Extreme Networks 200 Series 10

Summit 200 Series Switch Installation and User Guide 135

10 Network Address Translation (NAT)

This chapter covers the following topics:

•Overview on page 135

•Internet IP Addressing on page 136

•Configuring VLANs for NAT on page 136

•Configuring NAT on page 138

•Configuring NAT Rules on page 138

•Creating NAT Rules on page 139

•Displaying NAT Settings on page 141

•Disabling NAT on page 142

Overview

NAT is a feature that allows one set of IP addresses, typically private IP addresses, to be converted to

another set of IP addresses, typically public Internet IP addresses. This conversion is done transparently

by having a NAT device rewrite the source IP address and Layer 4 port of the packets.

Figure 24: NAT Overview

EW_07

NAT

switch

Outgoing

Incoming

Outgoing

Incoming

Internet

Inside Outside

Private

Network

Contents

Main Page Contents Preface Chapter 1 Summit 200 Series Switch Overview Chapter 2 Switch Installation Chapter 3 ExtremeWare Overview Chapter 4 Accessing the Switch Chapter 5 Managing the Switch Chapter 6 Configuring Ports on a Switch Chapter 7 Virtual LANs (VLANs) Chapter 8 Forwarding Database (FDB) Chapter 9 Access Policies Chapter 10 Network Address Translation (NAT) Chapter 11 Ethernet Automatic Protection Switching Chapter 12 Quality of Service (QoS) Chapter 13 Status Monitoring and Statistics Chapter 14 Spanning Tree Protocol (STP) Chapter 15 IP Unicast Routing Chapter 16 Interior Gateway Routing Protocols Chapter 17 IP Multicast Routing and IGMP Snooping Chapter 18 Configuring Stacked Switches Chapter 19 Using ExtremeWare Vista on the Summit 200 Appendix A Safety Information Appendix B Technical Specifications Appendix C Supported Standards Appendix D Software Upgrade and Boot Options Appendix E Troubleshooting Index Index of Commands Page Preface Introduction Conventions Related Publications 1 Summit 200 Series Switches Summary of Features Summit 200-24 Switch Physical Features Summit 200-24 Switch Front View Console Port Port Connections Summit 200-24 Switch Uplink Redundancy Full-Duplex Summit 200-24 Switch LEDs Table 3 describes the light emitting diode (LED) behavior on the Summit 200-24 switch. Table 3: Summit 200-24 switch LED behavior Summit 200-24 Switch Rear View Summit 200-48 Switch Physical Features Summit 200-48 Switch Front View Console Port Port Connections Gigabit Ethernet Port Failover Speed Summit 200-48 Switch Uplink Redundancy Full-Duplex Summit 200-48 Switch LEDs Table 4 describes the LED behavior on the Summit 200-48 switch. Summit 200-48 Switch Rear View Figure 4 shows the rear view of the Summit 200-48 switch. Figure 4: Summit 200-48 switch rear view Power Socket Table 4: Summit 200-48 switch LED behavior Serial Number Mini-GBIC Type and Hardware/Software Support Mini-GBIC Type and Specifications SX Mini-GBIC Specifications LX Mini-GBIC Specifications ZX Mini-GBIC Specifications Long Range GBIC System Budgets Page 2 Determining the Switch Location Following Safety Information Installing the Switch Rack Mounting Free-Standing Desktop Mounting of Multiple Switches Installing or Replacing a Mini-Gigabit Interface Connector (Mini-GBIC) Safety Information Preparing to Install or Replace a Mini-GBIC Removing and Inserting a Mini-GBIC Removing a Mini-GBIC Inserting a Mini-GBIC Creating a Stack Connecting Equipment to the Console Port Table 10: Console Connector Pinouts Powering On the Switch Checking the Installation Logging In for the First Time Page Page 3 Summary of Features Virtual LANs (VLANs) Spanning T ree Pr otocol Quality of Service Unicast Routing Load Sharing ESRP-Aware Switches Software Licensing Feature Licensing Edge Functionality Advanced Edge Functionality Enabling the Advanced Edge Functionality Security Licensing for Features Under License Control SSH2 Encryption Software Factory Defaults Page Page 4 Understanding the Command Syntax Syntax Helper Command Completion with Syntax Helper Abbreviated Syntax Command Shortcuts Summit 200 Series Switch Numerical Ranges Line-Editing Keys Command History Common Commands Table 14: Common Commands Table 13: Line-Editing Keys (continued) Table 14: Common Commands (continued) Configuring Management Access User Account A user-level account has viewing access to all manageable parameters, with the exception of: Table 14: Common Commands (continued) Administrator Account Prompt Text