Brocade Communications Systems 5600 vRouter User manual

53-1003718-03
14 September 2015
Brocade 5600 vRouter
NAT
Reference Guide
Supporting Brocade 5600 vRouter 3.5R6

© 2015, Brocade Communications Systems, Inc. All Rights Reserved.
ADX, Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, HyperEdge, ICX, MLX, MyBrocade, OpenScript, The Effortless
Network, VCS, VDX, Vplane, and Vyatta are registered trademarks, and Fabric Vision and vADX are trademarks of Brocade
Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be
trademarks of others.
Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning any
equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to this document
at any time, without notice, and assumes no responsibility for its use. This informational document describes features that may not be
currently available. Contact a Brocade sales office for information on feature and product availability. Export of technical data contained in
this document may require an export license from the United States government.
The authors and Brocade Communications Systems, Inc. assume no liability or responsibility to any person or entity with respect to the
accuracy of this document or any loss, cost, liability, or damages arising from the information contained herein or the computer programs that
accompany it.
The product described by this document may contain open source software covered by the GNU General Public License or other open
source license agreements. To find out which open source software is included in Brocade products, view the licensing terms applicable to
the open source software, and obtain a copy of the programming source code, please visit http://www.brocade.com/support/oscd.

Contents
Preface.....................................................................................................................................5
Document conventions......................................................................................5
Text formatting conventions.................................................................. 5
Command syntax conventions.............................................................. 5
Notes, cautions, and warnings.............................................................. 6
Brocade resources............................................................................................ 7
Contacting Brocade Technical Support.............................................................7
Document feedback.......................................................................................... 8
About This Guide.......................................................................................................................9
NAT Overview.......................................................................................................................... 11
What is NAT?.................................................................................................. 11
Benefits of NAT............................................................................................... 12
Types of NAT.................................................................................................. 13
Source NAT (SNAT)............................................................................13
Destination NAT (DNAT).....................................................................14
Bidirectional NAT................................................................................ 14
NAT 6-4...........................................................................................................15
IPv4 and IPv6 address formats........................................................... 15
Packet processing...............................................................................16
NAT 6-4 sessions................................................................................16
What NAT 6-4 supports.......................................................................16
What NAT 6-4 does not support..........................................................17
Supported protocols............................................................................ 17
Main NAT 6-4 operations.................................................................... 17
One-way translation............................................................................ 17
Interaction between NAT, routing, firewall, and DNS......................................17
Traffic flow through firewall, NAT, and routing.................................... 17
Interaction between NAT and routing..................................................18
Interaction between NAT and firewall................................................. 20
Interaction between NAT and DNS..................................................... 22
NAT rules........................................................................................................ 22
Traffic filters.....................................................................................................23
The "outbound-interface" filter.............................................................23
The "inbound-interface" filter...............................................................23
The "protocol" filter..............................................................................23
The "source" filter................................................................................24
The "destination" filter......................................................................... 24
Address conversion: translation addresses.................................................... 24
Source address translations................................................................25
Destination address translations......................................................... 25
NAT Configuration Examples................................................................................................... 27
Source NAT (one-to-one)................................................................................27
Source NAT (many-to-one)............................................................................. 28
Source NAT (many-to-many).......................................................................... 29
Brocade 5600 vRouter NAT Reference Guide 3
53-1003718-03

