Manual Chapter :
Managing NAT Policies and Translations
Applies To:
Show Versions![Show Versions](/etc/designs/pcx/techdocs/images/expandversions.gif)
BIG-IQ Centralized Management
- 6.0.0
Managing NAT Policies and Translations
About NAT policies and translations
You can use network translation address (NAT) policies to translate network addresses. These
NAT policies contain rules that contain NAT source translations and NAT destination
translations.
You associate a NAT policy with a firewall context by adding it to the NAT Policy property of
the firewall context.
You can discover a NAT policy on a BIG-IP® device version 12.1 or later,
or create one on a BIG-IQ® Centralized Management system, and then deploy it
to a BIG-IP device version 12.1 or later.
When you view differences that include NAT
policy changes to the global context, those changes appear under the global-device-context object
rather than the global object.
Create a NAT policy
You create a NAT policy to contain rules that contain NAT source translations and
NAT destination translations.
- Go to the NAT Policies screen: Click.
- ClickCreate.The New NAT Policy screen opens with the Properties displayed.
- Type a name for the NAT policy in theNamefield.
- Type an optional description for the NAT policy in theDescriptionfield.
- If needed, change the defaultCommonpartition in thePartitionfield.
- On the left, clickRulesand then clickCreate Rule.A new row appears in the table of rules. The row contains a rule template, including defaults, for the new rule.
- Click the edit icon to the left of the rule name to edit the default rule properties.
- Complete the rule fields as appropriate.You can also add rules by right-clicking in the Rules table, or by right-clicking any row in the Rules table and choosing one of the options available.
- Save your changes.
The NAT policy is now defined and can be assigned to a firewall context.
NAT rule properties
This table lists and describes the properties required when configuring NAT policy
rules. These rules are similar to rules used in firewall policies, but have a different set of
properties.
Property | Description |
---|---|
Name | Unique, user-provided name for the rule, and optionally a
description. |
Address (Source) or Address
(Destination) | Source or destination address or addresses. Select the type of
address from the list:
|
Port (Source) or Port
(Destination) | Source or destination port or ports. Select the type of port from
the list:
|
Proxy ARP (Destination) | Select enabled to accept proxy ARP
requests for destination translation addresses. Select
disabled to not accept proxy ARP requests
for destination translation addresses. |
Route Advertisement (Destination) | Select enabled to enable advertising
traffic to dynamic routing protocols configured in the route domain.
Select disabled to disable route
advertisement. |
Protocol | IP protocol to compare against the packet. Select the appropriate
protocol from the list. Select Other to
specify an unlisted protocol. |
NAT Source Translation | Type the name of a NAT Source Translation. Alternatively, in the
Shared Objects area at the bottom, you can select NAT
Source Translations to list those available, and
then drag it to the NAT Source Translation column. |
NAT Destination Translation | Type the name of a NAT Destination Translations in the field.
Alternatively, in the Shared Objects area at the bottom, you can
select NAT Destination Translations to list
those available and then drag and drop it into the NAT Destination
Translation column. |
Log Profile | Enter the name of a logging profile in the field. This logging
profile must already be defined using Logging Profiles in Shared
Security and should be pinned to the BIG-IP device using the Shared
Security pinning policy. |
State | Specify whether the rule is enabled or disabled. The field is
updated. |
Create NAT source translations
You create NAT source translations
to use within a network address translation policy rule.
- Click.
- ClickCreate.The New NAT Source Translations screen opens.
- Type a name for the NAT source translations in theNamefield.
- In theDescriptionfield, type an optional description for the NAT source translations.
- If needed, change the defaultCommonin thePartitionfield.
- From theTypelist, specify the type of address translation to use.The type of address translation you select determines what additional properties are available.
- SelectStatic NATfor static network address translation.
- SelectStatic PATfor static network port and address translation.
- SelectDynamic PATfor dynamic network port and address translation.
- If you selectedStatic NATfor theType, supply values for the following settings.PropertyDescriptionAddressesAdd one or more addresses or address ranges by typing them and then clicking the+button. Remove them by clicking theXnext to the address or address range.ICMP EchoSelectenabledto make ICMP echoes available. Selectdisabledto make ICMP echoes unavailable.Proxy ARPSelectenabledto accept proxy ARP requests for source translation addresses. Selectdisabledto not accept proxy ARP requests for source translation addresses.Route AdvertisementSelectenabledto enable route advertisement. Selectdisabledto disable route advertisement.Egress Interfaces areaSpecify whether the source address is translated for egressing network traffic, and on what interfaces, such as the/Common/http-tunnelinterface.
- SelectDisabled onto disable source address translation for the specified interfaces, and then select the check box for the interfaces to be disabled.
- SelectEnabled onto enable source address translation for the specified interfaces and then select the check box for the interfaces to be enabled.
