Jeff -
YES, you CAN perform H-REAP with NAT. However, as fella5 already mentioned, you can't do it with just plain old NAT, you must use static NAT and you cannot alter the destination ports. You should still be able to use multiple VLANs and trunks, but that will have to be routed by the time it hits the internet, and obviously won't work with standard SOHO equipment. I have tried this with a Netscreen firewall, and although I haven't had time to make it work, the join request made it to the controller. I used an additional public IP and only opened the necessary ports in the firewall for that IP. If I remember, the ports are 16666,16667,12222,12223 and 97. Here is an excerpt from the H-REAP Design and Deployment Guide (URL below):
-Regards,
Scott
http://www.cisco.com/en/US/products/ps6087/products_tech_note09186a0080736123.shtml#new
Does H-REAP work behind a NAT? In a deployment where Static NAT is used, can the WLC and H-REAP AP be placed behind Static NAT?
Yes, for the AP. Make sure that the AP source ports are not changed during the operation time by the NAT device. Normally with static NAT, it is not an issue. However, take these points into consideration:
*
There are two main NAT'ed UDP dialogs between the AP and controller: LWAPP data and LWAPP control.
*
Source port in the AP is a temporary dynamic port (>1024). In the controller, it is a fixed destination port (12222, 12223).
*
UDP translations are based on timeouts. This means that a current entry is left created for an X amount of time then deleted if not used, which is based on the timeout (could be shorter or longer depending on which is your NAT device).
*
LWAPP control is active. In general, you would expect that it will send one packet each 30 seconds (echo keepalive). Thus, for NAT translations for LWAPP control, you can assume that it will keep the NAT timeout refreshed.
*
LWAPP data only sends traffic if there is activity. For APs without any clients around, the LWAPP data NAT translation entry can expire (for example, more than 90 seconds without activity), and the NAT device creates a new entry if the AP sends new traffic. If the new entry is the same source port number, then you will not have any problems. However, if the UDP source port changes, then the WLC will drop it, as now the LWAPP data tunnel information no longer matches what was created before when the AP joined controller.
Therefore, it works as long as your NAT device preserves the UDP source port for traffic between the AP and the WLC at all times, even after UDP translation has expired due to no activity. If not, the data traffic is dropped, and you will end with the AP joined to the controller, but no data traffic for wireless clients.
