Home > Security Appliances > NAT and Port Forwarding > Utilizing 1:1 NAT with Link Aggregation and Multiple Public IPs

Utilizing 1:1 NAT with Link Aggregation and Multiple Public IPs

Table of contents
No headers

Many networks require multiple public IP addresses for public facing resources.  This article will outline configuring 1:1 NAT rules on the MX security appliance with Link aggregation and multiple public IP addresses.

Configuration

You may have public facing resources that users and customers need to access from the Internet.  Port forwarding rules are used when the destination IP is the MX's Internet port IP address (either Internet port 1 or 2).  If the ISP is providing a block of public IP addresses, a 1:1 NAT rule is configured to map the public IP address to the internal LAN IP address of the resource.  These rules can be configured from Configure > Firewall > Forwarding rules.  

In the following example a 1:1 NAT rule will be configured for two web servers.  Each webserver will be using a different ISP (ie. a different Internet port on the MX):

 

Hostname:WebServer01

Service: web server  (TCP port 80)

Public IP: 3.3.3.3

 

Hostname:WebServer02

 

Service: E-mail server and web mail (TCP ports 25, 80, and 443)

 

Public IP: 5.5.5.5

 

In the dashboard we would select Add a 1:1 NAT mapping and enter the following information:

 

 

Name: name for the mapping

 

Public IP: the IP address from the ISP that devices on the Internet will connect

 

LAN IP: local IP address of the device

 

Uplink: interface the MX should receive the inbound traffic from

 

Allowed inbound connections: firewall rules allowing inbound connections to the LAN device on the specified ports


The next figure shows the configuration required for our example:

 




 

*Note: The only inbound connections that are allowed are the ports that are defined by Allow inbound connections.

Uplink Preferences

These mappings will allow the appropriate inbound connections to the LAN servers.  Outbound traffic from these devices will follow the configured Primary uplink (Configure > Traffic shaping > Uplink configuration) unless Link aggregation has been enabled (in this case you could not be certain which interface the traffic would egress).  An Uplink preference can be created to send traffic from a specific LAN host out a particular uplink.


In the above image we have created a preference to send all TCP/UDP traffic for WebServer02 out the Internet 2 uplink.  This preference was created to avoid asynchronous routing.  In our example, WebServer02, is also acting as a mail server.  When it communicates with other mail servers they are expecting the IP address of our mail server to be the same as the 1:1 NAT statement we created.  Without having the uplink preference this server would use the Internet port 1 uplink (and hence the Internet port 1 IP address).

You must to post a comment.
Last modified
21:05, 2 Feb 2015

Tags

This page has no custom tags.

Classifications

This page has no classifications.

Article ID

ID: 1414

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case