- If you selectedStatic PATfor theType, fill in the following settings.PropertyDescriptionAddressesAdd one or more addresses or address ranges by typing them and then clicking the+button. Remove them by clicking theXbutton next to the address or address range.PortsAdd one or more ports or port ranges by typing them and then clicking the+button. Remove them by clicking theXbutton next to the port or port range.ICMP EchoSelectenabledto make ICMP echoes available. Selectdisabledto make ICMP echoes unavailable.Proxy ARPSelectenabledto accept proxy ARP requests for source translation addresses. Selectdisabledto not accept proxy ARP requests for source translation addresses.Route AdvertisementSelectenabledto enable route advertisement. Selectdisabledto disable route advertisement.Egress Interfaces areaSpecify whether egress interfaces are available.
- SelectDisabled onto disable egress filtering interfaces.
- SelectEnabled onto disable egress filtering interfaces.
- If you selectedDynamic PATfor theType, supply values for the following settings.PropertyDescriptionAddressesAdd one or more addresses or address ranges by typing them and then clicking the+button. Remove them by clicking theXbutton next to the address or address range.PortsAdd one or more ports or port ranges by typing them and then clicking the+button. Remove them by clicking theXbutton next to the port or port range.ICMP EchoSelectenabledto make ICMP echoes available. Selectdisabledto make ICMP echoes unavailable.Proxy ARPSelectenabledto accept proxy ARP requests for source translation addresses. Selectdisabledto not accept proxy ARP requests for source translation addresses.Route AdvertisementSelectenabledto enable route advertisement. Selectdisabledto disable route advertisement.PAT ModeSpecify the port address translation mode. The mode you select determines what additional properties are available.
- SelectNAPT(default)
- SelectDeterministic
- SelectPort Block Allocation
Inbound ModeSpecify the inbound mode.- SelectNoneto disable inbound mode.
- SelectEndpoint Independent Filteringto use endpoint independent filtering.
MappingSpecify the mapping to use. For all mappings, the default timeout value is 300 seconds, and can be modified. The range is 0 to 31536000 seconds.- SelectNoneto disable inbound mode.
- SelectEndpoint Independent Mappingto use endpoint independent filtering.
- SelectAddress Pooling Pairedto use paired address pooling.
Client Connection LimitEnter a number as the maximum number of client connections allowed. The default is 0, which indicates no connection limit.Port Block AllocationSpecify numeric values for one or more of the following fields; the default is to not have a value set:- Block Idle Timeout. The range is 30 31536000 seconds.
- Block Life Time. The range is 0 to 31536000 seconds.
- Block Size. Must be 1 or greater, and less than or equal to the number of ports in the port range.
- Client Block Limit. Must be 1 or greater.
- Zombie Timeout. Must be 0 to 31536000 seconds.
Hairpin modeEnables or disables hairpinning for incoming connections to active translation end-points (address/port combinations). Specify the hairpin mode.- Selectenabledto enable hairpin mode.
- Selectdisabledto not enable hairpin mode.
Backup AddressesAdd one or more backup IP addresses by typing them and then clicking the+button. Remove them by clicking theXbutton next to the address This property is available when the deterministic PAT mode is set.Egress Interfaces areaSpecify whether egress interfaces are available.- SelectDisabled onto disable egress filtering interfaces.
- SelectEnabled onto disable egress filtering interfaces.
PCPSpecify the PCP profile to use.- In theProfilesetting, select the PCP profile to use.
- Specify either a self IP or a DS-Lite tunnel where PCP requests can be sent.
- SelectSelf IP, and then select a self IP address.
- SelectDSlite, and then select a DS-Lite tunnel.
DS-Lite tunnels cannot be created by BIG-IQ® Centralized Management. You must create them on the BIG-IP® device and then import them to BIG-IQ Centralized Management. - Save your work.
The NAT source translations are now
defined, and you can assign them to a rule used by a NAT policy.
Creating NAT destination translations
You create NAT destination
translations to use within a NAT policy rule.
- Click.
- ClickCreate.The NAT Destination Translations - New Item screen opens.
- Type a name for the NAT destination translations in theNamefield.
- In theDescriptionfield, type an optional description for the NAT destination translations.
- If needed, in thePartitionfield change the defaultCommonpartition.
- From theTypelist, select the type of address translation to use. The type of address translation you select determines what additional properties are available.
- SelectStatic NATfor static network address translation.
- SelectStatic PATfor static network port and address translation.
- If you selectedStatic NATorStatic PATfor theTypesetting, supply values for theAddressessetting.
- Add one or more addresses or address ranges by typing them in, and then clicking the+button.
- Remove the address or address range by clicking theXbutton next to it.
- If you selectedStatic PATfrom theTypelist, supply values for thePortssetting.
- Add one or more ports or port ranges by typing them in and then clicking the+button.
- Remove the port or port range by clicking theXbutton next to it.
- ClickSaveto save the NAT destination translations, or clickSave & Closeto save the NAT destination translations and return to the NAT Destination Translations screen.
The NAT destination translations are now defined and can be assigned to a rule used
by a NAT policy.