Source NAT (one-to-many)...........................................................................30
Masquerade NAT..........................................................................................31
Destination NAT (one-to-one)....................................................................... 32
Scenario 1: Packets destined for an internal web server..................33
Scenario 2: Packets destined for an internal SSH server................. 33
Destination NAT (one-to-many).................................................................... 34
Bidirectional NAT.......................................................................................... 35
Mapping of address ranges.......................................................................... 36
The "exclude" option..................................................................................... 38
Source NAT and VPN: using the "exclude" option........................................39
The negation operator...................................................................................40
Address and port groups...............................................................................42
Configuring NAT 6-4..................................................................................... 43
NAT Commands.................................................................................................................... 45
clear nat........................................................................................................ 46
service nat.....................................................................................................47
service nat destination rule <rule-number>...................................................48
service nat destination rule <rule-number> description <description>..........49
service nat destination rule <rule-number> destination <destination>..........50
service nat destination rule <rule-number> disable...................................... 51
service nat destination rule <rule-number> exclude..................................... 52
service nat destination rule <rule-number> inbound-interface......................53
service nat destination rule <rule-number> log.............................................54
service nat destination rule <rule-number> protocol.....................................55
service nat destination rule <rule-number> source <address>.....................56
service nat destination rule <rule-number> translation <address>............... 57
service nat ipv6-to-ipv4 rule <rule-number> destination prefix
<dest_addr_prefix>..................................................................................58
service nat ipv6-to-ipv4 rule <rule-number> inbound-interface
<inbound_intf>.........................................................................................59
service nat ipv6-to-ipv4 rule <rule-number> source prefix
<src_addr_prefix>....................................................................................60
service nat source rule <rule-number> description <description>................ 61
service nat source rule <rule-number> destination <address>.....................62
service nat source rule <rule-number> disable.............................................63
service nat source rule <rule-number> exclude............................................64
service nat source rule <rule-number> log................................................... 65
service nat source rule <rule-number> outbound-interface <interface>....... 66
service nat source rule <rule-number> protocol <protocol>......................... 67
service nat source rule <rule-number> source <address>........................... 68
service nat source rule <rule-number> translation <address>......................69
show nat destination..................................................................................... 70
show nat source............................................................................................71
Related commands....................................................................................... 72
List of Acronyms....................................................................................................................73
4Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

Preface
● Document conventions......................................................................................................5
● Brocade resources............................................................................................................ 7
● Contacting Brocade Technical Support.............................................................................7
● Document feedback.......................................................................................................... 8
Document conventions
The document conventions describe text formatting conventions, command syntax conventions, and
important notice formats used in Brocade technical documentation.
Text formatting conventions
Text formatting conventions such as boldface, italic, or Courier font may be used in the flow of the text
to highlight specific words or phrases.
Format Description
bold text Identifies command names
Identifies keywords and operands
Identifies the names of user-manipulated GUI elements
Identifies text to enter at the GUI
italic text Identifies emphasis
Identifies variables
Identifies document titles
Courier font Identifies CLI output
Identifies command syntax examples
Command syntax conventions
Bold and italic text identify command syntax components. Delimiters and operators define groupings of
parameters and their logical relationships.
Convention Description
bold text Identifies command names, keywords, and command options.
italic text Identifies a variable.
value In Fibre Channel products, a fixed value provided as input to a command
option is printed in plain text, for example, --show WWN.
Brocade 5600 vRouter NAT Reference Guide 5
53-1003718-03

Convention Description
[ ] Syntax components displayed within square brackets are optional.
Default responses to system prompts are enclosed in square brackets.
{ x | y | z } A choice of required parameters is enclosed in curly brackets separated by
vertical bars. You must select one of the options.
In Fibre Channel products, square brackets may be used instead for this
purpose.
x | yA vertical bar separates mutually exclusive elements.
< > Nonprinting characters, for example, passwords, are enclosed in angle
brackets.
... Repeat the previous element, for example, member[member...].
\Indicates a “soft” line break in command examples. If a backslash separates
two lines of a command input, enter the entire command at the prompt without
the backslash.
Notes, cautions, and warnings
Notes, cautions, and warning statements may be used in this document. They are listed in the order of
increasing severity of potential hazards.
NOTE
A Note provides a tip, guidance, or advice, emphasizes important information, or provides a reference
to related information.
ATTENTION
An Attention statement indicates a stronger note, for example, to alert you when traffic might be
interrupted or the device might reboot.
CAUTION
A Caution statement alerts you to situations that can be potentially hazardous to you or cause
damage to hardware, firmware, software, or data.
DANGER
A Danger statement indicates conditions or situations that can be potentially lethal or
extremely hazardous to you. Safety labels are also attached directly to products to warn of
these conditions or situations.
Notes, cautions, and warnings
6 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

