6-Huawei Firewall: configure NAT based on source IP address
Experiment 1: configure No-Pat
1. Basic configuration:
2. R1 enables the Telnet function:
[R1] user-interface vty 0 4
[R1-ui-vty0-4] authentication-mode password?
Please press ENTER to execute command
[R1-ui-vty0-4] authentication-mode password
Please configure the login password (maximum length 16): cisco
[R1-ui-vty0-4] user privilege level 15
3. Configure the inter-Zone policy from Trust to Untrust:
[SRG] policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound] policy create-mode auto-sort enable
[SRG-policy-interzone-trust-untrust-outbound] policy 5
[SRG-policy-interzone-trust-untrust-outbound-5] policy source 192.168.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-5] policy destination 202.100.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-5] policy service service-set telnet
[SRG-policy-interzone-trust-untrust-outbound-5] policy service service-set icmp
[SRG-policy-interzone-trust-untrust-outbound-5] action permit
4. The address of NAT is not translated before deployment:
Telnet 202.100.1.1
Login authentication
Password:cisco
5. Configure no-pat:
[SRG] nat address-group 1 202.100.1.10 202.100.1.20 / / create an address group
[SRG] nat-policy interzone trust untrust outbound / / create a NAT policy between Zone
[SRG-nat-policy-interzone-trust-untrust-outbound] policy 0
[SRG-nat-policy-interzone-trust-untrust-outbound-0] policy source 192.168.1.0 mask 24 / / Source address segment to be converted
[SRG-nat-policy-interzone-trust-untrust-outbound-0] address-group 1 no-pat / / translated address group and does not translate to port
[SRG-nat-policy-interzone-trust-untrust-outbound-0] action source-nat / / perform source conversion action
Test:
Telnet 202.100.1.1
View firewall session translation:
[SRG] display firewall session table verbose / / source port 50573, the translated port is still 50573
View the firewall Map:
[SRG] display firewall server-map
Experiment 2: configure PAT, port translation with external address pool
[SRG-nat-policy-interzone-trust-untrust-outbound-0] undo address-group
[SRG-nat-policy-interzone-trust-untrust-outbound-0] address-group 1
Test:
Telnet 202.100.1.1
[SRG] display firewall session table verbose
III. Experiment 3: configure Easy-IP to convert 192.168.1.2 to USG's g0Uniplet0 interface address.
[SRG] nat-policy interzone trust untrust outbound
[SRG-nat-policy-interzone-trust-untrust-outbound-1] policy 0
[SRG-nat-policy-interzone-trust-untrust-outbound-0] undo address-group
[SRG-nat-policy-interzone-trust-untrust-outbound-0] easy-ip GigabitEthernet 0/0/0
Test:
[SRG] display firewall session table verbose
