Huawei switch NAT technology for accessing the external network

Huawei NAT allows private network users to access public networks by translating private IP addresses to public IP addresses, supporting static, dynamic, and port-based translations.

Overview of NAT on Huawei Devices

Network Address Translation (NAT) is used to enable private network hosts to communicate with public networks while conserving public IPv4 addresses and enhancing security. NAT translates the source IP address of packets from private addresses to public addresses, allowing multiple internal hosts to share a single public IP if needed . Huawei devices support several NAT types:

• Static NAT: One-to-one mapping between a private IP and a public IP. Useful when a fixed public IP is required for a specific internal host .
• Dynamic NAT: Maps private IPs to public IPs from a pool dynamically. The mapping is temporary and changes with each session .
• NAPT (Network Address and Port Translation): One public IP can serve multiple private IPs by translating both IP addresses and port numbers. This is ideal for large networks with limited public IPs .
• Easy IP: Simplifies NAT configuration by using the interface IP as the public address, often used in scenarios where WAN IPs are dynamically assigned .

Working Principle

When a host on a private network sends a packet to the Internet, the Huawei switch/router performs the following steps:

1. Receives the packet from the internal host.
2. Checks the NAT rules and selects a public IP (and port if NAPT is used) from the configured pool.
3. Translates the source IP (and port) to the public IP.
4. Forwards the packet to the external network.
5. Maintains a NAT table to map return traffic back to the original private host .

Configuration Example

A typical NAT configuration on Huawei devices involves:

1. Defining a public IP address pool:

   nat address-group 1 192.168.34.100 192.168.34.200

2. Creating an ACL to match internal traffic:

   acl 2000rule permit ip source 10.0.10.0 0.0.0.255rule permit ip source 10.0.20.0 0.0.0.255

3. Applying NAT to the outbound interface:

   interface GigabitEthernet0/0/0nat outbound 2000 address-group 1

4. Optional NAPT configuration for port translation:

   nat outbound 2000 address-group 1 no-pat

This setup allows multiple internal subnets to access the Internet using a shared public IP range while maintaining security and address reuse .

Best Practices

• Use NAPT when public IPs are limited.
• Avoid using the same interface IP for NAT and protocol interactions like BGP to prevent packet loss during congestion .
• Ensure ACLs are properly configured to control which internal hosts can access external networks.
• Monitor NAT session capacity and expand VSUP subcards if needed for high traffic environments . Huawei NAT technology provides a flexible and secure solution for connecting private networks to the Internet while efficiently managing IPv4 address resources.