Brocade resources
Visit the Brocade website to locate related documentation for your product and additional Brocade
resources.
You can download additional publications supporting your product at www.brocade.com. Select the
Brocade Products tab to locate your product, then click the Brocade product name or image to open the
individual product page. The user manuals are available in the resources module at the bottom of the
page under the Documentation category.
To get up-to-the-minute information on Brocade products and resources, go to MyBrocade. You can
register at no cost to obtain a user ID and password.
Release notes are available on MyBrocade under Product Downloads.
White papers, online demonstrations, and data sheets are available through the Brocade website.
Contacting Brocade Technical Support
As a Brocade customer, you can contact Brocade Technical Support 24x7 online, by telephone, or by e-
mail. Brocade OEM customers contact their OEM/Solutions provider.
Brocade customers
For product support information and the latest information on contacting the Technical Assistance
Center, go to http://www.brocade.com/services-support/index.html.
If you have purchased Brocade product support directly from Brocade, use one of the following methods
to contact the Brocade Technical Assistance Center 24x7.
Online Telephone E-mail
Preferred method of contact for non-
urgent issues:
•My Cases through MyBrocade
•Software downloads and licensing
tools
•Knowledge Base
Required for Sev 1-Critical and Sev
2-High issues:
• Continental US: 1-800-752-8061
• Europe, Middle East, Africa, and
Asia Pacific: +800-AT FIBREE
([phone])
• For areas unable to access toll
free number: [phone]
•Toll-free numbers are available in
many countries.
[email protected]
Please include:
• Problem summary
• Serial number
• Installation details
• Environment description
Brocade OEM customers
If you have purchased Brocade product support from a Brocade OEM/Solution Provider, contact your
OEM/Solution Provider for all of your product support needs.
• OEM/Solution Providers are trained and certified by Brocade to support Brocade® products.
• Brocade provides backline support for issues that cannot be resolved by the OEM/Solution Provider.
Brocade resources
Brocade 5600 vRouter NAT Reference Guide 7
53-1003718-03

• Brocade Supplemental Support augments your existing OEM support contract, providing direct
access to Brocade expertise. For more information, contact Brocade or your OEM.
• For questions regarding service levels and response times, contact your OEM/Solution Provider.
Document feedback
To send feedback and report errors in the documentation you can use the feedback form posted with
the document or you can e-mail the documentation team.
Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and
completeness of this document. However, if you find an error or an omission, or you think that a topic
needs further development, we want to hear from you. You can provide feedback in two ways:
• Through the online feedback form in the HTML documents posted on www.brocade.com.
• By sending your feedback to [email protected].
Provide the publication title, part number, and as much detail as possible, including the topic heading
and page number if applicable, as well as your suggestions for improvement.
Document feedback
8 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

About This Guide
This guide describes how to configure NAT on the Brocade 5600 vRouter (referred to as a virtual router,
vRouter, or router in the guide).
Brocade 5600 vRouter NAT Reference Guide 9
53-1003718-03

