Network Address Translation

154 Pages·2012·1.56 MB·English

by  Juniper Networks

Network Address Translation
Published:2012-12-05
Copyright©2012,JuniperNetworks,Inc.
JuniperNetworks,Inc.
1194NorthMathildaAvenue
Sunnyvale,California94089
USA
408-745-2000
www.juniper.net
ThisproductincludestheEnvoySNMPEngine,developedbyEpilogueTechnology,anIntegratedSystemsCompany.Copyright©1986-1997,
EpilogueTechnologyCorporation.Allrightsreserved.Thisprogramanditsdocumentationweredevelopedatprivateexpense,andnopart
ofthemisinthepublicdomain.
ThisproductincludesmemoryallocationsoftwaredevelopedbyMarkMoraes,copyright©1988,1989,1993,UniversityofToronto.
ThisproductincludesFreeBSDsoftwaredevelopedbytheUniversityofCalifornia,Berkeley,anditscontributors.Allofthedocumentation
andsoftwareincludedinthe4.4BSDand4.4BSD-LiteReleasesiscopyrightedbytheRegentsoftheUniversityofCalifornia.Copyright©
1979,1980,1983,1986,1988,1989,1991,1992,1993,1994.TheRegentsoftheUniversityofCalifornia.Allrightsreserved.
GateDsoftwarecopyright©1995,theRegentsoftheUniversity.Allrightsreserved.GateDaemonwasoriginatedanddevelopedthrough
release3.0byCornellUniversityanditscollaborators.GatedisbasedonKirton’sEGP,UCBerkeley’sroutingdaemon(routed),andDCN’s
HELLOroutingprotocol.DevelopmentofGatedhasbeensupportedinpartbytheNationalScienceFoundation.PortionsoftheGateD
softwarecopyright©1988,RegentsoftheUniversityofCalifornia.Allrightsreserved.PortionsoftheGateDsoftwarecopyright©1991,D.
L.S.Associates.
ThisproductincludessoftwaredevelopedbyMakerCommunications,Inc.,copyright©1996,1997,MakerCommunications,Inc.
JuniperNetworks,Junos,Steel-BeltedRadius,NetScreen,andScreenOSareregisteredtrademarksofJuniperNetworks,Inc.intheUnited
Statesandothercountries.TheJuniperNetworksLogo,theJunoslogo,andJunosEaretrademarksofJuniperNetworks,Inc.Allother
trademarks,servicemarks,registeredtrademarks,orregisteredservicemarksarethepropertyoftheirrespectiveowners.
JuniperNetworksassumesnoresponsibilityforanyinaccuraciesinthisdocument.JuniperNetworksreservestherighttochange,modify,
transfer,orotherwiserevisethispublicationwithoutnotice.
ProductsmadeorsoldbyJuniperNetworksorcomponentsthereofmightbecoveredbyoneormoreofthefollowingpatentsthatare
ownedbyorlicensedtoJuniperNetworks:U.S.PatentNos.5,473,599,5,905,725,5,909,440,6,192,051,6,333,650,6,359,479,6,406,312,
6,429,706,6,459,579,6,493,347,6,538,518,6,538,899,6,552,918,6,567,902,6,578,186,and6,590,785.
NetworkAddressTranslation
Copyright©2012,JuniperNetworks,Inc.
Allrightsreserved.
Theinformationinthisdocumentiscurrentasofthedateonthetitlepage.
YEAR2000NOTICE
JuniperNetworkshardwareandsoftwareproductsareYear2000compliant.JunosOShasnoknowntime-relatedlimitationsthroughthe
year2038.However,theNTPapplicationisknowntohavesomedifficultyintheyear2036.
ENDUSERLICENSEAGREEMENT
TheJuniperNetworksproductthatisthesubjectofthistechnicaldocumentationconsistsof(orisintendedforusewith)JuniperNetworks
software.UseofsuchsoftwareissubjecttothetermsandconditionsoftheEndUserLicenseAgreement(“EULA”)postedat
http://www.juniper.net/support/eula.html.Bydownloading,installingorusingsuchsoftware,youagreetothetermsandconditions
ofthatEULA.
ii Copyright©2012,JuniperNetworks,Inc.
