HP High-End Firewalls NAT and ALG Command Reference Part number: 5998-2639 Software version: F1000-E/Firewall module: R3166 F5000-A5: R3206 Document version: 6PW101-20120706
Legal and notice information Copyright 2012 Hewlett-Packard Development Company, L.P. No part of this documentation may be reproduced or transmitted in any form or by any means without prior written consent of Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
Contents NAT configuration commands 1 display nat address-group 1 display nat all 1 display nat bound 3 display nat dns-map 4 display nat server 4 display nat static 5 display nat statistics 6 nat address-group 7 nat dns-map 8 nat outbound 9 nat outbound static 11 nat server 11 nat static 13 ALG configuration commands 15 alg 15 Support and other resources 16 Contacting HP 16 Subscription service 16 Related information 16 Documents 16 Websites 16 Conventions 17 Index 19 i
NAT configuration commands display nat address-group View display nat address-group [ group-number ] Any view 1: Monitor level group-number: NAT address group number, in the range from 0 to 255. If this argument is not provided, information of all NAT address pools is displayed. Use the display nat address-group command to display the NAT address pool information. Related commands: nat address-group. # Display the NAT address pool information. <Sysname> display nat address-group NAT address-group information: There are currently 2 nat address-group(s) 1 : from 202.110.10.10 to 202.110.10.15 2 : from 202.110.10.20 to 202.110.10.25 # Display the information of NAT address group 1. <Sysname> display nat address-group 1 NAT address-group information: 1 : from 202.110.10.10 to 202.110.10.15 Table 1 Output description Field NAT address-group information There are currently 2 nat address-group(s) 1 : from 202.110.10.10 to 202.110.10.15 NAT address pool information There are currently two NAT address groups. The range of IP addresses in address pool 1 is from 202.110.10.10 to 202.110.10.15 display nat all display nat all 1
View Any view 1: Monitor level None Use the display nat all command to display all NAT configuration information. # Display all NAT configuration information. <Sysname> display nat all NAT address-group information: There are currently 1 nat address-group(s) 1 : from 202.110.10.10 to 202.110.10.15 NAT bound information: There are currently 1 nat bound rule(s) Interface: GigabitEthernet0/1 Direction: outbound ACL: 2009 Address-group: 1 NO-PAT: N NAT server in private network information: There are currently 1 internal server(s) Interface: GigabitEthernet0/2, Protocol: 6(tcp) Global: 5.5.5.5 : 80(www) Local : 192.1.1.1 : 80(www) NAT static information: There are currently 1 NAT static configuration(s) single static: Local-IP : 1.1.1.1 Global-IP : 2.2.2.2 Local-VPN : --- NAT static enabled information: Interface GigabitEthernet0/3 Table 2 Output description Direction out-static Field NAT address-group information There are currently 1 nat address-group(s) NAT bound information: NAT address pool information See the display nat address-group command for description on the specific fields. Configuration information about internal address-to-external address translation. See the display nat bound command for description on the specific fields. 2
Field NAT server in private network information NAT static information NAT static enabled information Internal server information. See the display nat server command for description on the specific fields. Information about static NAT. See the display nat static command for description on the specific fields. Information about static NAT entries and interface(s) with static NAT enabled. See the display nat static command for description on the specific fields. display nat bound display nat bound View Any view 1: Monitor level None Use the display nat bound command to display the NAT configuration information. Related commands: nat outbound. # Display the NAT configuration information. <Sysname> display nat bound NAT bound information: There are currently 1 nat bound rule(s) Interface: GigabitEthernet0/2 Direction: outbound ACL: 2000 Address-group: 319 NO-PAT: Y Table 3 Output description Field NAT bound information: Interface Direction ACL Address-group NO-PAT Display configured NAT address translation information The interface associated with a NAT address pool. Address translation direction: inbound or outbound. ACL number Address group number. The field is displayed as null in Easy IP mode. Support for NO-PAT mode or not 3