About This Guide
10 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

NAT Overview
● What is NAT?.................................................................................................................. 11
● Benefits of NAT............................................................................................................... 12
● Types of NAT.................................................................................................................. 13
● NAT 6-4...........................................................................................................................15
● Interaction between NAT, routing, firewall, and DNS......................................................17
● NAT rules........................................................................................................................ 22
● Traffic filters.....................................................................................................................23
● Address conversion: translation addresses.................................................................... 24
What is NAT?
Network Address Translation (NAT) is a service that modifies address, port, or both types of information
within network packets as they pass through a computer or network device. The device that performs
NAT on the packets can be the source of the packets, the destination of the packets, or an intermediate
device on the path between the source and destination devices.
FIGURE 1 An example of a device that performs NAT
NAT was originally designed to help conserve the number of IP addresses used by the growing number
of devices accessing the Internet, but it also has important applications in network security.
The computers on an internal network can use any of the addresses set aside by the Internet Assigned
Numbers Authority (IANA) for private addressing (refer to RFC 1918). These reserved IP addresses are
not in use on the Internet, so an external machine does not directly route to them. The following
addresses are reserved for private use:
• 10.0.0.0 through 10.255.255.255 (CIDR: 10.0.0.0/8)
• 172.16.0.0 through 172.31.255.255 (CIDR: 172.16.0.0/12)
• 192.168.0.0 through 192.168.255.255 (CIDR: 192.168.0.0/16)
A NAT-enabled router can hide the IP addresses of an internal network from the external network by
replacing the internal, private IP addresses with public IP addresses that have been provided to it.
These public IP addresses are the only addresses that are ever exposed to the external network. The
router can manage a pool of multiple public IP addresses from which it can dynamically choose when
performing address replacement.
Be aware that, although NAT can minimize the possibility that internal computers make unsafe
connections to the external network, it provides no protection to a computer that, for one reason or
Brocade 5600 vRouter NAT Reference Guide 11
53-1003718-03

another, connects to an untrusted machine. Therefore, you should always combine NAT with packet
filtering and other features of a complete security policy to fully protect your network.
For more information, refer to IPsec Site-to-Site VPN Reference Guide.
Benefits of NAT
NAT confers the following advantages:
• NAT conserves public Internet address space.
Any number of hosts within a local network can use private IP addresses instead of consuming
public IP addresses. The addresses of packets that are transmitted from this network to the public
Internet are translated to the appropriate public IP address. This translation means that the same
private IP address space can be reused within any number of private networks, as shown in the
following figure.
FIGURE 2 Reusing private address space
• NAT enhances security.
IP addresses within a private (internal) network are hidden from the public (external) network. This
hiding of addresses makes it more difficult for hackers to initiate an attack on an internal host.
Benefits of NAT
12 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

However, private network hosts are still vulnerable to attack; therefore, NAT is typically combined
with firewall functionality.
FIGURE 3 NAT combined with firewall
• NAT is seamless.
Standard client/server network services work without modification through a NAT-enabled device.
• NAT facilitates network migration from one address space to another.
The address space within a private network that is having NAT performed on it is independent of the
public IP address. This independence means that the private network can be moved to a new public
IP address without changing network configurations within the private network. Likewise, the
addressing within the private network can change without affecting the public IP address.
• NAT simplifies routing.
NAT reduces the need to implement more complicated routing schemes within larger local networks.
Types of NAT
NAT has three main types:
• Source NAT. This NAT is also called SNAT. “Masquerade” NAT is a special type of SNAT.
• Destination NAT. This NAT is also called DNAT.
• Bidirectional NAT. When both SNAT and DNAT are configured, the result is bidirectional NAT.
Source NAT (SNAT)
Source NAT (SNAT) is the most common form of NAT. SNAT changes the source address of the
packets passing through the Brocade vRouter. SNAT is typically used when an internal (private) host
needs to initiate a session to an external (public) host; in this case, the device that is performing NAT
changes the private IP address of the source host to some public IP address, as shown in the following
figure. In “masquerade” NAT (a common type of SNAT), the source address of the outgoing packet is
replaced with the primary IP address of the outbound interface. The destination address of return
packets is automatically translated back to the IP address of the source host.
NOTE
SNAT is performed after the routing decision is made.
Types of NAT
Brocade 5600 vRouter NAT Reference Guide 13
53-1003718-03

The device that is performing NAT tracks information about the traffic flow so that traffic from the flow
can be correctly forwarded to and from the source host.
FIGURE 4 Source NAT (SNAT)
Destination NAT (DNAT)
While SNAT changes the source address of packets, destination NAT (DNAT) changes the destination
address of packets passing through the Brocade vRouter. DNAT is typically used when an external
(public) host needs to initiate a session with an internal (private) host; for example, when a subscriber
accesses a news service, as shown in the following figure. The source address of return packets is
automatically translated back to the IP address of the source host.
NOTE
DNAT is performed before the routing decision is made.
FIGURE 5 Destination NAT (DNAT)
Bidirectional NAT
Bidirectional NAT is just a scenario in which both SNAT and DNAT are configured at the same time.
Bidirectional NAT is typically used when internal hosts need to initiate sessions with external hosts and
external hosts need to initiate sessions with internal hosts. The following figure shows an example of
bidirectional NAT.
Destination NAT (DNAT)
14 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

