS, and DNS.

Enabling NAT

The configuration of NAT in this example follows on the preceding configuration completed in the chapter, “Security.”

1.Go to the “Security Interface Configuration” page by clicking on Security under Configuration in the menu.

2.Click on Enable NAT to internal interfaces in the table, Security Interfaces. NAT is now enabled between the internal (LAN) and the external (WAN) interfaces of the firewall.

130	Introduction

Image 130

Contents Shdsl Integrated Access Device Patton Electronics Company, Inc Contents Basic Application Configurations Contents Specialized Configurations 113 Contacting Patton for assistance 143 Cable Recommendations 157 Contents Page Audience About this guideStructure Precautions Safety when working with electricity Factory default parametersAbout this guide General conventions Typographical conventions used in this documentMouse conventions Chapter contents General InformationGeneral attributes Model 3086 G.SHDSL IAD overviewModel 3086 G.SHDSL IAD overview TDM Interface Shdsl CharacteristicsEthernet Protocol supportATM Protocols PPP SupportManagement Security ModelWAN DSL Power connector Rear panel connectors and switchesConsole port outlined in red Ethernet port outlined in green RJ-11/4 DSL line port uses pins 2 and 3 of the RJ-11 portLine port outlined in yellow Product Overview Product Overview Applications OverviewIP/FR and Voice over DSL Internet/Extranet AccessIP/FR and TDM Access Product OverviewMetro Intranet Access Quick Start Installation Installing the AC power cord Hardware installationWhat you will need Connecting network cables Quick Start InstallationIP address Quick Start modification Web Operation and ConfigurationPC Configuration IP address has now been successfully changedModel 3086 home page displays see Figure Model 3086 menu structure is shown in onModel 3086 Menu Structure Basic Application Configurations Basic Application Configurations IPoA Routed RFC Introduction Routed WAN Services Bridged WAN Services TDM PortRear panel power and interface connectors X.21 Ports Connecting the 3086 serial port to a DTEConnecting the 3086 serial port to a DCE InterfacesConfiguring the V.35 or X.21 port via DIP switches X.21 PortsDIP switches location Switch Bank S2 Switch Position Function Factory Default Selected OptionSwitch Bank S3 T1 Interface T1 Interface ConnectionT1 Interface Configuration DIP Switch ConfigurationData Rate kbps Figuration only Web Interface Configuration Line Code The 3086 T1 interface uses B8ZSE1 Interface E1 Interface ConnectionDescription of S2 options follows the table E1/CRC S3-8 Setting Web Interface Configuration CLI configuration Using the 3086 as a simple modem TDM data over DSLCLI configuration Wait for configuration saved message… Saving configuration… Circuit ID Web browser configurationClear Error Counters Intended DSL Data RateDSL Rate Number of i Bit Intended Serial Interface Data RateTerminal Type TDM Plus Ethernet Traffic Assigning bandwidth to serial and Ethernet ports Selecting PCM modeSelecting the DSL link speed Central or Remote terminal Master/SlaveFor 3086 B type For 3086 a at the prompt typeSelect between Annex a and Annex B To select Annex B type Circuit ID Intended Serial Interface Data Rate Interface Type Two stand-alone units directly connected Using the 3086 in Routed or Bridged applicationsModel 3086 Remote Configuration Steps PPPoH Bridged Ethernet extension Hdlc Pppoh BridgedLeave User name and Password blank. Click on Apply Model 3086 Central Configuration Steps PPPoH Bridged Model 3086 Remote Configuration Steps PPPoH Routed Network Extension HDLC-PPPoH RoutedModel 3086 G.SHDSL Integrated Access Device User Guide Click on Configure Basic Application Configurations Model 3086 Central Configuration Steps PPPoH Routed Using the 3086 in Routed or Bridged applications RFC 1483 Bridged Configuration Bridged application configurations to a DslamDslam Connections with remote CPE units Model 3086 Remote Configuration Steps RFC 1483 Bridged Model 3086 Central Configuration Steps RFC 1483 Bridged PPPoH Bridged Configuration Dslam Connections with remote CPE units Model 3086 Central Configuration Steps PPPoH Bridged PPPoA Bridged RFC 2364 Configuration Model 3086 Remote Configuration Steps PPPoA BridgedModel 3086 CentralConfiguration Steps PPPoA Bridged VPI = VCI = LLC header mode = off Hdlc header mode = offModel 3086 Remote Configuration Steps RFC 1483 Routed Routed application configurations to a DslamRFC 1483 Routed Model 3086 G.SHDSL Integrated Access Device User Guide Basic Application Configurations Model 3086 Central Configuration Steps RFC 1483 Routed One IP interface was called ip1 with an IP addressIp set interface ip1 ipaddress 192.168.100.2 Dslam Connections with remote CPE units Basic Application Configurations PPPoH Routed Ip set interface ip1 ipaddress 192.168.100.2 Dslam Connections with remote CPE units Basic Application Configurations Model 3086 Central Configuration Steps PPPoH Routed Basic Application Configurations Basic Application Configurations Model 3086 Remote-Client Configuration Steps PPPoA Routed PPPoA Routed RFCUser Namefred Passwoodfredspass Click on Configure ChapBasic Application