display nat dns-map display nat dns-map View Any view 1: Monitor level None Use the display nat dns-map command to display NAT DNS mapping configuration information. Related commands: nat dns-map. # Display NAT DNS mapping configuration information. <Sysname> display nat dns-map NAT DNS mapping information: There are currently 2 NAT DNS mapping(s) Domain-name: www.server.com Global-IP : 202.113.16.117 Global-port: 80(www) Protocol : 6(tcp) Domain-name: ftp.server.com Global-IP : 202.113.16.100 Global-port: 21(ftp) Protocol : 6(tcp) Table 4 Output description Field NAT DNS mapping information There are currently 2 DNS mapping(s) Domain-name Global-IP Global-port Protocol NAT DNS mapping information There are two DNS mapping entries Domain name of the internal server External IP address of the internal server Public port number of the internal server Protocol type of the internal server display nat server display nat server 4
View Any view 1: Monitor level None Use the display nat server command to display information about internal servers. Related commands: nat server. # Display information about internal servers. <Sysname> display nat server NAT server in private network information: There are currently 2 internal server(s) Interface: GigabitEthernet0/1, Protocol: 6(tcp) Global: 100.100.120.120 : 21(ftp) Local : 192.168.100.100 : 21(ftp) Interface: GigabitEthernet0/2, Protocol: 6(tcp) Global: 100.100.100.121 : 80(www) Local : 192.168.100.101 : 80(www) vpn2 Table 5 Output description Field Server in private network information Interface Protocol Global Local Information about internal servers Internal server interface Protocol type External IP address and port number of a server, and the VPN that the external address belongs to. Internal network information of a server. For a common internal server, this field displays the internal IP address and port number of the server, and the VPN that the internal IP address belongs to. For an internal server in load sharing mode, this field displays the internal server group name, the VPN that the internal IP address belongs to, internal server member information, and the number of current connections of each member. display nat static display nat static 5
View Any view 1: Monitor level None Use the display nat static command to display static NAT entries and interface(s) with static NAT enabled. Related commands: nat static and nat outbound static. # Display static NAT entries and interface(s) with static NAT enabled. <Sysname> display nat static NAT static information: There are currently 1 NAT static configuration(s) single static: Local-IP : 4.4.4.4 Global-IP : 5.5.5.5 Unidirectional : N Local-VPN : --- NAT static enabled information: Interface GigabitEthernet0/2 Table 6 Output description Direction out-static Field NAT static information single static Local-IP Global-IP Unidirectional Local-VPN NAT static enabled information Interface Direction Configuration information of static NAT One-to-one static NAT Internal IP address External IP address Indicates whether only unidirectional address translation is supported. VPN that the internal IP address belongs to Information about static NAT enabled on the interface(s) Interface on which static NAT is configured Direction of packets to be translated display nat statistics display nat statistics 6
View Any view 1: Monitor level None Use the display nat statistics command to display NAT statistics. # Display NAT statistics. <Sysname> display nat statistics total PAT session table count: 1 total NO-PAT session table count: 0 total SERVER session table count: 0 total STATIC session table count: 0 Table 7 Output description Field total PAT session table count total NO-PAT session table count total SERVER session table count total STATIC session table count Number of PAT session entries Number of NO-PAT session entries Number of SERVER session entries Number of STATIC session entries nat address-group View nat address-group group-number start-address end-address [ level level ] undo nat address-group group-number start-address end-address [ level level ] System view 2: System level group-number: Index of the address pool, in the range 0 to 255l. start-address: Start IP address of the address pool. end-address: End IP address of the address pool. The end-address cannot be smaller than the start-address. If they are the same, the address pool has only one IP address. The maximum number of IP addresses that can be added to an address pool is 255. level level : Specifies the level of port numbers assigned in NAPT translation for this address pool. The value for argument level is either 1 or 0. 0 represents a lower level, and the assignable port numbers 7
