Chapter 7 NAT
3 tipos de NAT:
Source NAT
Destination NAT
Bidirectional NAT – combina a source e destination NAT para translation em ambas as direções
NAT Rulebases
O NAT usa rulebases diferentes para cada tipo de NAT, as rulebases são ordenadas numericamente e quando e feito um match o vRouter termina a execução da respectiva rulebase sem analisar outras rulebases.
Cada rulebase inclui 3 parâmetros:
Filtros, identificando o tráfego a ser Nated. Caso não seja definido nenhum filtro, todo e qualquer tráfego faz match.
Post-translation address, define o IP a ser substituído quando e feito o NAT. A opção masquerade usa o address da interface outbound
A interface onde a rule e aplicada e a direção.Deve ser especificada uma interface.
Caso seja especificado um port number no filtro ou post-translation address, deve ser especificado o Layer 4 protocol (TCP,UDP,ambos)
!NAT do tráfego com origem no source address usando o endereço da interface
vyatta@R1# show nat source
rule 10 {
source {
address 192.168.0.0/16
}
outbound-interface eth1
translation {
address masquerade
}
}
!Fazer o translate de vários port numbers de um IP Publico para um IP privado
vyatta@R1# show nat destination
rule 10 {
destination {
address 1.3.5.7
port 80
}
inbound-interface eth1
translation {
address 10.2.3.4
}
protocol tcp
}
rule 20 {
destination {
address 1.3.5.7
port 25
}
inbound-interface eth1
translation {
address 10.5.6.7
}
protocol tcp
}
rule 30 {
destination {
address 1.3.5.7
port 53
}
inbound-interface eth1
translation {
address 10.8.9.1
}
protocol udp
}
vyatta@R1:~$ show nat source rule
Disabled rules are not shown
Codes: X – exclude rule, M – masquerade rule
rule intf translation
—- —- ———–
M10 eth1 saddr 192.168.100.0/24 to 216.134.166.19
proto-all sport ANY
vyatta@R1:~$ show nat destination rules
Disabled rules are not shown
Codes: X – exclude rule
rule intf translation
—- —- ———–
10 eth1 daddr 1.3.5.7 to 10.2.3.4
proto-tcp dport 80
20 eth1 daddr 1.3.5.7 to 10.5.6.7
proto-tcp dport 25
30 eth1 daddr 1.3.5.7 to 10.8.9.1
proto-udp dport 53
vyatta@R1:~$ show nat source statistics
rule pkts bytes interface
—- —- —– ———10 528 38349 eth1
20 0 0 eth1
30 1359K 96M eth1
!Ver as NAT translations activas
vyatta@R1:~$ show nat source trans
Pre-NAT Post-NAT Prot Timeout
192.168.2.102 216.134.166.19 tcp 47
192.168.2.104 216.134.166.19 udp 0
192.168.2.102 216.134.166.19 udp 49
192.168.2.104 216.134.166.19 tcp 431740
192.168.2.104 216.134.166.19 tcp 431522
192.168.2.102 216.134.166.19 udp 179
192.168.2.104 216.134.166.19 tcp 431739
192.168.2.104 216.134.166.19 tcp 431988
192.168.2.104 216.134.166.19 tcp 431928
192.168.2.104 216.134.166.19 tcp 431810
192.168.2.106 216.134.166.19 tcp 326344
192.168.2.102 216.134.166.19 udp 28
192.168.2.102 216.134.166.19 udp 54
192.168.2.102 216.134.166.19 udp 179
192.168.2.104 216.134.166.19 udp 6
192.168.2.102 216.134.166.19 tcp 431848
Exclusion Filters
Permite excluir que sejam efetuados determinados NATs, por exemplo quando existem túneis VPN
Estes filters podem ser criados usando um ! ou “bang” como NOT Operator
vyatta@R1# show nat destination
rule 10 {
destination {
address 10.10.10.0/24
}
exclude
outbound-interface eth0
}
rule 40 {
outbound-interface eth0
translation {
address masquerade
}
}
Chapter 8 Licensing and Upgrades
Nota:Apartir de 1 Novembro 2013 o entitlement e processo de upgrade descrito neste documento já não se encontra disponível
Para registar o softawre e necessario configurar os seguintes parametros:
• Repository username
• Repository password
• Entitlement key
!Verificar se o vRouter foi registado com o Vyatta entitlement server
show entitlement
Upgrading the vRouter
Para efetuar upgrade usar o comando upgrade system image, este automaticamente
ira efectuar download da nova versão. É necessário ter pre-configurado os username/password de acesso ao repositório, senão serão solicitados os dados durante o upgrade
A imagem do vRouter tem 2 componentes: o próprio software vRouter e os respectivos controladores do Linux (drivers,system,..)
Caso o system template tenha sofrido alterações, e necessário efetuar um upgrade manual senão o processo de upgrade continua normalmente.
O processo manual e similar ao criar uma nova VM com alguns passos adicionais:
1. Download the new template just as you did for your initial installation.
2. Copy the configuration file from your existing virtual machine. You can use SCP or FTP to copy it to an
external server, or use simple copy-paste from a console window.
3. Edit the configuration file to remove the hardware-specific settings. We’ll show you the details of what to
remove on the next screen.
4. Install a new virtual machine using the new template.
5. When your new VM has booted up, copy your edited configuration file to /config/config.boot on the new
system. This is the default configuration file for the vRouter device.
6. Reboot your new VM. When it boots, it will read the hardware values from the hypervisor software, and
pull the rest of the configuration data from the configuration file you just copied over.
7. Once your new VM is fully operational, you can cut over operations from the old VM. This cut over
represents the only downtime your network will experience during the upgrade process, and should be
almost non-disruptive depending on your hypervisor software.
You can verify the success of your device upgrade with the commands show version and show system image
Referências:
Notas Estudo BCVRE 170-010 parte 1
Notas Estudo BCVRE 170-010 parte 2
Vyatta vRouter 5400 Online Documentation
Brocade Certified vRouter Engineer 2013 (BCVRE) Exam
Voucher gratuito Brocade Certified vRouter Engineer (BCVRE) 170-010 Exam
Network Functions Virtualization
Certification Brocade Community
Certification Exam Information