topic Server side NAT on ACE4710 in Application Networking

Server side NAT on ACE4710

atis — Tue, 18 Jun 2013 18:29:47 GMT

Hello,

I have a little config issue...

I have an ACE4710 loadbalancer, the load balancer have a public ip address on its uplink interface, and private address on its downlink interface.

There is a server connected to the downlink interface, and this server wants to set up a connection to the Internet, so the ACE should perform a NAT.

Somewhere I made a mistake or misunderstood something:

so first of all I created an access-list matched to the server ip address space:

access-list NAT_ACCESS line 10 extended permit ip <server ip address> any

then created a class-map matching to this ACL:

class-map match-any NAT_CLASS

match access-list NAT_ACCESS

then created a policy-map, containing which vlan the nat will occur:

policy-map multi-match NAT_POLICY

  class NAT_CLASS

    nat dynamic 1 vlan 100

After this I defined the nat pool on interface Vlan100

interface vlan 100

  <uplink interface, connected to Internet>

  ip address <public address>/<mask>

  nat-pool 1  <public address_1> netmask <mask> pat

  no shutdown

Finally assigned the policy-map to the downlink interface:

interface vlan 150
 <Downlink interface, connected to servers>
 ip address <privát cím>
 service-policy input NAT_POLICY
 no shut


 
This config didn't do any NAT, so where did I make the mistake?

BR, Attila

Server side NAT on ACE4710

chrhiggi — Tue, 18 Jun 2013 23:51:23 GMT

Hello Attila-

You actually want static nat. It is a 1:1 nat in and out. Remove everything and try this:

class-map match-any NAT_CLASS

2 match source-address 255.255.255.255

policy-map multi-match NAT_POLICY

 class NAT_CLASS

   nat static  netmask 255.255.255.255 vlan 100

interface vlan 150
 
 ip address 
 service-policy input NAT_POLICY
 no shut

Regards,

Chris Higgins

Server side NAT on ACE4710

atis — Wed, 19 Jun 2013 12:59:43 GMT

Later there will be more servers...

So I missed an interface acl on downlink interface:

access-list everyone extended permit ip any any

access-list everyone extended permit icmp any any

interface Vlan150

access-group input everyone

And it is working as expected.

BR, Attila