A10 NAT

  • A10 outgoing NAT 分成 L3-mode 及 L4 概念來處理的 NAT

Wildcard outgoing NAT

  • Layer 4 概念的 outgoing NAT
    1. 將 Clinet 端的 interface 設定為監聽模式 allow-promiscuous-vip
    2. 建立將要帶出去之 NAT IP (不能為 interface IP)
    3. 將 Gateway 視為 SLB Server 建立 Real Server
    4. 分別建立該 Gateway 的 Server Group (TCP 及 UDP 分開),並將 Gateway 的 Real Sevrer 加為 member
    5. 使用 wildcard VIP 將流量送到 Gateway,但是 no-dest-nat (不換 destination IP,只換 destination MAC 為 gateway MAC)
  • Gateway IP: 10.2.2.254/24
  • Source IP: 10.1.1.0/24
  • NAT IP: 10.2.2.100
  • Source vlan: 10
interface ve 10
 ip allow-promiscuous-vip
!
ip nat pool SNAT_IP 10.2.2.100 10.2.2.100 netmask /24
!
slb server GW_IP 10.2.2.254
   port 0  tcp
       no health-check
   port 0  udp
       no health-check
!
slb service-group GW_TCP tcp
    member GW_IP:0
!
slb service-group GW_UDP udp
    member GW_IP:0
!
slb virtual-server _wildcard_vserver 0.0.0.0
   port 0  tcp
      source-nat pool SNAT_IP
      service-group GW_TCP
      no-dest-nat
   port 0  udp
      source-nat pool SNAT_IP
      service-group GW_UDP
      no-dest-nat
   port 0  others
      source-nat pool SNAT_IP
      service-group GW_TCP
      no-dest-nat
   port 21  ftp
      source-nat pool SNAT_IP
      service-group GW_TCP
      no-dest-nat

L3 mode NAT

  • Gateway IP: 10.2.2.254/24
  • Source IP: 10.1.1.0/24
  • NAT IP: 10.2.2.100
  • Source vlan: 10
  • Gateway vlan: 20
interface ve 20
 ip nat outside
interface ve 10
 ip nat inside
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 any
!
ip nat pool SNAT_IP 10.2.2.100 10.2.2.100 netmask /24
!
ip nat inside source list 101 pool SNAT_IP
a10/nat.txt · 上一次變更: 2012/04/18 07:16 由 jal
上一頁 | 下一頁 | 回首頁 | RSS Feed | Facebook