Configurations Dslam Connections with remote CPE units Model 3086 Central-Server Configuration Steps PPPoA Routed 100 101 Local IP Magic Number MRU 102103 104 105 106 IPoA Routed RFC Model 3086 Remote Configuration Steps IPoA Routed107 108 109 110 VPI0 VCI700 WAN IP address Click on Apply Model 3086 Central Configuration Steps IPoA Routed111 112 Specialized Configurations RIP and RIPv2 Static Route IP ConfigurationsRouter Dhcp Server and RelaySpecialized Configurations 115DNS Client 116DNS Relay Mode 117IP Configurations Security Configuring the IAD 120Security Configuring the security interfaces121 Deleting a Firewall Policy 122Firewall Policies Enabling the FirewallFirewall Portfilters Firewall policy named item0 is now deletedSecurity Triggers 124125 Intrusion Detection System IDS Scan Attack Block DurationDefault = 86400 seconds126 127 Intrusion Detection System IDS NAT Network Address Translation Enabling NAT 130NAT Network Address Translation Global address pool and reserved map131 132 Monitoring Status Status LEDs 134Diagnostics Procedure Software UpgradesConfiguration PingOperating Remote Digital Loopback RDL-DSL Loop DiagnosticsOperating Local Analog Loopback LAL-Serial Port Loop 137Network Loop T1/E1 Diagnostics138 T1/E1 Local Loop 139QRSS-BIT Error Rate Diagnostics 140Transceiver Status AlarmsT1/E1 connection Status FDL statistics T1 onlyBIT Error Rate V.52 Diagnostics 142Contacting Patton for assistance Contact information Warranty coverageOut-of-warranty service Returns for creditShipping instructions Return for credit policyRMA numbers Contacting Patton for assistancePage Appendix a Compliance information Radio and TV Interference FCC Part SafetyCompliance CE Declaration of ConformityIndustry Canada Notice Authorized European RepresentativeFCC Part 68 Acta Statement 149150 Appendix B Specifications Ethernet General CharacteristicsShdsl Characteristics 15264K/G.703 Port 3086/RIF Model Sync Serial InterfaceT1/E1 Interface 3086/RIK and RIT models only Protocol SupportManagement PPP SupportATM Protocols 154Security DimensionsPower and Power Supply Specifications Compliance Standard Requirements156 Appendix C Cable Recommendations Adapter DSL CableEthernet Cable Foot 3 m, RJ-11/RJ-11 refer to RJ-11non-shielded port onAppendix D Physical Connectors RJ-11 non-shielded port Assuming the MDI-X switch is in the out positionRJ-45 shielded 10/100 Ethernet port RJ-45 non-shielded RS-232 console port EIA-561Physical Connectors 35 M/34 Connector35 DB-25 Female Connector Serial portIEC 320 connector two prong Power input21 DB-15 Connector E1/T1 RJ-48C Connector 162Appendix E Command Line Interface CLI Operation 163Local VT-100 emulation CLI TerminologyProduces a list of numbered transport objects Remote TelnetThen Using the ConsoleCommand Line Interface CLI Operation 165Adding new users Administering user accountsSetting user passwords Following information is returnedControlling user access Changing user settingsControlling login access Shdsl CommandsFor CPE remote unit To establish the DSL link168 169 170 Appendix F Interworking Functions Information Interworking Functions Information Frame Relay Local Management Interface LMI Configuration OptionsManagementType Default Value nomaintenance 173T392Value Default Value MgtAutoStart Default Value FalseT391Value Default Value FullReportCycle Default ValueCommand lmi show CLI Configuration MethodsShow current configuration Set configuration variableFRS Configuration Options Frame Relay Service Interworking FRF.8Web Configuration Methods DE MappingFecn Mapping Translation Mode177 FRS Name 178Show one of the eight groups CLI Configuration MethodCommand frs set group # variable value Set variable attributes on a specified groupFRS Overview Screen Set variable attributes on a specified channel180 Group/Channel Level Configuration Screen 181Frame Relay Network Interworking FRF.5 FRN Configuration Options182 Port Level Configuration Options 183Channel Level Configuration Options 184Show detailed information about a specific port CLI Configuration Methods for Port Level ManagementList all ports available to the system 185Understanding the Channel Level View Command frn set port# variable valueConfiguration Management of the Channel Level Variables 186Command frn set port# channel # variable value Set Configuration Variables associated with the Channels187 Port Level Information Screen 188Packet Information Screen Channel Level Information Screen189 Frame Relay CLI Configuration Options Frame Relay Configuration OptionsFrame Relay Ethernet Based Operations List all active Frame Relay Channels Clear all Frame Relay TransportsDelete the specified transport 191Configuration Variables Available Serial Interface ConfigurationWeb Based Configuration of the Frame Relay Channel Clock ModeGain help about the Serial Interface Show current configuration settings193 Ping and Trace Route Web Interface ConfigurationsPing commands from the CLI Interface 194Start Trace Route ip traceroute start Trace Route from the CLI InterfaceDefine Usage ip traceroute 195Restore Configuration Backup and Restore FeaturesBackup Configuration Ping and traceroute from the web interface

Related manuals

Manual 2 pages 38.76 Kb