FIGURE 6 Bidirectional NAT
NAT 6-4
The Brocade vRouter supports NAT 6-4, a translator that allows IPv6-only networks to communicate
with IPv4-only networks. The router forwards the IPv6 packets to the translator, which converts them
into IPv4 packets. The response IPv4 packets flow in the opposite direction with the NAT6-4 translator
converting IPv4 addresses into IPv6.
The following figure shows the flow of packets, which originate in an IPv6-only network.
FIGURE 7 NAT 6-4 packet flow
IPv4 and IPv6 address formats
To perform NAT 6-4 translation, the router rewrites an incoming IPv6 packet into an IPv4 address space
for the source and destination of the packet. This rewrite requires that the router modify the Ethernet
and the IP headers.
For more information about the IPv4 and IPv6 address formats, refer to RFC 6052 (section 2.2).
NAT 6-4
Brocade 5600 vRouter NAT Reference Guide 15
53-1003718-03

Packet processing
The following figure shows the forwarding pipeline stages for processing of incoming IPv6 packets.
Incoming IPv6 packets are processed by IPv6 (in) and IPv4 (in), and IPv4 (out) firewalls.
FIGURE 8 Forwarding pipeline stages
The following figure shows the reverse pipeline stages for processing incoming IPv4 packets.
Outgoing IPv4 packets are processed by the IPv4 (in), and IPv6 (in) and IPv6 (out) firewalls.
FIGURE 9 Reverse pipeline stages
NAT 6-4 sessions
You can display information about sessions that are created as a result of NAT 6-4 conversion by
using the show session-table command, as shown in the following example. This example shows a
NAT 6-4 session that is created to support an ICMP session.
vyatta@vyatta# run show session-table
TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,
FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,
TW - TIME WAIT, CL - CLOSE, LI - LISTEN
CONN ID Source Destination Protocol TIMEOUT Intf Parent
1 198.18.4.200 20.20.10.4 icmp [1] 14 dp0p224p1 0
What NAT 6-4 supports
The Brocade vRouter NAT 6-4 translator supports the following:
• TCP and UDP protocols and Internet Control Message Protocol (ICMP) echo requests.
NOTE
ICMP is supported only for echo requests and responses.
• Working with firewalls (stateful and stateless).
• Working with DNAT and SNAT.
• Address formats as specified in section 2.2 of RFC 6052.
• Stateful connection tracking and validation (by way of the NPF session table).
• Selective packet filtering of source and destination prefixes on the inbound interface of the IPv6
network.
Packet processing
16 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

What NAT 6-4 does not support
The Brocade vRouter NAT 6-4 translator does not support the following:
• Bidirectional NAT (SNAT and DNAT).
• Sessions initiated from an IPv4 network.
• Multihomed behavior in an IPv4 network.
Supported protocols
NAT 6-4 supports the following protocols:
• TCP
• UDP
• ICMP
Main NAT 6-4 operations
The NAT 6-4 translator maintains state and, for enabled interfaces, inspects the incoming IPv6 packets
that match the configured filter (the filter specifies the IPv6 prefix) to determine whether the packet
requires translation between IP versions.
Inspecting packets involves performing a lookup against configured IPv6 prefixes, deriving IPv4
addresses from IPv4 addresses, and performing lookups of IPv4 addresses against a table of converted
addresses for the reverse flow. Translation implies changes to the Ethernet frame, the IP header, and
updates to the TCP, UCP, and ICMP checksums. In brief, NAT 6-4 is highly invasive.
One-way translation
The Brocade vRouter NAT 6-4 translator supports one-way translation with the IPv6 network initiating
communication with the IPv4 network.
Interaction between NAT, routing, firewall, and DNS
One of the most important concepts to understand when working with NAT is the processing order of
the various services that might be configured within the Brocade vRouter. If the processing order of the
services is not considered, the results achieved might not be what you expect. This section covers the
following topics:
•Traffic flow through firewall, NAT, and routing on page 17
•Interaction between NAT and routing on page 18
•Interaction between NAT and firewall on page 20
•Interaction between NAT and DNS on page 22
Traffic flow through firewall, NAT, and routing
For example, if you are using DNAT, you should take care not to set up the system to route packets
based on particular external addresses. This routing method would not have the expected result
What NAT 6-4 does not support
Brocade 5600 vRouter NAT Reference Guide 17
53-1003718-03