range from 35000 to 65535; 1 represents a higher level, and the assignable port numbers range from 1024 to 34999 for devices in stateful failover state, and from 1024 to 65535 for devices not in stateful failover state. The default value for argument level is 1. In the asymmetric stateful failover network scenario, configure different port assignment levels for the address pools on the two stateful failover devices. Use the nat address-group command to configure a NAT address pool. Use the undo nat address-group command to remove an address pool. An address pool consists of a set of consecutive IP addresses. Note that: You cannot remove an address pool that has been associated with an ACL. Different address pools must not overlap. An address pool is not needed in the case of Easy IP where the interface s public IP address is used as the translated IP address. # Configure an address pool numbered 1 that contains addresses 202.110.10.10 to 202.110.10.15. [Sysname] nat address-group 1 202.110.10.10 202.110.10.15 nat dns-map View nat dns-map domain domain-name protocol pro-type ip global-ip port global-port undo nat dns-map domain domain-name System view 2: System level domain domain-name: Specifies the domain name of an internal server. A domain name is a string containing no more than 255 case-insensitive characters. It consists of several labels separated by dots (.). Each label has no more than 63 characters that must begin and end with letters or digits; besides, dashes (-) can be included. protocol pro-type: Specifies the protocol type used by the internal server, tcp or udp. ip global-ip: Specifies the public IP address used by the internal server to provide services to the external network. port global-port: Specifies the port number used by the internal server to provide services to the external network. The global-port argument is in the range 1 to 65535. Use the nat dns-map command to map the domain name to the public network information of an internal server. 8
Use the undo nat dns-map command to remove a DNS mapping. The maximum number of DNS mappings is 16. Related commands: display nat dns-map. # A company provides Web service to external users. The domain name of the internal server is www.server.com, and the public IP address is 202.112.0.1. Configure a DNS mapping, so that internal users can access the Web server using its domain name. [Sysname] nat dns-map domain www.server.com protocol tcp ip 202.112.0.1 port www nat outbound View nat outbound [ acl-number ] [ address-group group-number [ no-pat ] ] [ track vrrp virtual-router-id ] undo nat outbound [ acl-number ] [ address-group group-number ] [ no-pat ] ] [ track vrrp virtual-router-id ] Interface view 2: System level acl-number: ACL number, in the range 2000 to 3999. address-group group-number: Specifies an address pool for NAT, in the range from 0 to 255.. If no address pool is specified, the IP address of the interface will be used as the translated IP address, that is, Easy IP is enabled. no-pat: Indicates that no many-to-many NAT is implemented. If this keyword is not configured, many-to-one NAT is implemented using the TCP/UDP port information. track vrrp virtual-router-id: Associates address translation on a specified outbound interface with a VRRP group. The virtual-router-id argument indicates the number of the VRRP group, in the range of 1 to 255. Without this argument specified, no VRRP group is associated. Use the nat outbound command or the nat outbound acl-number command to associate an ACL with the IP address of the interface and enable Easy IP. Use the nat outbound acl-number address-group group-number no-pat command to associate an ACL with an IP address pool for translation of only the IP address and enable many-to-many NAT. Use the nat outbound address-group group-number command or the nat outbound acl-number address-group group-number command to associate an ACL with an IP address pool for translation of both the IP address and port number and enable NAPT. Use the undo nat outbound command to remove an association. If the acl-number argument is specified, a packet matching the associated ACL will be serviced by NAT. If the acl-number argument is not specified, a packet whose source IP address is not the IP address of the outbound interface will be serviced by NAT. 9
