topic Re: 7102dl partial NAT in Switches, Hubs, and Modems

7102dl partial NAT

Casey Morford — Tue, 17 Feb 2009 23:21:07 GMT

We have a 7102dl for routing our /27 block of IPs.

Is is possible to NAT a few of the public IPs and just route the remaining IPs?

For example, a few of our servers have internal IP's only in the 10.0.0.0/8 subnet. I'd like to do a one to one NAT from public to private IPs for those servers. Some of our other servers are simply configured with the public IP.

By enabling the firewall, am I committed to NATing all of our public IPs, or, from what I've read in the forums, do I simply define the IPs I want NATed as secondary IPs on the public interface, and then the remaining public IPs will be routed as normal?

Re: 7102dl partial NAT

Pieter 't Hart — Thu, 19 Feb 2009 09:52:28 GMT

no,
all public adresses lay on the "outside" network.

for incomming connections the firewall only listens to configured NAT adresses.
the other adresses are ignored by this firewall and can be used by another device on the outside network.

for outgoing connections you may configure a NAT-pool, so multiple internal hosts can share public adresses.

regards,
Pieter

Re: 7102dl partial NAT

Casey Morford — Thu, 19 Feb 2009 12:50:44 GMT

I think my original post didn't make clear that I know where the servers need to sit in terms of subnets (inside/outside), I just didn't know if enabling the firewall caused issues for normal routing (from the T1/frame relay interface) on the public interface.

Let me confirm, for example:

7102dl config (frame relay, but just showing the net interfaces):
eth 0/1: 192.168.0.1 (Private)
eth 0/2: xxx.xxx.xxx.1 (/27 Public IP Block)
secondary eth 0/2: xxx.xxx.xxx.2

I know I can sit a server with ip 192.168.0.2 on the private network (gateway 192.168.0.1) and one-to-one NAT xxx.xxx.xxx.2 to 192.168.0.2. That shouldn't be a problem.

The part I wasn't 100% sure on was, once the firewall is enabled, can I continue to have servers assigned with the remaining public IPs talking to eth 0/2? I'm thinking this will work fine, since that interface is still visible, I just didn't know if I'd run into problems enabling the firewall to NAT a few of those public IP's.