Network Security and Services · Topic 4 of 4

Source, Destination and Bidirectional NAT

Learn static NAT, NAT No-PAT, NAPT, Easy IP, NAT Server and bidirectional NAT, with nat outbound and nat server setup on Huawei AR routers for HCIA.

6 min

In a nutshell

Source NAT changes the source of outgoing traffic. Destination NAT changes the destination of incoming traffic.
NAT No-PAT translates addresses only, NAPT translates addresses and ports, Easy IP is NAPT with the interface address.
nat outbound with no-pat is NAT No-PAT, with only an address group is NAPT, with only an ACL is Easy IP.

What it is

NAT (Network Address Translation) changes the IP addresses, and often the ports, in packet headers as they pass a device. Its main job is to let hosts with private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) reach the internet through a few public addresses.

NAT saves public IPv4 addresses and hides the internal address plan, but it breaks true end to end addressing.

How it works

Kinds of NAT

Kind	What is translated	Typical use
Source NAT	The source address of traffic going out	Inside users reach the internet
Destination NAT	The destination address of traffic coming in	Internet users reach an inside server
Bidirectional NAT	Both source and destination of the same flow	Special routing cases, described below
Static NAT	One fixed private address to one fixed public address, both directions	A host that needs a permanent public address

The device keeps a NAT session table that records each translation, so replies can be translated back. Only traffic matching the configured rule, usually an ACL, is translated.

Source NAT types

Type	Address source	Ports translated	Mapping
NAT No-PAT	Address pool	No	One private address uses one public address at a time
NAPT	Address pool	Yes	Many private addresses share each public address, told apart by port
Easy IP	The outbound interface's own address	Yes	Many private addresses share the interface address

NAT No-PAT (dynamic NAT) still needs as many public addresses as hosts online at once. NAPT maps each inside address and port to a public address and a new port, so a small pool serves many hosts. Easy IP is NAPT using the interface address, ideal when that address is assigned dynamically by DHCP or PPPoE.

Source NAT configuration on an AR router

The ACL selects which inside traffic is translated, and nat outbound is applied on the outside interface.

[R1] acl 2000
[R1-acl-basic-2000] rule 5 permit source 192.168.1.0 0.0.0.255
[R1-acl-basic-2000] quit
[R1] nat address-group 1 202.1.1.10 202.1.1.20
[R1] interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1] nat outbound 2000 address-group 1

Command on the outside interface	Result
`nat outbound 2000 address-group 1 no-pat`	NAT No-PAT
`nat outbound 2000 address-group 1`	NAPT
`nat outbound 2000`	Easy IP, using this interface's address

The outside network also needs a route, usually a default route, toward the internet.

Destination NAT and NAT Server

NAT Server publishes an inside server on a public address and port. Traffic from the internet to that public address is translated to the server's private address.

[R1] interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1] nat server protocol tcp global 202.1.1.5 www inside 192.168.1.100 8080

Here internet users browse to 202.1.1.5 on port 80 (www) and reach 192.168.1.100 on port 8080. With nat server global 202.1.1.6 inside 192.168.1.101, every port of the public address is mapped to the server.

Static NAT is configured with nat static global 202.1.1.3 inside 192.168.1.3. It is one to one and works in both directions: outgoing traffic from 192.168.1.3 uses 202.1.1.3, and incoming traffic to 202.1.1.3 reaches 192.168.1.3.

Bidirectional NAT

In bidirectional NAT, the device translates the destination address and the source address of the same flow. It is used when destination NAT alone is not enough.

A common case: an internet client 1.1.1.1 reaches a published server at 202.1.1.5. The device changes the destination to the server's private address 192.168.1.100, and also changes the source from 1.1.1.1 to an inside address of its own, such as 192.168.1.200. The server then sees a client on its own subnet and replies to the NAT device, even if its default gateway or routes do not point there.

Huawei firewalls configure it as a NAT Server mapping combined with a source NAT policy for the same traffic.

Checking NAT

Use display nat outbound and display nat server to see the configuration, and display nat session all to see live translations.

A worked example

R1 uses nat outbound 2000 on GigabitEthernet0/0/1, which gets its address from the ISP by DHCP. Inside hosts reach the internet, all sharing the interface address with different ports. That is Easy IP.

A web server inside must also be reachable from outside, but R1 has no spare public address. nat server protocol tcp global current-interface www inside 192.168.1.100 www publishes the server on the interface address.

How the exam asks about this

"Which NAT type translates many private addresses to the outbound interface address?" → Easy IP.
"Which NAT type maps addresses one to one from a pool without translating ports?" → NAT No-PAT.
"Which feature lets internet users reach an inside web server through a public address?" → NAT Server (destination NAT).

What to remember for the exam

Source NAT changes the source of outgoing traffic. Destination NAT changes the destination of incoming traffic.
NAT No-PAT translates addresses only, NAPT translates addresses and ports, Easy IP is NAPT with the interface address.
nat outbound with no-pat is NAT No-PAT, with only an address group is NAPT, with only an ACL is Easy IP.
NAT Server is configured with nat server on the outside interface and maps public address and port to a private address and port.
Bidirectional NAT translates both source and destination of one flow.

Watch out

NAT No-PAT does not save addresses the way NAPT does. Each inside host online at the same time still needs its own public address from the pool.

Common mistakes

Applying nat outbound on the inside interface. The command belongs on the outside (public) interface, where the translated traffic leaves.

Calling NAT Server source NAT. NAT Server translates the destination of traffic arriving from outside. It is the main form of destination NAT.

Forgetting the ACL. nat outbound translates only traffic the ACL permits. Hosts outside the ACL ranges are not translated and fail to reach the internet.

Check yourself

What does the no-pat keyword change in nat outbound 2000 address-group 1 no-pat?
Ports are not translated, so each inside address takes a whole public address from the pool (NAT No-PAT).
Why is Easy IP suited to a router whose public address comes from DHCP?
It always uses the outbound interface's current address, so no fixed address pool is needed.
Which command shows the live NAT translations?
display nat session all, which lists each session with its inside and translated addresses and ports.

Topic 4 of 4 in Network Security and Services

Test yourself on Network Security and Services

The full Huawei HCIA-Datacom H12-811 question bank has 600 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.