Default Accounts Changing the Default Password Creating a Management Account Viewing Accounts Deleting an Account Domain Name Service Client Services Checking Basic Connectivity Ping Traceroute Page Page 5 Using the Console Interface Using Telnet Connecting to Another Host Using Telnet Configuring Switch IP Parameters Using a BOOTP Server Manually Configuring the IP Settings Disconnecting a Telnet Session Controlling Telnet Access Using Secure Shell 2 (SSH2) Enabling SSH2 Using SNMP Accessing Switch Agents Supported MIBs Configuring SNMP Settings Page Displaying SNMP Settings Authenticating Users RADIUS Client Per-Command Authentication Using RADIUS Configuring RADIUS Client RADIUS RFC 2138 Attributes Table 19: RADIUS Commands (continued) RADIUS Server Configuration Example (Merit) RADIUS Per-Command Configuration Example Page Configuring TACACS+ Table 20: TACACS+ Commands Network Login Web-Based and 802.1x Authentication Co-existence of Web-Based and 802.1x Authentication Comparison of Web-Based and 802.1x Authentication Authentication Methods Campus and ISP Modes User Accounts Interoperability Requirements Supplicant Side Authentication Server Side Multiple Supplicant Support Exclusions and Limitations Configuring Network Login Web-Based Authentication User Login Using Campus Mode Page DHCP Server on the Switch Displaying DHCP Information Displaying Network Login Settings Disabling Network Login Additional Configuration Details Network Login Configuration Commands Displaying Network Login Settings Disabling Network Login Using EAPOL Flooding Using the Simple Network Time Protocol Configuring and Using SNTP Page Table 25: Greenwich Mean Time Offsets (continued) SNTP Configuration Commands Table 26 describes SNTP configuration commands. SNTP Example Table 26: SNTP Configuration Commands Table 25: Greenwich Mean Time Offsets (continued) Page 6 Enabling and Disabling Switch Ports Configuring Switch Port Speed and Duplex Setting Turning Off Autonegotiation for a Gigabit Ethernet Port Turning Off Autopolarity Detection for an Ethernet Port Switch Port Commands Table 27: Switch Port Commands (continued) Load Sharing on the Switch Table 27: Switch Port Commands (continued) Load-Sharing Algorithms Configured IP Address-Based Load Sharing Configuring Switch Load Sharing Load-Sharing Example Load-Sharing on a Summit 200 Series Switch Verifying the Load-Sharing Configuration Switch Port-Mirroring Por t-Mir ro rin g Com mands Port-Mirroring Example Setting Up a Redundant Gigabit Uplink Port Extreme Discovery Protocol EDP Commands 7 Overview of Virtual LANs Benefits Types of VLANs Port-Based VLANs Spanning Switches with Port-Based VLANs Sales Accounting Engineering Ta g ge d V LA Ns Uses of Tagged VLANs Assigning a VLAN Tag *Tagged Ports MMSS Sales Marketing Mixing Port-Based and Tagged VLANs VLAN Names Default VLAN Renaming a VLAN Configuring VLANs on the Switch VLAN Configuration Commands VLAN Configuration Examples Displaying VLAN Settings MAC-Based VLANs MAC-Based VLAN Guidelines MAC-Based VLAN Limitations MAC-Based VLAN Example Timed Configuration Download for MAC-Based VLANs Page Page 8 Overview of the FDB FDB Contents FDB Entry Types How FDB Entries Get Added Associating a QoS Profile with an FDB Entry Configuring FDB Entries To configure entries in the FDB, use the commands listed in Table 31. FDB Configuration Examples The following example adds a permanent entry to the FDB: Table 31: FDB Configuration Commands Displaying FDB Entries On a Non-stacked Switch On a Stacked Set of Switches Page Page 9 Overview of Access Policies Access Control Lists Rate Limits Routing Access Policies Using Access Control Lists Access Masks Access Lists Rate Limits How Access Control Lists Work Access Mask Precedence Numbers Specifying a Default Rule The permit-established Keyword Adding Access Mask, Access List, and Rate Limit Entries Maximum Entries Deleting Access Mask, Access List, and Rate Limit Entries Verifying Access Control List Configurations Access Control List Commands Table 32: Access Control List Configuration Commands Page Table 32: Access Control List Configuration Commands (continued) Access Control List Examples Using the Permit-Established Keyword Page Page Example 2: Filter ICMP Packets 10.10.10.100 10.10.20.100 Example 3: Rate-limiting Packets SYN SYN Using Routing Access Policies Creating an Access Profile Configuring an