Table of Contents
About the Documentation ............................................xi
DocumentationandReleaseNotes..................................xi
Supported Platforms .............................................xi
UsingtheExamplesinThisManual..................................xi
MergingaFullExample...........................................xii
Merging a Snippet ...............................................xii
Documentation Conventions ......................................xiii
DocumentationFeedback.........................................xv
Requesting Technical Support .....................................xv
Self-HelpOnlineToolsandResources...............................xv
OpeningaCasewithJTAC........................................xvi
Part1 Overview
Chapter1 Network Address Translation ........................................3
Network Address Translation Overview ..................................3
TypesofNAT....................................................3
NATConceptandFacilitiesOverview.............................3
IPv4-to-IPv4BasicNAT........................................4
NAT-PT.....................................................5
Static Destination NAT ........................................5
Twice NAT ..................................................5
IPv6 NAT ...................................................6
NAT-PT with DNS ALG ........................................6
DynamicNAT................................................6
Stateful NAT64 ..............................................7
Dual-StackLite...............................................7
Part2 Configuration
Chapter2 Configuration Tasks ................................................11
ConfiguringAddressesandPortsforUseinNATRules......................11
ConfiguringPoolsofAddressesandPorts.............................11
PreserveRangeandPreserveParity.............................12
ConfiguringAddressPoolsforNetworkAddressPortTranslation..........13
Round-RobinAllocation.......................................13
Sequential..................................................14
Port Block Allocation .........................................14
AdditionalOptionsforNAPT...................................19
ComparisionofNAPTImplementationMethods...................19
SpecifyingDestinationandSourcePrefixes...........................19
Copyright©2012,JuniperNetworks,Inc. iii
NetworkAddressTranslation
Requirements for NAT Addresses ..................................20
Configuring NAT Rules ...............................................21
ConfiguringMatchDirectionforNATRules...........................22
ConfiguringMatchConditionsinNATRules...........................23
ConfiguringActionsinNATRules...................................24
ConfiguringNATRuleSets............................................27
ConfiguringStaticSourceTranslationinIPv4Networks.....................27
ConfiguringtheNATPoolandRule.................................27
ConfiguringtheServiceSetforNAT.................................29
Configuring Trace Options ........................................30
ConfiguringStaticSourceTranslationinIPv6Networks.....................31
ConfiguringtheNATPoolandRule..................................31
ConfiguringtheServiceSetforNAT.................................32
Configuring Trace Options ........................................33
ConfiguringDynamicSourceAddressandPortTranslationinIPv4Networks...34
ConfiguringDynamicSourceAddressandPortTranslationforIPv6
Networks ......................................................37
ConfiguringDynamicAddress-OnlySourceTranslationinIPv4Networks......38
ConfiguringStaticDestinationAddressTranslationinIPv4Networks..........41
ConfiguringPortForwardingforStaticDestinationAddressTranslation.......43
ConfiguringTranslationTypeforTranslationBetweenIPv6andIPv4
Networks......................................................46
ConfiguringtheDNSALGApplication...............................46
ConfiguringtheNATPoolandNATRule.............................47
ConfiguringtheServiceSetforNAT.................................50
ConfiguringTraceOptions.........................................51
Configuring NAT-PT .................................................51
ConfiguringDynamicSourceAddressandStaticDestinationAddressTranslation
(IPv6toIPV4)..................................................54
Chapter3 NATRulesExamples...............................................57
Example:ConfiguringStaticSourceTranslationinanIPv4Network...........58
ConfiguringStaticSourceTranslationinIPv6Networks....................58
ConfiguringtheNATPoolandRule.................................59
ConfiguringtheServiceSetforNAT.................................60
ConfiguringTraceOptions.........................................61
Example:ConfiguringStaticSourceTranslationwithMultiplePrefixesand
AddressRanges.................................................61
Example:ConfiguringDynamicSourceAddressandPortTranslation(NAPT)
for an IPv4 Network .............................................62
Example:ConfiguringDynamicSourceTranslationforanIPv4Network.......62
Example:ConfiguringDynamicSourceAddressandPortTranslationforanIPv6
Network.......................................................63
Example:ConfiguringDynamicAddress-OnlySourceTranslation............64
Example:ConfiguringDynamicAddress-OnlySourceTranslationinanIPv4
Network.......................................................64
Example:ConfiguringStaticDestinationAddressTranslation................65
Example:ConfiguringNATinMixedIPv4andIPv6Networks................66
Example:ConfiguringtheTranslationTypeBetweenIPv6andIPv4Networks..69
iv Copyright©2012,JuniperNetworks,Inc.
