CLI: Example for Configuring Intranet Users to Access the Public Addresses of Intranet Servers (Source NAT+Static Destination NAT)

This section provides an example for configuring intranet users to access the public IP addresses of intranet servers.

Networking Requirements

An enterprise has deployed a FW as a security gateway on the intranet border. NAT Server is configured on the FW for the intranet web and File Transfer Protocol (FTP) servers to provide services for Internet users. PC D on the same network segment and security zone with the two servers. Source NAT is configured on the FW so that PC D can use a public address to access the two intranet servers.

The enterprise applies for two public IP addresses:

1.1.10.10 used by intranet servers.
1.1.1.11 into which PC D's private address is translated.

Figure 1 illustrates the networking for a source NAT policy in outbound interface mode. The router is an access gateway on the ISP network.

Figure 1 Networking diagram for configuring intranet users to access the public IP addresses of intranet servers (source NAT+destination NAT)

Data Planning

Item		Data	Description
GigabitEthernet 0/0/1		IP address: 1.1.1.1/24 Security zone: Untrust	1.1.1.1/24 is a public address provided by the ISP.
GigabitEthernet 0/0/2		IP address: 10.2.0.1/24 Security zone: DMZ	Intranet servers use 10.2.0.1 as the default gateway address.
Addresses in the source NAT address pool		1.1.1.11	-
Addresses in the destination NAT address pool		10.2.0.7 to 10.2.0.8	-
Routing information	Default route	Destination address: 0.0.0.0 Next hop address: 1.1.1.254	Configure a default route on the FW to direct intranet traffic to the ISP network.

Configuration Roadmap

Assign IP addresses to interfaces, add the interfaces to security zones, and configure network connectivity.
Configure a security policy for traffic between intranet users and intranet servers.
Configure NAT Server. Configure two server mapping entries, one for the web server and the other for the FTP server.
Configure a source NAT policy to allow PC D to access the intranet servers based on the servers' public address.
Configure a default route on the FW to direct intranet traffic to the ISP router.
Configure static routes destined for public addresses of intranet servers on the router.

Procedure

Assign IP addresses to interfaces, add the interfaces to security zones, and configure network connectivity.

# Assign an IP address to GigabitEthernet 0/0/1.

<FW> system-view
[FW] interface GigabitEthernet 0/0/1
[FW-GigabitEthernet 0/0/1] ip address 1.1.1.1 24
[FW-GigabitEthernet 0/0/1] quit

# Assign an IP address to GigabitEthernet 0/0/2.

[FW] interface GigabitEthernet 0/0/2
[FW-GigabitEthernet 0/0/2] ip address 10.2.0.1 24
[FW-GigabitEthernet 0/0/2] quit

# Add GigabitEthernet 0/0/1 to the Untrust zone.

[FW] firewall zone untrust
[FW-zone-untrust] add interface GigabitEthernet 0/0/1
[FW-zone-untrust] quit

# Add GigabitEthernet 0/0/2 to the DMZ zone.

[FW] firewall zone dmz
[FW-zone-dmz] add interface GigabitEthernet 0/0/2
[FW-zone-dmz] quit

Configure a security policy.

[FW] security-policy
[FW-policy-security] rule name policy1
[FW-policy-security-rule-policy1] source-zone dmz
[FW-policy-security-rule-policy1] destination-zone dmz
[FW-policy-security-rule-policy1] destination-address 10.2.0.0 24
[FW-policy-security-rule-policy1] action permit
[FW-policy-security-rule-policy1] quit
[FW-policy-security] quit

Configure a source NAT address pool.

[FW] nat address-group addressgroup1
[FW-address-group-addressgroup1] mode pat
[FW-address-group-addressgroup1] section 0 1.1.1.11 1.1.1.11
[FW-address-group-addressgroup1] route enable
[FW-address-group-addressgroup1] quit

Configure a destination NAT address pool.

[FW] destination-nat address-group addressgroup2
[FW-dnat-address-group-addressgroup2] section 10.2.0.7 10.2.0.8
[FW-dnat-address-group-addressgroup2] quit

Configure a source NAT policy.

[FW] nat-policy
[FW-policy-nat] rule name policy_nat1
[FW-policy-nat-rule-policy_nat1] source-zone dmz
[FW-policy-nat-rule-policy_nat1] source-address 10.2.0.6 24
[FW-policy-nat-rule-policy_nat1] destination-address 1.1.10.10 32
[FW-policy-nat-rule-policy_nat1] service protocol tcp destination-port 3000 to 3001
[FW-policy-nat-rule-policy_nat1] action source-nat address-group addressgroup1
[FW-policy-nat-rule-policy_nat1] action destination-nat static port-to-address address-group addressgroup2 2000
[FW-policy-nat-rule-policy_nat1] quit
[FW-policy-nat] quit

Configure black-hole routes destined to the destination address of traffic to prevent routing loops.
```
[FW] ip route-static 1.1.10.10 255.255.255.255 NULL0 
```

Enable NAT ALG for FTP.

[FW] firewall zone dmz
[FW-zone-dmz] detect ftp
[FW-zone-dmz] quit
[FW] firewall interzone dmz untrust
[FW-interzone-dmz-untrust] detect ftp
[FW-interzone-dmz-untrust] quit

Configure a default route to direct intranet traffic to the ISP router.
```
[FW] ip route-static 0.0.0.0 0.0.0.0 1.1.1.254
```
Configure a blackhole route to prevent routing loops between the FW and router.
```
[FW] ip route-static 1.1.10.10 32 NULL 0
```
Configure a static route to public address (1.1.10.10) with the next hop being 1.1.1.1 on the router so that traffic destined for the server can be sent to the FW.
Contact your ISP administrator to perform this step.

Configuration Scripts

Configuration script for the FW:

#
 sysname FW
#
interface GigabitEthernet0/0/1
 undo shutdown
 ip address 1.1.1.1 255.255.255.0 
#
interface GigabitEthernet0/0/2
 undo shutdown
 ip address 10.2.0.1 255.255.255.0 
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#
firewall zone dmz
 set priority 50
 add interface GigabitEthernet0/0/2
 detect ftp
# 
firewall interzone dmz untrust 
 detect ftp 
#
 ip route-static 0.0.0.0 0.0.0.0 1.1.1.254 
 ip route-static 1.1.10.10 255.255.255.255 NULL0 
# 
nat address-group addressgroup1 0
 mode pat
 route enable
 section 0 1.1.1.11 1.1.1.11 
# 
destination-nat address-group addressgroup2 0
 section 10.2.0.7 10.2.0.8 
#  
security-policy   
  rule name policy1  
    source-zone dmz  
    destination-zone dmz
    destination-address 10.2.0.0 24 
    action permit 
#  
nat-policy  
  rule name policy_nat1 
    source-zone dmz 
    source-address 10.2.0.6 24
    destination-address 1.1.10.10 32
    service protocol tcp destination-port  3000 to 3001
    action source-nat address-group addressgroup1 
    action destination-nat static port-to-address address-group addressgroup2 2000
# 
return