Access Profile Mode Adding an Access Profile Entry Specifying Subnet Masks Deleting an Access Profile Entry Applying Access Profiles Routing Access Policies for RIP Examples Routing Access Policies for OSPF Making Changes to a Routing Access Policy Removing a Routing Access Policy Routing Access Policy Commands Table 33: Routing Access Policy Configuration Commands (continued) 10 NAT switch Internet Inside Outside Private Network Internet IP Addressing Configuring VLANs for NAT NAT Modes Static Mapping Dynamic Mapping Port-mapping Auto-constraining Configuring NAT Configuring NAT Rules Creating NAT Rules Creating Static and Dynamic NAT Rules Static NAT Rule Example Dynamic NAT Rule Example Creating Portmap NAT Rules Creating Auto-Constrain NAT Rules Auto-Constrain Example Advanced Rule Matching Destination Specific NAT L4-Port Specific NAT Displaying NAT Settings Page 11 Overview of the EAPS Protocol Direction of health-check message Master node Secondary port is logically blocked S 4 S 5 S 6 S S 2 S 1 SP Optimizing Interoperability Fault Detection and Recovery PS S 4 S 5 S S 3 S 2 S 1 Restoration Operations Summit 200 Series Switches in Multi-ring Topologies LHS ring RHS ring Commands for Configuring and Monitoring EAPS Creating and Deleting an EAPS Domain Defining the EAPS Mode of the Switch Configuring EAPS Polling Timers Configuring the Primary and Secondary Ports Configuring the EAPS Control VLAN Configuring the EAPS Protected VLANs Enabling and Disabling an EAPS Domain Enabling and Disabling EAPS Unconfiguring an EAPS Ring Port Displaying EAPS Status Information Page Table 37: show eaps Display Fields Table 37: show eaps Display Fields (continued) Page 12 Overview of Policy-Based Quality of Service Applications and Types of QoS Video Applications Critical Database Applications Web Browsing Applications File Server Applications Configuring QoS for a Port or VLAN Traffic Groupings Access List Based Traffic Groupings MAC-Based Traffic Groupings Permanent MAC addresses Dynamic MAC Addresses Blackhole MAC Address Explicit Class of Service (802.1p and DiffServ) Traffic Groupings Configuring 802.1p Priority Observing 802.1p Information 802.1p Commands Configuring 802.1p Priority Replacing 802.1p Priority Information Configuring DiffServ Observing DiffServ Information Changing DiffServ Code point assignments in the QoS Profile Replacing DiffServ Code Points DiffServ Examples Physical and Logical Groupings Source port VLAN Verifying Physical and Logical Groupings Verifying Configuration and Performance QoS Monitor Real-Time Performance Monitoring Displaying QoS Profile Information Modifying a QoS Configuration Traffic Rate-Limiting Dynamic Link Context System DLCS Guidelines DLCS Limitations DLCS Commands Page 13 Status Monitoring Page Port Statistics Port Errors Port Monitoring Display Keys Setting the System Recovery Level Logging Local Logging Real-Time Display Remote Logging Logging Configuration Changes Logging Commands RMON About RMON RMON Features of the Switch Statistics History Alarms Events Configuring RMON Event Actions Page 14 Overview of the Spanning Tree Protocol Spanning Tree Domains Defaults STPD BPDU Tunneling STP Configurations Page Configuring STP on the Switch Page Table 52: STP Configuration Commands (continued) STP Configuration Example Displaying STP Settings Disabling and Resetting STP Page 15 Overview of IP Unicast Routing Router Interfaces Populating the Routing Table Dynamic Routes Static Routes Multiple Routes IP Route Sharing Proxy ARP ARP-Incapable Devices Proxy ARP Between Subnets Relative Route Priorities Configuring IP Unicast Routing Verifying the IP Unicast Routing Configuration IP Commands Table 56 describes the commands used to configure the IP route table. Table 56: Route Table Configuration Commands Table 55: Basic IP Commands (continued) Table 57 describes the commands used to configure IP options and the ICMP protocol. Table 57: ICMP Configuration Commands Table 56: Route Table Configuration Commands (continued) Table 57: ICMP Configuration Commands (continued) Routing Configuration Example Figure 34: Unicast routing configuration example Displaying Router Settings To display settings for various IP routing components, use the commands listed in Table 58. Resetting and Disabling Router Settings Table 58: Router Show Commands Table 59: Router Reset and Disable Commands Configuring DHCP/BOOTP