Note that: You can configure multiple associations or use the undo command to remove an association on an interface that serves as the egress of an internal network to the external network. When the undo nat outbound command is executed to remove an association, the NAT entries depending on the association are not deleted; they will be aged out automatically after 5 to 10 minutes. During this period, the involved users cannot access the external network whereas all the other users are not affected. When an ACL rule is not operative, no new NAT session entry depending on the rule can be created. However, existing connections are still available for communication. If a packet matches the specified next hop, the packet will be translated using an IP address in the address pool; if not, the packet will not be translated. You can bind an ACL to only one address pool on an interface; an address pool can be bound to multiple ACLs. NAPT cannot translate connections from external hosts to internal hosts. In stateful failover networking, make sure that you associate each address pool configured on an interface with one VRRP group only; otherwise, the system associates the address pool with the VRRP group having the highest group ID. NOTE: The ACL rules referenced by the same interface cannot conflict. That is, the source IP address, destination IP address in any two ACL rules cannot be the same. For basic ACLs (numbered from 2000 to 2999), if the source IP address in any two ACL rules are the same, a conflict occurs. # Configure NAT for hosts on subnet 10.110.10.0/24. The NAT address pool contains addresses 202.110.10.10 through 202.110.10.12. Assume that interface GigabitEthernet0/1 is connected to the Internet. [Sysname] acl number 2001 [Sysname-acl-basic-2001] rule permit source 10.110.10.0 0.0.0.255 [Sysname-acl-basic-2001] rule deny [Sysname-acl-basic-2001] quit [Sysname] nat address-group 1 202.110.10.10 202.110.10.12 # To also translate TCP/UDP port information, do the following: [Sysname] interface GigabitEthernet0/1 [Sysname-GigabitEthernet0/1] nat outbound 2001 address-group 1 # To ignore the TCP/UDP port information in translation, do the following: [Sysname] interface GigabitEthernet0/1 [Sysname- GigabitEthernet0/1] nat outbound 2001 address-group 1 no-pat # To use the IP address of the GigabitEthernet0/1 interface for translation, do the following: [Sysname] interface GigabitEthernet0/1 [Sysname- GigabitEthernet0/1] nat outbound 2001 10
nat outbound static View nat outbound static [ track vrrp virtual-router-id ] undo nat outbound static [ track vrrp virtual-router-id ] Interface view 2: System level track vrrp virtual-router-id: Associates static NAT with a VRRP group. The virtual-router-id argument indicates the number of the VRRP group, in the range of 1 to 255. Without this keyword and argument combination specified, no VRRP group is associated. Use the nat outbound static command to enable static NAT on an interface, making the configured static NAT mappings take effect. Use the undo nat outbound static command to disable static NAT on the interface. Related commands: display nat static. nat server View # Configure a one-to-one NAT mapping and enable static NAT on interface GigabitEthernet0/1. [Sysname] nat static 192.168.1.1 2.2.2.2 [Sysname] interface GigabitEthernet0/1 [Sysname-GigabitEthernet0/1] nat outbound static nat server protocol pro-type global { global-address current-interface interface interface-type interface-number } [ global-port ] inside local-address [ local-port ] [ vpn-instance local-name ] [ track vrrp virtual-router-id ] undo nat server protocol pro-type global { global-address interface interface-type interface-number current-interface } [ global-port ] inside local-address [ local-port ] [ vpn-instance local-name ] [ track vrrp virtual-router-id ] Interface view 2: System level index: Index of the internal server, in the range from 1 to 255. 11
protocol pro-type: Specifies a protocol type. pro-type supports TCP, UDP, and ICMP. If ICMP is specified, do not specify port number for the internal server. global-address: Public IP address for the internal server. interface: Uses a specified interface address as the external IP address for the internal server, enabling Easy IP. interface-type interface-number: Specifies the interface type and interface number. Currently, only loopback interface is supported and must be configured; otherwise the configuration is considered illegal. current-interface: Uses the current interface address as the external IP address for the internal server. global-port: Global port number for the internal server, in the range 0 to 65535. local-address: Internal IP address of the internal server. vpn-instance local-name: Specifies the VPN to which the internal server belongs. The local-name argument is a case-sensitive string of 1 to 31 characters. Without this parameter, the internal server does no belong to any VPN. track vrrp virtual-router-id: Associates the internal server with a VRRP group. The virtual-router-id argument indicates the number of the VRRP group to