Enterasys Networks X-PeditionTM Configuring Policy Based Routing Example, NAT Port Forwarding

Configuring Policy Based Routing Example

+The above optional NAPT commands use ACL 101 for the 200.2.2.0 network and ACL 102 for the 201.2.2.0 network

XSR(config-if<F2>)#ip nat source intf-static 10.1.1.1 203.2.2.1

+The above optional command statically NATs packets from 10.1.1.1 to 203.2.2.1

NAT Port Forwarding

This scenario, as shown in Figure 5-16, illustrates NAT port forwarding. The connection is initiated by the PC at 172.20.2.1 to port 4003 on 200.2.2.1. The XSR’s static NAT table is first checked for mappings. An entry is found for 200.2.2.1 (which happens to be the interface IP address, but is not required) with port 4003 mapping it to the PC at 10.1.1.1:23. The packet is then translated and forwarded to 10.1.1.1 destined for port 23.

The reply packet from the Telnet server once again passes to the static NAT at interface F2 and is forwarded to 172.20.2.1 as being from 200.2.2.1:4003.

Figure 5-16 NAT Port Forwarding

		Inside						Outside
Runs Telnet Server at Port 23							Reply
			Telnet SYN Pkt
					DA: 172.20.2.1				172.21.2.2
			DA: 10.1.1.1
			SA: 172.20.2.1			SA: 200.2.2.1
	10.1.1.1								Internet
			Internal		External
					interface
			interface
				XSR
						F2
10.1.1.2									Request
									DA: 200.2.2.1:4003
				NAT Table					SA: 172.20.2.1 172.20.2.1

Protocol	Inside local	Inside global
	IP Address	IP Address
TCP	10.1.1.1:23	200.2.2.1:4003

Enter the following commands to enable NAT Port Forwarding:

XSR(config)#interface fastethernet2 XSR(config-if<F2>)#ip address 200.2.2.1/24

XSR(config-if<F2>)#ip nat source intf-static tcp 10.1.1.1 23 200.2.2.1 4003 XSR(config-if<F2>)#ip nat source assigned overload

Configuring Policy Based Routing Example

The following example configures PBR to forward to a next-hop router:

XSR(config)#access-list 101 permit ip 10.10.10.0 0.0.0.255 192.168.5.0 0.0.0.255

The commands below configure GigabitEthernet interface 1 with an IP address, and enable PBR with the ip policy command:

XSR(config)#interface GigabitEthernet 1

XSR(config-if<G1>)#ip address 192.168.5.1 255.255.255.0

5-44 Configuring IP