Relay Verifying the DHCP/BOOTP Relay Configuration UDP-Forwarding Configuring UDP-Forwarding UDP-Forwarding Example ICMP Packet Processing UDP-Forwarding Commands 16 RIP Versus OSPF Overview of RIP Routing Table Split Horizon Pois on Revers e Tr i g ge re d U pd a t es Route Advertisement of VLANs Overview of OSPF Link-State Database Database Overflow Opaque LSAs Areas Backbone Area (Area 0.0.0.0) Stub Areas Not-So-Stubby-Areas (NSSA) Normal Area Virtual Links ABR ABR Virtual link Area 2 Area 1 Area 0 Point-to-Point Support Virtual link ABR 1 ABR 2 Area 1 Area 0 Area 3 Area 2 Route Re-Distribution Configuring Route Re-Distribution Re-Distributing Routes into OSPF Re-Distributing Routes into RIP OSPF Timers and Authentication Configuring RIP Table 63 describes the commands used to configure RIP. Table 63: RIP Configuration Commands Table 63: RIP Configuration Commands (continued) RIP Configuration Example Displaying RIP Settings Resetting and Disabling RIP Configuring OSPF Table 66 describes the commands used to configure OSPF. Table 66: OSPF Configuration Commands Page Page Page Configuring OSPF Wait Interval Displaying OSPF Settings OSPF LSD Display Resetting and Disabling OSPF Settings Page 17 IGMP Snooping IP Multicast Routing Overview PIM Sparse Mode (PIM-SM) Overview Configuring PIM-SM Enabling and Disabling PIM-SM PIM-SM Commands Table 69 summaries the PIM-SM commands available on the Summit 200: Table 69: PIM-SM Commands IGMP Overview Configuring IGMP and IGMP Snooping Displaying IGMP Snooping Configuration Information Clearing, Disabling, and Resetting IGMP Functions Table 71: IGMP Disable and Reset Commands Table 70: IGMP and IGMP Snooping Commands (continued) Page 18 Introducing Stacking Configuring a Stack Creating a Backup Configuration Enabling the Master Enabling a Stack Member Stack Discovery Configuring Ports and VLANS on Stacks Page Recovering a Stack Changing a Stack Configuration Stack Configuration Commands Table 72 summarizes the commands used to configure a stack. Table 72: Stack Configuration Commands Running Features on a Stack Testing Images for a Stack Using the Console for Managing the Stack Setting the Command Prompt 19 on the Summit 200 ExtremeWare Vista Overview Setting Up Your Browser Accessing ExtremeWare Vista Page Navigating within ExtremeWare Vista Browser Controls Status Messages Standalone Buttons Configuring the Summit 200 using ExtremeWare Vista IP Forwarding License OSPF Configure Global OSPF Parameters Create or Delete an OSPF Area Configure an Area Range Configure an OSPF Area Configure an IP interface for OSPF Page Page Configure OSPF Authentication Ports Page RIP Configure Global RIP Parameters Configure RIP for an IP interface Page SNMP System Group Configuration Trap Information Spanning Tree Page Page Page Switch User Accounts Virtual LAN Creating and Deleting a VLAN Renaming a VLAN Configuring a VLAN Reviewing ExtremeWare Vista Statistical Reports Event Log FDB IP ARP IP Configuration Global IP Configuration Statistics Router Interface Statistics IP Route IP Statistics Global IP Statistics Global ICMP Statistics Router Interface IP Statistics Ports Port Collisions Por t Errors Port Utilization RIP Switch Locating Support Information Help TFTP Download Page Page Page Page A Important Safety Information Power Power Co rd Connections Lithium Battery Page Page B Summit 200-24 Switch Page Page Summit 200-48 Switch Page Page C ExtremeWare supports the following standards for the Summit 200 series switch. Management and Security Standards and Protocols Page D Downloading a New Image Rebooting the Switch As an Non-stacked Switch As a Stacked Set of Switches Saving Configuration Changes Returning to Factory Defaults Using TFTP to Upload the Configuration Using TFTP to Download the Configuration Downloading a Complete Configuration Downloading an Incremental Configuration Scheduled Incremental Configuration Download Remember to Save Upgrading and Accessing BootROM Upgrading BootROM Accessing the BootROM menu Boot Option Commands Table 74: Boot Option Commands (continued) E LEDs Using the Command-Line Interface Port Configuration VLANs STP Debug Tracing TOP Command Contacting Extreme Technical Support Page Index Numerics A permit-established permit-established B D E F G H I J K L M N O P permit-established ping R S Page T traceroute U V W Page Index of Commands C Page D E H L N P Q T U