because the addresses of external packets would have all been changed to internal addresses by
DNAT before routing.
The following figure shows the traffic flow between NAT, routing, and firewall within the Brocade
vRouter.
FIGURE 10 Traffic flow through the Brocade vRouter
Interaction between NAT and routing
When considering NAT in relation to routing, it is important to be aware how routing decisions are
made with respect to DNAT and SNAT. The scenarios in this section illustrate this point.
Scenario 1a: DNAT—Packets passing through the Brocade vRouter
In this scenario, packets originate in Network A and pass through the Brocade vRouter.
NOTE
DNAT—routing decisions are based on translated destination address.
Note that DNAT operates on the packets before the routing decision. This sequence means that
routing decisions based on the destination address are made relative to the translated destination
address—not the original destination address; refer to the following figure.
Interaction between NAT and routing
18 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03

FIGURE 11 Pass-through DNAT routing decisions
Scenario 1b: DNAT—Packets destined for the Brocade vRouter
In this scenario, packets are destined for a process within the Brocade vRouter. For packets destined
for the Brocade vRouter, routing decisions based on the destination address are made relative to the
translated destination address—not the original destination address.
Again, because DNAT operates on the packets before the routing decision, routing decisions based on
destination address are made on the translated destination address—not the original destination
address; refer to the following figure.
FIGURE 12 Brocade vRouter-destined DNAT routing decisions
Scenario 2a: SNAT—Packets passing through the Brocade vRouter
On the other hand, routing decisions are made before SNAT. This sequence means that routing
decisions based on the source address are made on the original source address—not the translated
source address.
NOTE
SNAT routing decisions are based on original source address.
Scenario 1b: DNAT—Packets destined for the Brocade vRouter
Brocade 5600 vRouter NAT Reference Guide 19
53-1003718-03

Scenario 2b: SNAT—Packets originating from the Brocade vRouter
In this scenario, packets originate with a process in the Brocade vRouter. Again, because routing
decisions are made before SNAT, operations based on source address are made on the translated
source address—not the original source address.
Interaction between NAT and firewall
When considering NAT in relation to firewall, it is important to understand the traffic flow between NAT
and firewall. In particular, it is important to keep in mind that firewall rule sets are evaluated at different
points in the traffic flow. The scenarios in this section illustrate this point.
Scenario 1a: DNAT—Packets passing through the Brocade vRouter
In this scenario, packets originate in Network A and pass through the Brocade vRouter. Note the
following rule applications:
• For firewall rule sets applied to inbound packets on an interface, the firewall rules are applied before
DNAT (that is, on the translated destination address).
• For rule sets applied to outbound packets on an interface, the firewall rules are applied after DNAT
(that is, on the translated destination address); refer to the following figure.
FIGURE 13 Pass-through DNAT firewall decisions
Scenario 1b: DNAT—Packets destined for the Brocade vRouter
In this scenario, packets are destined for a process within the Brocade vRouter. When firewall rule
sets are applied to locally bound packets on an interface, the firewall rules are applied before DNAT
(that is, on the translated destination address); refer to the following figure.
Scenario 2b: SNAT—Packets originating from the Brocade vRouter
20 Brocade 5600 vRouter NAT Reference Guide
53-1003718-03