BROCADE IP PRIMER

Chapter 14: Security, Redundancy and MoreThe DNS server will not only need to get out to the Internet, but the Internet willneed to be able to come to it. This requires a one-to-one relationship, which, asyou may recall from Chapter 2, describes true NAT. There are two stepsinvolved in this. The first step is to define the translations. We're advertising apublic IP address range of 1.2.4.0/24. Let's use 1.2.4.6 as our public addressfor the DNS server:BR-SwitchA#conf tBR-SwitchA(config)#ip nat inside source static 10.1.1.21.2.4.6The command tells the switch to translate the packets with a source addressof 10.1.1.2 with the public address 1.2.4.6. Likewise, the switch also knows totranslate inbound packets for 1.2.4.6 to 10.1.1.2. But we haven't activated theNAT yet. This is the second step. To activate the NAT, we need to define therouter interfaces involved as either being on the inside or the outside. On thisswitch, we will want to designate interface ve 1 as inside (this is the routerinterface facing the DNS server), but we will want to set e 1 and e 2 as outside.In other words, when traffic from the DNS server leaves e 1 or e 2, NAT will beapplied (e.g., the address will be translated). To do this, we enter the following:BR-SwitchA#conf tBR-SwitchA(config)#int ve 1BR-SwitchA(config-vif-1)#ip nat insideBR-SwitchA(config)#int e 1BR-SwitchA(config-if-e1000-1)#ip nat outsideBR-SwitchA(config)#int e 2BR-SwitchA(config-if-e1000-2)#ip nat outsideThe static NAT is now configured. The DNS server can get out to the Internet,and the Internet can reach it as well.Now, let's say we need to configure PAT (Port Address Translation). We'd likethe entire 10.1.1.0/24 network (except for 10.1.1.2, of course) to share a singlepublic IP address, 1.2.4.8. First, we need to create an ACL to define thetraffic that we would like to NAT:BR-SwitchA#conf tBR-SwitchA(config)#ip access-list extended Net10NATBR-SwitchA(config-ext-nacl)#deny ip host 10.1.1.2 anyBR-SwitchA(config-ext-nacl)#permit ip 10.1.1.0 0.0.0.255 anyHey, why is there a “deny” line? Well, we wanted to make sure that our DNSserver doesn't participate in this pool. After all, the DNS server has its ownstatic NAT address. The second line clearly permits all other addresses from10.1.1.0/24. Remember that this is not permitting or denying traffic. This is“matching” or “not matching” traffic. Traffic with a source IP address of10.1.1.2 will not match (as shown by the “deny” line). Traffic with a source IPaddress in the 10.1.1.0/24 network will match (as shown by the last line).Next, we need to define the pool of addresses that the source may translateto. In this case, the pool only has one address (1.2.4.8). This still needs to berepresented as range.308 Brocade IP Primer