Link Search Menu Expand Document

NAT

Configuration > Networking > NAT

NAT allows for multiple sites with overlapping IP addresses to connect to a single SD-WAN fabric. You can configure SNAT (Source Network Address Translation), DNAT (Destination Network Address Translation), destination TCP, and UDP port translation rules that apply to all LAN to WAN traffic in the ingress and egress directions. Configured rules apply to all traffic including tunneled traffic, internet bound traffic, and other passthrough traffic. The following address translation options are supported:

  • 1:1 source and destination IP address translation

  • 1:1 subnet to subnet source and destination IP address translation

  • Many to one IP source address translation

  • NAT pools for translated source IP address

You can view both NAT rules and NAT pools within your network by selecting NAT Rules or NAT Pools at the top of the page. You can also export a CSV file of your branch NAT traffic. Select the Edit icon to add rules to your NAT and NAT pools.

NAT Rules and Pools

You can add NAT rules and configure NAT pools from the NAT tab.

NAT Rules

Each NAT rule has a directional field or value. Outbound rules are applied to the traffic flows initiated from the LAN and destined to the WAN. Inbound rules are applied to the traffic flows initiated from the WAN and destined to the LAN. They include all tunneled traffic, internet bound traffic, and other passthrough traffic. Return traffic for a given flow does not require an additional rule. The destination IP address must be configured for each rule.

NOTE: You must disable advertisements of local, static routes on the LAN side at the site so routes are completely unique. Additionally, you must configure announce-only static routes for your NAT pools and advertise them to the WAN by allowing those routes in your “Redistribute routes to SD-WAN fabric” route map.

Complete the following steps to add a rule to your NAT:

  1. On the NAT tab, click the edit icon next to an appliance name.

    The NAT dialog box opens.

  2. Click Add Rule.

  3. Enter the following values in the table by selecting any of the columns.

    Field Description
    Priority Order in which the rules are executed; the lower the priority, the higher the chance your NAT rule will be applied.
    LAN Interface Name of the LAN interface the NAT rule is using. This is configurable for an outbound NAT rule only.
    Segment Name of the segment being used.
    Direction Select the direction the traffic is going:

    Outbound (LAN to Fabric)

    Inbound (Fabric to LAN)
    Protocol Type of protocol being used for each NAT.
    Source Original source IP address of the IP packet.
    Destination Address of the LAN/WAN interface where the traffic is going to.
    Translated Source Translated source IP address when the NAT rule is applied.
    Translated Destination Translated destination IP address when the NAT rule is applied.
    Enabled Select this check box to enable your customized NAT rule. Direction can be both inbound or outbound.
    Comment Any comment you want to add pertaining to your NAT rule.
    Criteria Match: LAN interface, direction, source, destination

    Set: Translated source, translated destination
  4. Click Save.

NAT Pools

You also have the option to configure a NAT pool. Complete the following steps to create a NAT pool:

  1. On the NAT tab, click the edit icon next to an appliance name.

    The NAT dialog box opens.

  2. Click NAT Pools.

    The NAT Pools dialog box opens.

  3. Click Add.

  4. Enter the following values in the table by selecting any of the columns.

    Field Description
    Name Name of your pool.
    Direction Specify whether the traffic is outbound or inbound.
    Subnet IP address of the subnet.
    Translate Ports Enable source port address translation if the NAT pool is too small to accommodate multiple flows simultaneously with 1:1 IP address translation.
  5. Click Save.

    A confirmation message appears at the bottom of the screen.


Back to top

© Copyright 2024 Hewlett Packard Enterprise Development LP.

To view the end-user software agreement, go to HPE Aruba Networking EULA.

Open Source Code:

This product includes code licensed under certain open source licenses which require source compliance. The corresponding source for these components is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise Company. To obtain such source code, please check if the code is available in the HPE Software Center at https://myenterpriselicense.hpe.com/cwp-ui/software but, if not, send a written request for specific software version and product for which you want the open source code. Along with the request, please send a check or money order in the amount of US $10.00 to:

Hewlett Packard Enterprise Company
Attn: General Counsel
WW Corporate Headquarters
1701 E Mossy Oaks Rd Spring, TX 77389
United States of America