Avaya BSGX4e User's Guide download pdf (Page 134)

134 BSGX4e Business Gateway User Guide

NN47928-102 Release 01.01

NAT/ALG

Network Address Translation (NAT) provides security by hiding the internal addresses

of the private network from the Internet: addresses and/or ports are translated

from private IP addresses to public IP addresses, and vice versa.

The BSGX4e device can do both standard and reverse NAT:

 Standard NAT (also known as Network Address Port Translation [NAPT])

Standard NAT translates the source IP address of the LAN to the public WAN IP

address. It also changes the source port (for UDP and TCP protocols) or the ICMP

identifier. These translations allow several LAN devices to be connected to the

WAN through one public IP address.

 Reverse NAT (also known as Redirection)

Reverse NAT forwards traffic and translates addresses between a private IP

address and a public IP address. This allows a server in the LAN to be accessed

from the Internet (using address forwarding or port forwarding).

The BSGX4e device also supports the Application Layer Gateway (ALG). The ALG

enables the transfer of FTP or TFTP traffic through firewall policies and NAT. This is

done by creating dynamic holes in the firewall policy and changing IP addresses in

application protocol headers. To enable ALG, see “ALG Configuration” (page 140).

Configuring NAT

The NAT policy types on the BSGX4e allow for the following configuration:

 Static NAT (also known as inbound mapping)

One, and only one, public IP address is mapped to one private IP address. Static

NAT supports strict translation: only one device on the private network can be

recognized through the public IP address on the Internet.

 NAT address forwarding forwards a flow from the WAN side that is directed to a

public address; it changes the destination IP address to a matching LAN address.

 NAT port forwarding forwards the flow from the WAN side that is directed to a

specific public IP address and port, changing the destination IP address and port

to the configured destination IP address and port of the LAN device. NAT port

forwarding supports NAT overload. Use of multiple ports enables one public IP

address to serve multiple hosts on the private network.

To use NAT, the following configuration steps are required:

1. Verify that NAT is enabled on the WAN interface. (It is initially enabled on eth0.)

2. Configure NAT public addresses and policies as needed for each address and port

translation.

3. Configure firewall security policies that reference the NAT policies (see “Security

Policy Configuration Command” (page 131)).

For specific steps and examples, see “Port Forwarding” (page 137), “Address

Forwarding” (page 138), and “Static NAT Forwarding” (page 138).

1 2 ... 129 130 131 132 133 134 135 136 137 138 139 ... 455 456

No comments

Avaya BSGX4e User's Guide Page 134