Brocade Communications Systems 12.4.00a Enabling IP NAT , Enabling static NAT redundancy

106 ServerIron ADX Security Guide
53-1002440-03
Redundancy
4
The new protocol is similar to the symmetric VIP protocol and uses any L2 link to exchange the NAT
PDUs. Both ServerIronADXs will run a “symmetric VIP like” protocol to report and receive ownership
(similar to the VLAN AD protocol in symmetric SLB). When one ServerIron ADX goes down, the peer
ServerIron ADX wil l become the maste r for that NAT IP (in case of static NAT) or NAT pool (i n case of
dynamic NAT). However, the NAT IP/NAT pool ownership is used only to decide which ServerIronADX
responds to the ARP request for the NAT IP. Both ServerIronADXs are allowed to use the NAT IP in
keeping with the design for symmetric VIP (sym-active SLB).
The global ip policy dependency is as follows:
•SLB — not needed
•IP NAT — not needed
•TCS — An ip policy must be defined. Without it, caching will not work.
Enabling IP NAT
When a ServerIron ADX is configured with Switch code, NAT is enabled globally but when it is
configured with Router Code, it is enabled per-interface.
NOTE
ServerIron ADX ADX does not support IP NAT inside and outside on the same physical interface.
Enabling IP NAT globally
The following command enables IP NAT globally.
ServerIronADX(config)# ip nat inside
Syntax: [no] ip nat inside
Enabling IP NAT per-interface
When enabled per-interface, IP NAT must be enabled exclusively “inside” or “outside” on a physical
or virtual interface as shown in the following example.
ServerIronADX(config)# interface ethernet 1/5
ServerIronADX(config-if-e1000-1/5) ip nat inside
Syntax: [no] ip nat [inside | outside]
The inside parameter configures the interface as an IP NAT inside interface.
The outside parameter configures the interface as an IP NAT outside interface.
Enabling static NAT redundancy
To enable static NAT redundancy, enter the ip nat inside source static command such as the
following.
ServerIronADX(config)# ip nat inside source static 10.10.10.10 63.32.23.1 2
Syntax: ip nat inside source static <ip-addr1> <ip-addr2> <priority-value>
The existing ip nat inside command has been extended to include a <priority-value>, which is used
to determine the owner of the NAT IP address.