A10 NAT

• A10 outgoing NAT 分成 L3-mode 及 L4 概念來處理的 NAT

• Layer 4 概念的 outgoing NAT
  1. 將 Clinet 端的 interface 設定為監聽模式 allow-promiscuous-vip
  2. 建立將要帶出去之 NAT IP (不能為 interface IP)
  3. 將 Gateway 視為 SLB Server 建立 Real Server
  4. 分別建立該 Gateway 的 Server Group (TCP 及 UDP 分開)，並將 Gateway 的 Real Sevrer 加為 member
  5. 使用 wildcard VIP 將流量送到 Gateway，但是 no-dest-nat (不換 destination IP，只換 destination MAC 為 gateway MAC)
• Gateway IP: 10.2.2.254/24
• Source IP: 10.1.1.0/24
• NAT IP: 10.2.2.100
• Source vlan: 10

interface ve 10
 ip allow-promiscuous-vip
!
ip nat pool SNAT_IP 10.2.2.100 10.2.2.100 netmask /24
!
slb server GW_IP 10.2.2.254
   port 0  tcp
       no health-check
   port 0  udp
       no health-check
!
slb service-group GW_TCP tcp
    member GW_IP:0
!
slb service-group GW_UDP udp
    member GW_IP:0
!
slb virtual-server _wildcard_vserver 0.0.0.0
   port 0  tcp
      source-nat pool SNAT_IP
      service-group GW_TCP
      no-dest-nat
   port 0  udp
      source-nat pool SNAT_IP
      service-group GW_UDP
      no-dest-nat
   port 0  others
      source-nat pool SNAT_IP
      service-group GW_TCP
      no-dest-nat
   port 21  ftp
      source-nat pool SNAT_IP
      service-group GW_TCP
      no-dest-nat

• Gateway IP: 10.2.2.254/24
• Source IP: 10.1.1.0/24
• NAT IP: 10.2.2.100
• Source vlan: 10
• Gateway vlan: 20

interface ve 20
 ip nat outside
interface ve 10
 ip nat inside
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 any
!
ip nat pool SNAT_IP 10.2.2.100 10.2.2.100 netmask /24
!
ip nat inside source list 101 pool SNAT_IP