Configuring NAT Security

NAT security can be implemented by setting the maximum number of NAT sessions that can be established and the rate at which the first packet is sent to create a flow for a specific user.

Usage Scenario

You can deploy the NAT security function to guarantee secure operations on a NAT device and prevent attacks.

Pre-configuration Tasks

Before configuring the NAT security function, complete the following task:

Configure basic NAT functions.
Configure NAT for traffic.

Configuring a Limit on the Maximum Number of User-to-Network NAT Sessions: A forward session is established for packets transmitted from the user side to the network side. To prevent individual users from consuming excessive session table resources to cause failures to establish connections for other users, you can set a limit on the maximum number of user-to-network NAT sessions that can be established for a specific user.

Configuring a Limit on the Maximum Number of Network-to-User NAT Sessions: A reverse session is established for packets transmitted from the network side to the user side. To prevent individual users from consuming excessive session resources to cause failures to establish connections for other users, you can set a limit on the maximum number of network-to-user NAT sessions that can be established for a specific user.

Setting the Rate at Which Packets Are Sent to Create a Flow for a User: A device can be configured to dynamically detect the traffic forwarding rate and limit the rate at which packets are sent to create a flow for each user.

Configuring the Rate Limit at Which the First Packet Is Sent to Create a Flow: Limiting the rate at which the first packet is sent to the CPU of a service board to create a flow prevents users from using a large number of CPU resources through first packet attack and thereby ensuring the forwarding of normal traffic.

Verifying the NAT Security Configuration: After configuring the NAT security functions, you can run display commands to check the configuration.