be associated. Without this keyword and argument combination specified, no VRRP group is associated. Use the nat server command to define an internal server. Using the address and port defined by the global-address and global-port parameters, external users can access the internal server with an IP address of local-address and a port of local-port. Use the undo nat server command to remove the configuration. Note that: If one of the two arguments global-port and local-port is set to any, the other must also be any or remain undefined. Using this command, you can configure internal servers (such as Web, FTP, Telnet, POP3, and DNS servers) to provide services for external users. An internal server can reside in an internal network or an VPN. The maximum number of internal server configuration commands is 255. The number of internal servers that each command can define equals the difference between global-port2 and global-port1. Up to 4096 internal servers can be configured on an interface. The system allows up to 1024 internal server configuration commands. In general, this command is configured on an interface that serves as the egress of an internal network and connects to the external network. Currently, the device supports using an interface address as the external IP address of an internal server, which is Easy IP. If you specify the current-interface keyword, the internal server uses the current primary IP address of the current interface. If you use interface { interface-type interface-number } to specify an interface, the interface must be an existing loopback interface and the current primary IP address of the loopback interface is used. HP recommends that if an internal server using Easy IP is configured on the current interface, the IP address of this interface should not be configured as the external address of another internal server; vice versa. This is because that the interface address that is referenced by the internal server using Easy IP serves as the external address of the internal server. 12
In stateful failover networking, make sure that you associate the public address of an internal server on an interface with one VRRP group only; otherwise, the system associates the public address with the VRRP group having the highest group ID. Related commands: display nat server. CAUTION: nat static When the protocol type is not udp (with a protocol number of 17) or tcp (with a protocol number of 6), you can configure one-to-one NAT between an internal IP address and an external IP address only, but cannot specify port numbers. # Allow external users to access the internal Web server 10.110.10.10 on the LAN through http://202.110.10.10:8080, and the internal FTP server 10.110.10.11 in VPN vrf10 through ftp://202.110.10.10/. Assume that the interface GigabitEthernet0/1 is connected to the external network. [Sysname] interface GigabitEthernet0/1 [Sysname-GigabitEthernet0/1] nat server protocol tcp global 202.110.10.10 8080 inside 10.110.10.10 www [Sysname-GigabitEthernet0/1] quit [Sysname] ip vpn-instance vrf10 [Sysname-vpn-instance] route-distinguisher 100:001 [Sysname-vpn-instance] vpn-target 100:1 export-extcommunity [Sysname-vpn-instance] vpn-target 100:1 import-extcommunity [Sysname-vpn-instance] quit [Sysname] interface serial 1/0 [Sysname-Serial1/0] nat server protocol tcp global 202.110.10.10 21 inside 10.110.10.11 vpn-instance vrf10 # Allow external hosts to ping the host with an IP address of 10.110.10.12 in VPN vrf10 by using the ping 202.110.10.11 command. [Sysname] interface GigabitEthernet0/1 [Sysname- GigabitEthernet0/1] nat server protocol icmp global 202.110.10.11 inside 10.110.10.12 vpn-instance vrf10 # Allow external hosts to access the Telnet services of internal servers 10.110.10.1 to 10.110.10.100 in VPN vrf10 through the public address of 202.110.10.10 and port numbers from 1001 to 1100. As a result, a user can telnet to 202.110.10.10:1001 to access 10.110.10.1, telnet to 202.110.10.10:1002 to access 10.110.10.2, and so on. [Sysname] interface GigabitEthernet0/1 [Sysname-GigabitEthernet0/1] nat server protocol tcp global 202.110.10.10 1001 1100 inside 10.110.10.1 10.110.10.100 telnet vpn-instance vrf10 nat static [ acl-number ] local-ip [ vpn-instance local-name ] global-ip undo nat static [ acl-number ] local-ip [ vpn-instance local-name ] global-ip] 13