TableofContents
Example:ConfiguringDynamicSourceAddressandStaticDestinationAddress
Translation(IPv6toIPV4)........................................70
Example:ConfiguringSourceDynamicandDestinationStaticTranslation......71
Example: Configuring NAT-PT .........................................71
Example:ConfiguringPortForwardingwithTwiceNAT.....................84
Example:ConfiguringanOversubscribedPoolwithFallbacktoNAPT.........85
Example:ConfiguringanOversubscribedPoolwithNoFallback.............86
Example:AssigningAddressesfromaDynamicPoolforStaticUse...........86
Example:ConfiguringNATRulesWithoutDefiningaPool...................87
Example:PreventingTranslationofSpecificAddresses....................88
Example:ConfiguringNATforMulticastTraffic...........................88
Rendezvous Point Configuration ...................................89
Router1Configuration............................................92
Example:ConfiguringPortForwardingwithTwiceNAT.....................92
Chapter4 Configuration Statements .........................................95
address(ServicesNATPool)..........................................95
address-allocation..................................................95
address-range .....................................................96
application-sets(ServicesNAT).......................................96
applications (Services NAT) ..........................................97
cgn-pic ...........................................................97
destination-address ................................................98
destination-address-range ...........................................98
destination-pool ...................................................99
destination-port range ..............................................99
destination-prefix..................................................100
destination-prefix-list ..............................................100
destined-port......................................................101
dns-alg-pool ......................................................101
dns-alg-prefix .....................................................102
from(ServicesNAT)................................................102
hint .............................................................103
ipv6-multicast-interfaces............................................103
match-direction ...................................................104
nat-type .........................................................104
no-translation .....................................................105
overload-pool .....................................................105
overload-prefix ....................................................106
pgcp ............................................................106
pool .............................................................107
port .............................................................108
port-forwarding ...................................................109
port-forwarding-mappings ..........................................109
ports-per-session ..................................................110
remotely-controlled ................................................110
rule ..............................................................111
rule-set ...........................................................112
services (NAT) .....................................................112
Copyright©2012,JuniperNetworks,Inc. v
NetworkAddressTranslation
secured-port-block-allocation ........................................113
source-address(NAT)...............................................114
source-address-range ...............................................114
source-pool .......................................................115
source-prefix ......................................................115
source-prefix-list ...................................................116
syslog ............................................................116
translated-port.....................................................117
term .............................................................118
then .............................................................119
translated ........................................................120
translation-type ....................................................121
transport .........................................................122
use-dns-map-for-destination-translation...............................123
Part3 Administration
Chapter5 NetworkAddressTranslationOperationalModeCommands...........127
showservicesnatpool..............................................128
showservicesnatmapping...........................................131
Part4 Index
Index.........................................................135
vi Copyright©2012,JuniperNetworks,Inc.
List of Figures
Part1 Overview
Chapter1 Network Address Translation ........................................3
Figure1:DynamicNATFlow............................................7
Figure2:StatefulNAT64Flow..........................................7
Figure 3: DS-Lite Flow ................................................8
Part2 Configuration
Chapter3 NATRulesExamples...............................................57
Figure4:ConfiguringDNSALGswithNAT-PTNetworkTopology.............72
Figure5:ConfiguringNATforMulticastTraffic............................88
Copyright©2012,JuniperNetworks,Inc. vii
NetworkAddressTranslation
viii Copyright©2012,JuniperNetworks,Inc.
List of Tables
About the Documentation ..........................................xi
Table1:NoticeIcons.................................................xiii
Table2:TextandSyntaxConventions...................................xiii
Part2 Configuration
Chapter2 Configuration Tasks ................................................11
Table3:DeterministicPortBlockAllocationCommitConstraints.............18
Table4:ComparisonofNAPTImplementationMethods....................19
Part3 Administration
Chapter5 NetworkAddressTranslationOperationalModeCommands...........127
Table5:showservicesnatpoolOutputFields...........................128
Table6:showservicesnatmappingOutputFields........................131
Copyright©2012,JuniperNetworks,Inc. ix
NetworkAddressTranslation
x Copyright©2012,JuniperNetworks,Inc.