View System view 2: System level acl-number: Number of an ACL, in the range of 2000 to 3999. You can use an ACL to specify the destination addresses that internal hosts can access. local-ip: Internal IP address. vpn-instance local-name: Specifies the VPN to which the internal IP address belongs. The local-name argument is a case-sensitive string of 1 to 31 characters. Without this keyword and argument combination, the internal IP address does not belong to any VPN. global-ip: External IP address. Use the nat static command to configure a one-to-one static NAT mapping. Use the undo nat static command to remove a one-to-one static NAT mapping. Related commands: display nat static. # In system view, configure static NAT mapping between internal IP address 192.168.1.1 and external IP address 2.2.2.2. [Sysname] nat static 192.168.1.1 2.2.2.2 # Configure static NAT to allow the internal host 192.168.1.1 to access only the external network 3.3.3.0/24 by using the external IP address 2.2.2.2. [Sysname] acl number 3001 [Sysname-acl-adv-3001] rule permit ip destination 3.3.3.0 0.0.0.255 [Sysname-acl-adv-3001] quit [Sysname] nat static 3001 192.168.1.1 2.2.2.2 14
ALG configuration commands alg alg { all dns ftp h323 ils msn nbt pptp qq rtsp sip sqlnet tftp } undo alg { all dns ftp h323 ils msn nbt pptp qq rtsp sip sqlnet tftp } View System view 2: System level all: Enables ALG for all protocols. dns: Enables ALG for DNS. ftp: Enables ALG for FTP. h323: Enables ALG for H.323. ils: Enables ALG for ILS. msn: Enables ALG for MSN. nbt: Enables ALG for NBT. pptp: Enables ALG for PPTP. qq: Enables ALG for QQ. rtsp: Enables ALG for RTSP. sip: Enables ALG for SIP. sqlnet: Enables ALG for SQLNET. tftp: Enables ALG for TFTP. Use the alg command to enable ALG for a specified protocol. Use the undo alg command to disable ALG for a specified protocol. By default, the ALG feature is enabled for all protocols. # Enable ALG for FTP. [Sysname] alg ftp 15
Support and other resources Contacting HP For worldwide technical support information, see the HP support website: http://www.hp.com/support Before contacting HP, collect the following information: Product model names and numbers Technical support registration number (if applicable) Product serial numbers Error messages Operating system type and revision level Detailed questions Subscription service HP recommends that you register your product at the Subscriber's Choice for Business website: http://www.hp.com/go/wwalerts After registering, you will receive email notification of product enhancements, new driver versions, firmware updates, and other product resources. Related information Documents Websites To find related documents, browse to the Manuals page of the HP Business Support Center website: http://www.hp.com/support/manuals For related documentation, navigate to the Networking section, and select a networking category. For a complete list of acronyms and their definitions, see HP A-Series Acronyms. HP.com http://www.hp.com HP Networking http://www.hp.com/go/networking HP manuals http://www.hp.com/support/manuals HP download drivers and software http://www.hp.com/support/downloads HP software depot http://www.software.hp.com HP Education http://www.hp.com/learn 16
Conventions This section describes the conventions used in this documentation set. Command conventions Convention Boldface Italic Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. [ ] Square brackets enclose syntax choices (keywords or arguments) that are optional. { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk-marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one. Asterisk-marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times. # A line that starts with a pound (#) sign is comments. GUI conventions Convention Boldface Window names, button names, field names, and menu items are in bold text. For example, the New User window appears; click OK. > Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols Convention WARNING CAUTION IMPORTANT NOTE TIP An alert that calls attention to important information that if not understood or followed can result in personal injury. An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software. An alert that calls attention to essential information. An alert that contains additional or supplementary information. An alert that provides helpful information. 17
Network topology icons Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features. Represents a firewall chassis or a firewall module. Port numbering in examples The port numbers in this document are for illustration only and might be unavailable on your device. 18
Index A D N S W A alg,15 D display nat address-group,1 display nat all,1 display nat bound,3 display nat dns-map,4 display nat server,4 display nat static,5 display nat statistics,6 Documents,16 nat address-group,7 nat dns-map,8 nat outbound,9 nat outbound static,11 nat server,11 nat static,13 S Subscription service,16 W Websites,16 N 19